4 ms·

This is extremely alarmist. If you are on Mac, developing anything at all with Python, those are going to be your tools. If you randomly guessed at developer se

This is extremely alarmist. If you are on Mac, developing anything at all with Python, those are going to be your tools. If you randomly guessed at developer setups, that is going to be one of the most common setups as well. What's next, I use a computer so someone could just upload a virus somewhere in hopes I happen upon it, which would be dangerous? I have dotfiles which not only specify Python, but also its version and some packages. That protects against typosquatting! I will never type those package names out manually again. And this is all in Nix (btw), so all hash-pinned!

lrvick 1y ago
It is absolutely not alarmist. Seriously, go apply to be a Homebrew developer right now under an alias, make some useful updates for a few months, then submit a PR as another alias, and approve and merge your own changes from the first alias. After you get away with skipping code review a few times, now go switch a popular package that relies on abandoned sources to point to your fork that makes a few legitimate updates. Now in a few months make an update that compromises the random number generator on every brew users laptop making it easy to covertly intercept and manipulate the traffic of any target however you want. Maybe for less chance of getting caught, target sysadmins or release engineers by targeting a niche tool many of them use and wait until they publish new ssh keys to github (which are always public!), that you can re-generate the private keys of since you know about their compromised entropy. Check for public dotfiles of your targets to pick the right niche tool. Now go collect database dumps or crypto from a pile of major companies. Easy money if you do not have ethics. Seen these attacks in the wild many times, some at close range. A bored teenager could do this, and in fact attacks like this happen every day. And everyone just says pointing it out is "alarmist". People used to defend lead paint and asbestos too. Survivors bias is a hell of a drug. I have done supply chain attacks along the lines of the above myself to prove the risk is very much real to my clients. It is expensive to fix so wanting the risk to be overstated is understandable, but it is actually super easy. Sometimes you can even get away with buying the expired email domain of a inactive maintainer so you can easily just take over their identity. Done this twice and I am no state actor. Nix, by the way, is hash pinned, but you just blindly update those hashes when there are updates, right? Their code submission process is as yolo as Homebrew. Any rando can push whatever they want without multi-party code signing. I am the one that submitted the RFC to nix to fix this which was rejected as in the end they admitted they want a hobby distro and do not want the overhead and rigor needed for professional targeted environments. This is why I was forced to abandon nix and get all my clients to abandon it, in favor of StageX which even as the founder I have no control of. It mandates deterministic builds and cryptographic signing by at least two well known keys of maintainers. We do not point out risks unless there are solutions to mitigate them.
- sturob 1y ago
  Could you clarify what you mean by 'attacks like this happen every day' please?
  - lrvick 1y ago
    Here are just a few old well known examples in popular package managers: * Gentoo: https://archives.gentoo.org/gentoo-announce/message/dc23d48d2258e1ed91599a8091167002 https://archives.gentoo.org/gentoo-announce/message/dc23d48d... * Debian: https://lists.debian.org/debian-devel-announce/2006/07/msg00003.html https://lists.debian.org/debian-devel-announce/2006/07/msg00... * NPM: https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes https://eslint.org/blog/2018/07/postmortem-for-malicious-pac... * PyPi: https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_sshdecorator_package/ https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_... * Ubuntu Snap: https://github.com/canonical-websites/snapcraft.io/issues/651 https://github.com/canonical-websites/snapcraft.io/issues/65... * Arch Linux AUR: https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html https://lists.archlinux.org/pipermail/aur-general/2018-July/... * Homebrew: https://medium.com/@vesirin/how-i-gained-commit-access-to-homebrew-in-30-minutes-2ae314df03ab https://medium.com/@vesirin/how-i-gained-commit-access-to-ho... No one has fixed the fundamental problems that allow any of these to happen after years and years. Now put "supply chain attack" into any news search engine today. Attacks of this nature are up by 400-1500%+ in recent years depending on whose estimates you trust. They are easy, they are common, they are everywhere... and most security engineers and sysadmins are entirely asleep on the wheel on this one. Most of our consulting work these days is mitigating these risks in the most critical deployment and code paths of our clients.
    - sturob 1y ago
      Thank you, I was not aware of all of these, and I don't doubt the seriousness of the issue. That said: 'every day' does seem quite hyperbolic.
      - lrvick 1y ago
        There are several thousand expired email domains of maintainers right now on NPM alone, allowing you to easily take over their accounts if you wanted, arguably legally, for maybe $10. I bought the domain name of the sole maintainer of the NPM package "foreach", gaining control of their email address and likely password reset capabilities, just to prove this point and troll the press a bit, which worked better than I could have ever hoped. And yet, still not -enough- press because almost no one is doing anything about it yet. With easily over a million published open source packages that exist, and it being -so- easy to take them over since almost no one uses hardware code signing or 2FA, and with well above 365 documented/discovered cases every year, (obviously not counting all the ones that are -not- discovered!) "every day" is a given. If anything with LLM based pull request attacks spiking right now, I assume several malicious commits will be merged today. Most will look like accidents, hard to spot, and merged helpfully by bots that automatically merge commits to major distros. The floodgates are wide open. "Sonatype logged over 245,032 malicious packages in open source projects available to public download in 2023, double the number seen from 2019 to 2022. In total, one in eight open source downloads poses a risk." https://www.cpomagazine.com/cyber-security/open-source-software-supply-chain-attacks-have-tripled-but-nearly-all-vulnerabilities-are-avoidable-by-updating/ https://www.cpomagazine.com/cyber-security/open-source-softw...

lrvick 1y ago

It is absolutely not alarmist. Seriously, go apply to be a Homebrew developer right now under an alias, make some useful updates for a few months, then submit a PR as another alias, and approve and merge your own changes from the first alias. After you get away with skipping code review a few times, now go switch a popular package that relies on abandoned sources to point to your fork that makes a few legitimate updates. Now in a few months make an update that compromises the random number generator on every brew users laptop making it easy to covertly intercept and manipulate the traffic of any target however you want. Maybe for less chance of getting caught, target sysadmins or release engineers by targeting a niche tool many of them use and wait until they publish new ssh keys to github (which are always public!), that you can re-generate the private keys of since you know about their compromised entropy. Check for public dotfiles of your targets to pick the right niche tool. Now go collect database dumps or crypto from a pile of major companies. Easy money if you do not have ethics. Seen these attacks in the wild many times, some at close range. A bored teenager could do this, and in fact attacks like this happen every day. And everyone just says pointing it out is "alarmist". People used to defend lead paint and asbestos too. Survivors bias is a hell of a drug. I have done supply chain attacks along the lines of the above myself to prove the risk is very much real to my clients. It is expensive to fix so wanting the risk to be overstated is understandable, but it is actually super easy. Sometimes you can even get away with buying the expired email domain of a inactive maintainer so you can easily just take over their identity. Done this twice and I am no state actor. Nix, by the way, is hash pinned, but you just blindly update those hashes when there are updates, right? Their code submission process is as yolo as Homebrew. Any rando can push whatever they want without multi-party code signing. I am the one that submitted the RFC to nix to fix this which was rejected as in the end they admitted they want a hobby distro and do not want the overhead and rigor needed for professional targeted environments. This is why I was forced to abandon nix and get all my clients to abandon it, in favor of StageX which even as the founder I have no control of. It mandates deterministic builds and cryptographic signing by at least two well known keys of maintainers. We do not point out risks unless there are solutions to mitigate them.

sturob 1y ago
Could you clarify what you mean by 'attacks like this happen every day' please?
- lrvick 1y ago
  Here are just a few old well known examples in popular package managers: * Gentoo: https://archives.gentoo.org/gentoo-announce/message/dc23d48d2258e1ed91599a8091167002 https://archives.gentoo.org/gentoo-announce/message/dc23d48d... * Debian: https://lists.debian.org/debian-devel-announce/2006/07/msg00003.html https://lists.debian.org/debian-devel-announce/2006/07/msg00... * NPM: https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes https://eslint.org/blog/2018/07/postmortem-for-malicious-pac... * PyPi: https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_sshdecorator_package/ https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_... * Ubuntu Snap: https://github.com/canonical-websites/snapcraft.io/issues/651 https://github.com/canonical-websites/snapcraft.io/issues/65... * Arch Linux AUR: https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html https://lists.archlinux.org/pipermail/aur-general/2018-July/... * Homebrew: https://medium.com/@vesirin/how-i-gained-commit-access-to-homebrew-in-30-minutes-2ae314df03ab https://medium.com/@vesirin/how-i-gained-commit-access-to-ho... No one has fixed the fundamental problems that allow any of these to happen after years and years. Now put "supply chain attack" into any news search engine today. Attacks of this nature are up by 400-1500%+ in recent years depending on whose estimates you trust. They are easy, they are common, they are everywhere... and most security engineers and sysadmins are entirely asleep on the wheel on this one. Most of our consulting work these days is mitigating these risks in the most critical deployment and code paths of our clients.
  - sturob 1y ago
    Thank you, I was not aware of all of these, and I don't doubt the seriousness of the issue. That said: 'every day' does seem quite hyperbolic.
    - lrvick 1y ago
      There are several thousand expired email domains of maintainers right now on NPM alone, allowing you to easily take over their accounts if you wanted, arguably legally, for maybe $10. I bought the domain name of the sole maintainer of the NPM package "foreach", gaining control of their email address and likely password reset capabilities, just to prove this point and troll the press a bit, which worked better than I could have ever hoped. And yet, still not -enough- press because almost no one is doing anything about it yet. With easily over a million published open source packages that exist, and it being -so- easy to take them over since almost no one uses hardware code signing or 2FA, and with well above 365 documented/discovered cases every year, (obviously not counting all the ones that are -not- discovered!) "every day" is a given. If anything with LLM based pull request attacks spiking right now, I assume several malicious commits will be merged today. Most will look like accidents, hard to spot, and merged helpfully by bots that automatically merge commits to major distros. The floodgates are wide open. "Sonatype logged over 245,032 malicious packages in open source projects available to public download in 2023, double the number seen from 2019 to 2022. In total, one in eight open source downloads poses a risk." https://www.cpomagazine.com/cyber-security/open-source-software-supply-chain-attacks-have-tripled-but-nearly-all-vulnerabilities-are-avoidable-by-updating/ https://www.cpomagazine.com/cyber-security/open-source-softw...