6 ms·
I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to
by 0xDEAFBEAD 3y ago
I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it.
If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)
- onionisafruit 3y agoDoes github have that on any repos? If so, I’ve never stumbled across it.
- khqc 3y agothere is an open issue that warns about this
- idkyall 3y agoI'm really curious where the 0-day is in the code of the project honestly
- deleted 3y ago[deleted]
- saagarjha 3y agoThe 0-day is in a popular software package. The GitHub repo apparently contains a backdoor ability to execute code from the attacker. If I had to guess, this would be the software update functionality here: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp#L39 https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...
- r1ch 3y agoThat's just malware. There's no 0-day here.
- saagarjha 3y agoThat’s what Google is calling it, so I’m inclined to believe them.
- g___ 3y ago"In addition to targeting researchers with 0-day exploits, the threat actors also developed a standalone Windows tool that has the stated goal of 'download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers.' The attackers used a 0-day but getsymbol is not one.
- saagarjha 3y agoYep, that’s what I said.
- deleted 3y ago[deleted]
- edgyquant 3y agoNo it isn’t what you said at all. You said Google was calling malware a zero day and you believe them, but they aren’t doing this.
- saagarjha 3y agoThis is what I said: > The 0-day is in a popular software package. (I have no idea what this is.) > The GitHub repo apparently contains a backdoor ability to execute code from the attacker. (This is what Google says and I think it’s the autoupdater.) Is this different than what you feel?
- rightbyte 3y agoSeems to be some dll:s included. Maybe there? "But the tool also has the ability to download and execute arbitrary code from an attacker-controlled domain." Sounds like most software nowadays to be honest. The blog author does not really point out why this code would be more malicious than "normal" or how the code author is known to be Korean.
- deleted 3y ago[deleted]
- dantillberg 3y agoThis "UpdateCheckThread" code looks pretty funky, [0]. It downloads some stuff from a URL, writes a file to disk, and creates a process to run it. 0: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp#L39 https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...
- bdowling 3y agoIf the code is wrapped in if (updateDlg.DoModal() == IDOK) { … } then doesn’t that mean it only runs that code if the user clicks “OK” on the update dialog? (Edit: I think I understand now. It’s not the code, it’s the update URL that’s the problem, because it’s controlled by NK. So if you run this and blindly click “OK”, then it will download an executable that will infect your PC.) (Edit 2: Or the issue is not in the source at all, but is in the prebuilt binary.)
- rightbyte 3y agoIt could be that the code is fine but the URL is compromised?
- zb3 3y agoThis also serves as a reminder that code hosted on github might be malicious and we shouldn't blindly trust those just because the author seems to have similar interests.. I've done that multiple times :(
- dkjaudyeqooe 3y agoThat's true, but in this case the code might be fine and the executables they provide on GitHub bogus. It's tricky to keep in mind that GitHub is not a trusted build source.
- eastbound 3y agoAnd the GitHub Actions… oh man… Insert some tool in your build that comes from another random repository, that uploads an artifact to S3 or similar… GitHub’s architecture entirely is the iMessage of source code.
- uoaei 3y agoCould you please expand on your iMessage comparison? I don't understand what you're referencing.
- MarkSweep 3y agoI don’t know if I 100% follow or agree with the comparison of iMessage and GitHub actions. But iMessage has had a number of interesting security vulnerabilities over the years in image parsing and deserialization. One example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Or a story from today: https://news.ycombinator.com/item?id=37425007 https://news.ycombinator.com/item?id=37425007 So perhaps the similarity between iMessage and GutHub actions is there are a lot of things that could go wrong. In iMessage it’s a pile of memory unsafe code that was not originally designed to withstand attack. In GutHub actions there is a lot of trust in their parties that could potentially be exploited.
- saagarjha 3y agoI reported the repository as malware, guess we'll see what happens with it
- saagarjha 3y ago> Our review of the account named in your report has concluded. We have determined that one or more violations of GitHub’s Terms of Service have occurred and have taken appropriate action in response.
- momothereal 3y agoIt looks like it just got taken offline
- codetrotter 3y agoYep. Page Not Found now. I just had a look at it like 30 minutes ago and it was still there then. Here are archives of what it looked like http://web.archive.org/web/20230907185609/https://github.com/dbgsymbol/ http://web.archive.org/web/20230907185609/https://github.com... http://web.archive.org/web/20230907193333/https://github.com/dbgsymbol?tab=repositories http://web.archive.org/web/20230907193333/https://github.com... http://web.archive.org/web/20230907193402/https://github.com/dbgsymbol/getsymbol http://web.archive.org/web/20230907193402/https://github.com...
- raincole 3y agoI think it's better to give an obvious warning and archive it. As a reminder to people.
- nneonneo 3y agoThe source code itself looks relatively clean; there's autoupdate functionality but it looks like it's gated behind a confirmatory dialog box. It's much more likely that the binary releases and/or autoupdate binaries are backdoored. If someone compiles their own version, and then clicks to accept the autoupdate, they could be infected. The binary is 15+MB in size, which is far more than enough to hide a small backdoor.
- bowmessage 3y agoIt's the auto-update functionality from a now-suspect URL. The repo has since been taken down, but here's the suspect file: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp#L44 https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...
- sillysaurusx 3y agoDrat, archive.org didn't snag it. Do you happen to have a copy? https://web.archive.org/web/20230000000000*/https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp https://web.archive.org/web/20230000000000*/https://github.c...
- gregsadetsky 3y agocheck https://github.com/bb33bb/getsymbol https://github.com/bb33bb/getsymbol and https://github.com/clayne/win-getsymbol https://github.com/clayne/win-getsymbol, two up to date forks -- and my comment above https://news.ycombinator.com/item?id=37425311 https://news.ycombinator.com/item?id=37425311
- gregsadetsky 3y agoFound these two forks which are still accessible (and are supposedly up to date with the upstream repo (linked in the comment above) which is not accessible anymore): https://github.com/bb33bb/getsymbol https://github.com/bb33bb/getsymbol https://github.com/clayne/win-getsymbol https://github.com/clayne/win-getsymbol here is the same link as in the comment above from one of the forks: https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMainDlg.cpp https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMai... the code fetches from `UPDATE_CHECK_URL`, which is hardcoded as: https://dbgsymbol.com/version https://dbgsymbol.com/version which as of the time of this posting, returns: "GetSymbol 2.0.3|https://dbgsymbol.com/downloads/2.0.3/GetSymbol.exe https://dbgsymbol.com/downloads/2.0.3/GetSymbol.exe" the GetSymbol.exe file (which is downloadable right now) being presumably the infected file being discussed..!
- madeofpalk 3y agoWhat's the point of the warning? Wouldn't Github just removing the offending repo?
- userbinator 3y agoUnfortunately, looks like it did. ...which while admirable from one perspective, also effectively destroys the evidence. I prefer the warning instead.
- account42 3y agoIt also normalizes removing repositories for other reasons.
- madeofpalk 3y agoContent providers have an obligation and responsibility to remove content for a variety of reasons. It's already normalised, as it should be.
- rl3 3y ago>I notice that the getsymbol tool on Github has 214 stars ... Analysis of which accounts starred it prior to publicity is probably a worthwhile endeavor. If there's any commonality with other obscure projects, that may be an indicator those accounts could be puppets.
- nottheengineer 3y agoUnfortunately that opens up a whole new can of worms. There are already sites that guess how fake amazon reviews are, maybe we need something similar for github. I hope an analysis like you proposed could yield some insights to patterns or maybe even enough data to do some machine learning on.
- ChrisRR 3y agoBut how do I trust the tool that guesses how compromised a repo is?
- nottheengineer 3y agoYou post it to HN and claim that it's safe. If you aren't proven wrong in the next 2 hours, it probably is.
- amelius 3y ago> If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project) I'd also strongly suggest they add a way to flag projects in a way that is appropriate.
- self_awareness 3y agoIt looks like its no longer on Github. Does anyone have the source code mirror? I would love to get a peek on it.