3 ms·

If accurate, at least one of the hosts in question indicated the user was root. Perhaps it was running in a container. Regardless, this malicious package could

If accurate, at least one of the hosts in question indicated the user was root. Perhaps it was running in a container. Regardless, this malicious package could be used for data exfiltration or other nefarious things.

riceart 4y ago
> user was root In a well designed zero trust network this makes little difference. The traditional posix security model is bogus from the start anyway. A lot more useful stuff you can exfiltrate as a regular user usually.
eternalban 4y ago
But they have already explained (at the end) that in any event, "Googlers can download and run arbitrary code on their machines", with the implication being that Google already thought about and had to deal with this general issue a long time ago. What this exploit does is invert the how of this "arbitrary code" running on google machines, but it makes perfect sense that Google's security protections couldn't care less how the code ended up on some dev's machine since they themselves could have just explicitly pulled it from the net.
- Initial_BP 4y ago
  Not directly relevant but interesting... https://github.com/google/santa https://github.com/google/santa This is a product developed by Google that has at least been utilized internally to some extent. It's not perfect, but my previous company used it and it does prevent unexpected unknown code from running in the background. What it does not do is prevent someone from intentionally downloading and executing a library unless the upvoter actually comes to some demand that you do so. I found that it quickly became a bit of a "alert fatigue" where you approve things your coworkers send you so they can get back to work without properly vetting.
  - saagarjha 4y ago
    Many developers have this set to “only block known malware” for obvious reasons.
  - eternalban 4y ago
    Thank you for sharing this! This is very cool. I'd use this on my personal laptop. It has a pure local mode.
mjg59 4y ago
If an attacker has arbitrary code execution as a user with sudo access (ie, basically any developer system), then the user/root distinction is basically meaningless.

riceart 4y ago

> user was root In a well designed zero trust network this makes little difference. The traditional posix security model is bogus from the start anyway. A lot more useful stuff you can exfiltrate as a regular user usually.

eternalban 4y ago

But they have already explained (at the end) that in any event, "Googlers can download and run arbitrary code on their machines", with the implication being that Google already thought about and had to deal with this general issue a long time ago. What this exploit does is invert the how of this "arbitrary code" running on google machines, but it makes perfect sense that Google's security protections couldn't care less how the code ended up on some dev's machine since they themselves could have just explicitly pulled it from the net.

Initial_BP 4y ago
Not directly relevant but interesting... https://github.com/google/santa https://github.com/google/santa This is a product developed by Google that has at least been utilized internally to some extent. It's not perfect, but my previous company used it and it does prevent unexpected unknown code from running in the background. What it does not do is prevent someone from intentionally downloading and executing a library unless the upvoter actually comes to some demand that you do so. I found that it quickly became a bit of a "alert fatigue" where you approve things your coworkers send you so they can get back to work without properly vetting.
- saagarjha 4y ago
  Many developers have this set to “only block known malware” for obvious reasons.
- eternalban 4y ago
  Thank you for sharing this! This is very cool. I'd use this on my personal laptop. It has a pure local mode.

mjg59 4y ago

If an attacker has arbitrary code execution as a user with sudo access (ie, basically any developer system), then the user/root distinction is basically meaningless.