4 ms·
> The changes to build-to-host.m4 weren't in the source repo, so there was no commit. > > The attacker had permissions to create GitHub releases, so they simpl
by MuffinFlavored 3y ago
> The changes to build-to-host.m4 weren't in the source repo, so there was no commit.
>
> The attacker had permissions to create GitHub releases, so they simply added it to the GitHub release tarball.
What are some simple tweaks the "Debians" of the world can do to mitigate this kind of stuff?
Not trust "hand-curated-by-possibly-malicious-maintainers" GitHub release tarballs, only trust git commits?
Whitelist functions that are allowed to do IFUNC/ELF hooking to core OpenSSH functions?
- ilc 3y agoRead IOCCC entries. Now realize, those are people having FUN. What is your chance of catching nation state level maliciousness in a codebase? Pretty low.
- heeen2 3y agoremove test blobs before building
- JonChesterfield 3y agoWhat's a test binary? Bunch of bytes on disk. What's a source file? Bunch of bytes on disk.
- varjag 3y agoGood people and bad people are all made of atoms so there's no difference.
- evilos 3y agoI think the point is that you can't tell a good person from a bad one by inspecting the atoms.
- heeen2 3y agobinary files can be distinguished from text files with good enough confidence. folders containing test files could easily be removed before build just by name or should live in a separate repository altogether.
- JonChesterfield 3y agoA text file can contain a malicious payload in exactly the same way a binary file can. If you want to get paranoid about a test subdirectory, stash the payload in comments or formatting choices in the source code itself. It's great to say "aha, this particular exploit would be deleted by not having binary files in a test directory!", but that totally misses the point that you can put the bytes you want in other places, such as in the source code which is itself a load of bytes. See also polyglot programs and the code is data premise.
- heeen2 3y agoWhat point are you arguing here? More binaries rather than less? Less readable source code rather than more readable? That we should just give up because some people manage to win underhanded C contests? Are you arguing that binaries are equally easy to understand and dissect as source code that has to follow some syntax?