4 ms·

By the number of malicious packages that site has hosted over the past few months, this was only a matter of time. I've lost track of the number of "white hats

By the number of malicious packages that site has hosted over the past few months, this was only a matter of time. I've lost track of the number of "white hats" that contact us with extortion requests after they used some dependency confusion attack.

Mystery-Machine 3y ago
Why is it an extortion request and "white hats" if they have successfully found a security issue in your project and reported it to you, without actually exploiting it? Would you rather them not report it to you or even worse, exploit it?
- cjsawyer 3y ago
  Sounds like they’re the ones who implemented the bad code in the first place, as a honeypot. That just extortion with extra steps.
- JadeNB 3y ago
  > Why is it an extortion request and "white hats" if they have successfully found a security issue in your project and reported it to you, without actually exploiting it? Presumably because there is some demand for compensation before disclosure?
- dahwolf 3y ago
  Pay me or I will harm you is extortion, as simple as that. There's an entire industry now of people that check known vulnerabilities (so they don't invent anything themselves) in software/packages and cross check this against outdated websites, at a very large scale. They have no morals or security ethics, they barely even have knowledge, they just want to make money with the least amount of effort possible. Don't ever pay them a cent. They're just as ruthless as spammers.
  - autoexec 3y ago
    If several groups of people who "barely even have knowledge" can profit from checking for well known vulnerabilities on websites and reporting them I say more power to them. If there is an entire industry of people doing low effort work which then discovers vulnerabilities on a company's website that company should pay them, and probably fire some people they've already been paying for not putting in even that much effort to secure their own stuff. Who is less ethical? The people reporting vulnerabilities and wanting to be paid for it or the companies who don't bother to invest in even basic security practices putting people's data at risk and allowing scammers and hackers to leverage those insecure systems to hurt others?
    - dahwolf 3y ago
      The word "companies" is doing a lot of work in your rant. The vast majority of websites on the internet do not have a team behind them. That's exactly the reason why they lack maintenance. So they're not intimidating well-funded companies, they're intimidating that nice guy that in 2003 build a website for the local bridge club. Volunteering his time and money to do so.
  - bmacho 3y ago
    > There's an entire industry now of people that check known vulnerabilities (so they don't invent anything themselves) in software/packages and cross check this against outdated websites, at a very large scale. If it's easy, then more the danger, and more the reason to pay the white hats instead of getting robbed by black hats?
accrual 3y ago
Is it still "white hat" if money or a transaction is involved? My understanding is it's either black hat, the exploit is sold for money. Red team, you paid to be exploited for your own benefit. Or white hat, an exploit was found and it's communicated to limit black hat and red team. White hat + money would just be gray hat or blackmail.
- rocqua 3y ago
  White hats can still get bug-bounties. Though if a company hasn't published such a bounty and a hat 'extorts' the bounty by demanding payment or else they will publish, that hat has a tint of grey.
  - Aeolun 3y ago
    That's not a tint of gray, that's just plain black.
passion__desire 3y ago
Why can't PyPI safeguard popular packages by making sure that new packages are few (4 or 5) edit-distance away to make sure popular ones don't get intermixed with malicious packages. Is that difficult to implement?
- rocqua 3y ago
  pip-env, pipe, pipes, sip, siv, lipo, etc Are all within an edit distance of 4 from pip, and would all be blocked. Besides 'dependecy confusion' is not typo-squatting at all. It is about having a public package that masks the name of a private package repo. The default behavior of pip is to then use the public repo, which can let outsiders who know internal package names totally take over those internal packages.
heavyset_go 3y ago
That's certainly a way to look a gift horse in the mouth.

Mystery-Machine 3y ago

Why is it an extortion request and "white hats" if they have successfully found a security issue in your project and reported it to you, without actually exploiting it? Would you rather them not report it to you or even worse, exploit it?

cjsawyer 3y ago
Sounds like they’re the ones who implemented the bad code in the first place, as a honeypot. That just extortion with extra steps.
JadeNB 3y ago
> Why is it an extortion request and "white hats" if they have successfully found a security issue in your project and reported it to you, without actually exploiting it? Presumably because there is some demand for compensation before disclosure?
dahwolf 3y ago
Pay me or I will harm you is extortion, as simple as that. There's an entire industry now of people that check known vulnerabilities (so they don't invent anything themselves) in software/packages and cross check this against outdated websites, at a very large scale. They have no morals or security ethics, they barely even have knowledge, they just want to make money with the least amount of effort possible. Don't ever pay them a cent. They're just as ruthless as spammers.
- autoexec 3y ago
  If several groups of people who "barely even have knowledge" can profit from checking for well known vulnerabilities on websites and reporting them I say more power to them. If there is an entire industry of people doing low effort work which then discovers vulnerabilities on a company's website that company should pay them, and probably fire some people they've already been paying for not putting in even that much effort to secure their own stuff. Who is less ethical? The people reporting vulnerabilities and wanting to be paid for it or the companies who don't bother to invest in even basic security practices putting people's data at risk and allowing scammers and hackers to leverage those insecure systems to hurt others?
  - dahwolf 3y ago
    The word "companies" is doing a lot of work in your rant. The vast majority of websites on the internet do not have a team behind them. That's exactly the reason why they lack maintenance. So they're not intimidating well-funded companies, they're intimidating that nice guy that in 2003 build a website for the local bridge club. Volunteering his time and money to do so.
- bmacho 3y ago
  > There's an entire industry now of people that check known vulnerabilities (so they don't invent anything themselves) in software/packages and cross check this against outdated websites, at a very large scale. If it's easy, then more the danger, and more the reason to pay the white hats instead of getting robbed by black hats?

accrual 3y ago

Is it still "white hat" if money or a transaction is involved? My understanding is it's either black hat, the exploit is sold for money. Red team, you paid to be exploited for your own benefit. Or white hat, an exploit was found and it's communicated to limit black hat and red team. White hat + money would just be gray hat or blackmail.

rocqua 3y ago
White hats can still get bug-bounties. Though if a company hasn't published such a bounty and a hat 'extorts' the bounty by demanding payment or else they will publish, that hat has a tint of grey.
- Aeolun 3y ago
  That's not a tint of gray, that's just plain black.

passion__desire 3y ago

Why can't PyPI safeguard popular packages by making sure that new packages are few (4 or 5) edit-distance away to make sure popular ones don't get intermixed with malicious packages. Is that difficult to implement?

rocqua 3y ago
pip-env, pipe, pipes, sip, siv, lipo, etc Are all within an edit distance of 4 from pip, and would all be blocked. Besides 'dependecy confusion' is not typo-squatting at all. It is about having a public package that masks the name of a private package repo. The default behavior of pip is to then use the public repo, which can let outsiders who know internal package names totally take over those internal packages.

heavyset_go 3y ago

That's certainly a way to look a gift horse in the mouth.