6 ms·

If this question had a reliable (and public) answer then the world would be a very different place! That said, this is an important question. We, particularly

If this question had a reliable (and public) answer then the world would be a very different place! That said, this is an important question. We, particularly those us who work on critical infrastructure or software, should be asking ourselves this regularly to help prevent this type of thing. Note that it's also easy (and similarly catastrophic) to swing too far the other way and approach all unknowns with automatic paranoia. We live in a world where we have to trust strangers every day, and if we lose that option completely then our civilization grinds to a halt. But-- vigilance is warranted. I applaud these engineers who followed their instincts and dug into this. They all did us a huge service! EDIT: wording, spelling

josephg 3y ago
Yeah thanks for saying this; I agree. And as cliche as it is to look for a technical solution to a social problem, I also think better tools could help a lot here. The current situation is ridiculous - if I pull in a compression library from npm, cargo or Python, why can that package interact with my network, make syscalls (as me) and read and write files on my computer? Leftpad shouldn’t be able to install crypto ransomware on my computer. To solve that, package managers should include capability based security. I want to say “use this package from cargo, but refuse to compile or link into my binary any function which makes any syscall except for read and write. No open - if I want to compress or decompress a file, I’ll open the file myself and pass it in.” No messing with my filesystem. No network access. No raw asm, no trusted build scripts and no exec. What I allow is all you get. The capability should be transitive. All dependencies of the package should be brought in under the same restriction. In dynamic languages like (server side) JavaScript, I think this would have to be handled at runtime. We could add a capability parameter to all functions which issue syscalls (or do anything else that’s security sensitive). When the program starts, it gets an “everything” capability. That capability can be cloned and reduced to just the capabilities needed. (Think, pledge). If I want to talk to redis using a 3rd party library, I pass the redis package a capability which only allows it to open network connections. And only to this specific host on this specific port. It wouldn’t stop all security problems. It might not even stop this one. But it would dramatically reduce the attack surface of badly behaving libraries.
- Guvante 3y ago
  Doesn't this exact exploit not fixed by your capability theory? It is hijacking a process that has network access at runtime not build time. The build hack grabs files from the repo and inspects build parameters (in a benign way, everyone checks whether you are running on X platform etc)
  - josephg 3y ago
    The problem we have right now is that any linked code can do anything, both at build time and at runtime. A good capability system should be able to stop xz from issuing network requests even if other parts of the process do interact with the network. It certainly shouldn't have permission to replace crc32_resolve() and crc64_resolve() via ifunc. Another way of thinking about the problem is that right now every line of code within a process runs with the same permissions. If we could restrict what 3rd party libraries can do - via checks either at build time or runtime - then supply chain attacks like this would be much harder to pull off.
    - im3w1l 3y ago
      I'm not convinced this is such a cure-all as any library must necessarily have the ability to "taint" its output. Like consider this library. It's a compression library. You would presumably trust it to decompress things right? Like programs? And then you run those programs with full permission? Oops..
      - josephg 3y ago
        It’s not a cure-all. I mean, we’re talking about infosec - so nothing is. But that said, barely any programs need the ability to execute arbitrary binaries. I can’t remember the last time I used eval() in JavaScript. I agree that it wouldn’t stop this library from injecting backdoors into decompressed executables. But I still think it would be a big help anyway. It would stop this attack from working. At the big picture, we need to acknowledge that we can’t implicitly trust opensource libraries on the internet. They are written by strangers, and if you wouldn’t invite them into your home you shouldn’t give them permission to execute arbitrary code with user level permissions on your computer. I don’t think there are any one size fits all answers here. And I can’t see a way to make your “tainted output” idea work. But even so, cutting down the trusted surface area from “leftpad can cryptolocker your computer” to “Leftpad could return bad output” sounds like it would move us in the right direction.
saalweachter 3y ago
Assume 3% of the population is malicious. Enough to be cautious, enough to think about how to catch bad actors, not so much as to close yourself off and become a paranoid hermit.
- pizzafeelsright 3y ago
  Huh. I never really thought of it as a percentage. I've been evil, been wonderful, and indifferent at different stages in life. I have known those who have done similar for money, fame, and boredom. I think, given a backstory, incentive, opportunity, and resources it would be possible to most people to flip from wouldn't to enlisted. Leverage has shown to be the biggest lever when it comes to compliance.
  - XorNot 3y ago
    It's doubtful you've been evil, or at least, you are really lacking in imagination of the true scope of what that word implies.
  - mlsu 3y ago
    The line between good and evil cuts through the heart of every person
  - saulpw 3y ago
    "Assume that 3% of the people you encounter will act maliciously."
- heresie-dabord 3y ago
  We live in a time of populous, wealthy dictatorships that have computer-science expertise are openly hostile to the US and Canada. North America is only about 5% of the world's population. [1] (We can assume that malicious actors are in North America, too, but this helps to adjust our perspective.) The percentage of maliciousness on the Internet is much higher. [1] _ See continental subregions. https://en.wikipedia.org/wiki/List_of_continents_and_continental_subregions_by_population https://en.wikipedia.org/wiki/List_of_continents_and_contine...
heresie-dabord 3y ago
Threat actors create personas. We will need strong social trust to protect our important projects and dependencies.
account42 3y ago
> We, particularly those us who work on critical infrastructure or software We should also be asking ourselves if we are working on critical infrastructure. Lasse Collin probably did not consider liblzma being loaded by sshd when vetting the new maintainer. Did the xz project ever agree to this responsibility? We should also be asking ourselfs if each dependency of critical infrastructure is worth the risk. sshd linking libsystemd just to write a few bytes into an open fd is absurd. libsystemd pulling in liblzma because hey it also does compressed logging is absurd. Yet this kind of absurd dependency bloat is everywhere.

josephg 3y ago

Yeah thanks for saying this; I agree. And as cliche as it is to look for a technical solution to a social problem, I also think better tools could help a lot here. The current situation is ridiculous - if I pull in a compression library from npm, cargo or Python, why can that package interact with my network, make syscalls (as me) and read and write files on my computer? Leftpad shouldn’t be able to install crypto ransomware on my computer. To solve that, package managers should include capability based security. I want to say “use this package from cargo, but refuse to compile or link into my binary any function which makes any syscall except for read and write. No open - if I want to compress or decompress a file, I’ll open the file myself and pass it in.” No messing with my filesystem. No network access. No raw asm, no trusted build scripts and no exec. What I allow is all you get. The capability should be transitive. All dependencies of the package should be brought in under the same restriction. In dynamic languages like (server side) JavaScript, I think this would have to be handled at runtime. We could add a capability parameter to all functions which issue syscalls (or do anything else that’s security sensitive). When the program starts, it gets an “everything” capability. That capability can be cloned and reduced to just the capabilities needed. (Think, pledge). If I want to talk to redis using a 3rd party library, I pass the redis package a capability which only allows it to open network connections. And only to this specific host on this specific port. It wouldn’t stop all security problems. It might not even stop this one. But it would dramatically reduce the attack surface of badly behaving libraries.

Guvante 3y ago
Doesn't this exact exploit not fixed by your capability theory? It is hijacking a process that has network access at runtime not build time. The build hack grabs files from the repo and inspects build parameters (in a benign way, everyone checks whether you are running on X platform etc)
- josephg 3y ago
  The problem we have right now is that any linked code can do anything, both at build time and at runtime. A good capability system should be able to stop xz from issuing network requests even if other parts of the process do interact with the network. It certainly shouldn't have permission to replace crc32_resolve() and crc64_resolve() via ifunc. Another way of thinking about the problem is that right now every line of code within a process runs with the same permissions. If we could restrict what 3rd party libraries can do - via checks either at build time or runtime - then supply chain attacks like this would be much harder to pull off.
  - im3w1l 3y ago
    I'm not convinced this is such a cure-all as any library must necessarily have the ability to "taint" its output. Like consider this library. It's a compression library. You would presumably trust it to decompress things right? Like programs? And then you run those programs with full permission? Oops..
    - josephg 3y ago
      It’s not a cure-all. I mean, we’re talking about infosec - so nothing is. But that said, barely any programs need the ability to execute arbitrary binaries. I can’t remember the last time I used eval() in JavaScript. I agree that it wouldn’t stop this library from injecting backdoors into decompressed executables. But I still think it would be a big help anyway. It would stop this attack from working. At the big picture, we need to acknowledge that we can’t implicitly trust opensource libraries on the internet. They are written by strangers, and if you wouldn’t invite them into your home you shouldn’t give them permission to execute arbitrary code with user level permissions on your computer. I don’t think there are any one size fits all answers here. And I can’t see a way to make your “tainted output” idea work. But even so, cutting down the trusted surface area from “leftpad can cryptolocker your computer” to “Leftpad could return bad output” sounds like it would move us in the right direction.

saalweachter 3y ago

Assume 3% of the population is malicious. Enough to be cautious, enough to think about how to catch bad actors, not so much as to close yourself off and become a paranoid hermit.

pizzafeelsright 3y ago
Huh. I never really thought of it as a percentage. I've been evil, been wonderful, and indifferent at different stages in life. I have known those who have done similar for money, fame, and boredom. I think, given a backstory, incentive, opportunity, and resources it would be possible to most people to flip from wouldn't to enlisted. Leverage has shown to be the biggest lever when it comes to compliance.
- XorNot 3y ago
  It's doubtful you've been evil, or at least, you are really lacking in imagination of the true scope of what that word implies.
- mlsu 3y ago
  The line between good and evil cuts through the heart of every person
- saulpw 3y ago
  "Assume that 3% of the people you encounter will act maliciously."
heresie-dabord 3y ago
We live in a time of populous, wealthy dictatorships that have computer-science expertise are openly hostile to the US and Canada. North America is only about 5% of the world's population. [1] (We can assume that malicious actors are in North America, too, but this helps to adjust our perspective.) The percentage of maliciousness on the Internet is much higher. [1] _ See continental subregions. https://en.wikipedia.org/wiki/List_of_continents_and_continental_subregions_by_population https://en.wikipedia.org/wiki/List_of_continents_and_contine...

heresie-dabord 3y ago

Threat actors create personas. We will need strong social trust to protect our important projects and dependencies.

account42 3y ago

> We, particularly those us who work on critical infrastructure or software We should also be asking ourselves if we are working on critical infrastructure. Lasse Collin probably did not consider liblzma being loaded by sshd when vetting the new maintainer. Did the xz project ever agree to this responsibility? We should also be asking ourselfs if each dependency of critical infrastructure is worth the risk. sshd linking libsystemd just to write a few bytes into an open fd is absurd. libsystemd pulling in liblzma because hey it also does compressed logging is absurd. Yet this kind of absurd dependency bloat is everywhere.