5 ms·

PyPI Preventing Domain Resurrection Attacks

136 points by pabs3 1y ago

ocdtrekkie 1y ago
One of the places this worried me the most was Golang, where domains for repositories are used as a package source. Credit where credit's due, when I contacted Google about a developer who had passed before their domain expired, and they were able to lock out the domain from pulling anything new into their cache.
- snickerdoodle12 1y ago
  On the other hand it's pretty crazy you could just get a domain blacklisted like that
  - ocdtrekkie 1y ago
    It was quite possible to independently prove my report was genuine. I am confident they didn't take my word for it. I give Google a lot of well-deserved criticism, but they handled this issue pretty well and quite promptly.
    - sidewndr46 1y ago
      Couldn't you pay pretty much any random official in a corrupt country to produce a death certificate in any name you want? Maybe it's a bigger bribe than normal, but it seems like it would be routine
      - ocdtrekkie 1y ago
        So this is where I'd highlight the benefits that an actual human looked at and responded to my email (a rarity for Google), and hence could use human discretion to decide that what I indicated was indeed accurate, and not randomly from a random corrupt country. I really have to emphasize: Any security process that actually works has humans in the loop! (Security doesn't scale.) The other thing of course, is that the domain was expiring. So similar to PyPI just accepting in the parent article that an expired domain isn't trustworthy, Google could verify shortly thereafter whether or not the domain was renewed by the developer in question. And ultimately, you're suggesting paying off an official to pretend someone is dead, so you can block package updates to a domain, which doesn't really introduce a security issue, and of course, is trivially reversible when the person in question is, in fact, still alive. As Tony Stark would say, "Not a good plan".
        sidewndr46 1y ago
        I don't think you've ever dealt with the likes of US credit bureaus if you think getting something like a death announcement is "trivially reversible". I forever am and forever will be a civil engineer somewhere in upstate New York thanks to them. Nevermind I was still in high school at the time and don't even have a shred of engineering qualifications. Whoever you are, thanks for the borrowed ladder my friend.
        vdqtp3 1y ago
        Reminds me of this presentation from a decade ago https://www.youtube.com/watch?v=9FdHq3WfJgs https://www.youtube.com/watch?v=9FdHq3WfJgs
- sneak 1y ago
  go’s lockfiles include cryptographic hashes which prevent even Google from maliciously replacing packages in the cache.
  - ocdtrekkie 1y ago
    A malicious actor could, however, quite trivially add one to the version number. ;)
    - arccy 1y ago
      No technical solution is going to save you from an upstream going rogue and you blindly updating. The only way is to properly review your dependencies.
      - dwattttt 1y ago
        The problem isn't an upstream going rogue; it's an upstream going dark, and someone taking advantage of that. Upstreams going dark happens much more often than them going rogue. A system that requires you to prove more than you just control a domain isn't as vulnerable to this problem.
  - junon 1y ago
    This doesn't address availability or discoverability though. There are no upsides other than a fleeting sense of "decentralization", without any of the securities of a real decentralized protocol.
  - tsimionescu 1y ago
    For a given version, yes. But the security risk here is about publishing a new (malicious) version of a previously trusted package, by taking control of an expired domain. Say I'm using mydomain.org/abc and it's a perfectly fine package. I'm currently using v1.25.7. Two months later, I see a new version of mydomain.org/abc, v1.25.8. I will likely update to it and use it relatively confidently. But, unbeknownst to me, mydomain.org's registration expired one month ago, and a malicious actor has grabbed it in the meantime; and they have now released a malicious version of this package. Nothing in Go's security model prevents this type of attack, except that Google's package "cache" (the package repo that Go downloads things from) can be configured by Google to not provide that malicious package. This is a major design flaw with the silly idea of using an extremely imparmenent identifier - DNS names, which can only be leased for a limited time and are automatically auctioned off after they expire - as the main identifier for something as long lived as Go packages. No other package ecosystem has this terrible design concept - even when they do use DNS, they use it only for an initial authentication, not as the only identifier. For example, in Java's Maven repo, to publish a package org.mydomain.abc from a Maven Central account, you need to prove that you have ownership of abc.mydomain.org once when associating this package. Afterwards, the package name remains associated with your Maven Central account, forever. If you lose access to that domain name and someone else obtains, they can't go through the same steps, Maven Central won't let them, since that package name is already tied to your account.
- junon 1y ago
  This is why URI based imports make little sense to me, honestly.
- WhyNotHugo 1y ago
  go.mod keeps checksums, so this should come up easily for downstream consumers. However, when devs change dependencies, an innocent `go mod …` might update to a new (compromised) version of a dependency.
sneak 1y ago
All of this because we still haven’t solved durable long-term strong cryptographic identity on the internet. (Actually we have, but nobody wants to make people install Metamask or similar to log into websites.)
- zokier 1y ago
  Keybase had good concept originally and they even had some momentum for a sec, but then they took VC money and imploded. Considering how simple system it was, I feel it should be something we could implement again (without spof)
  - ocdtrekkie 1y ago
    I really liked Keybase, and do note that Keyoxide exists as an open-source project where annotations of proofs are made directly on the PGP keys and no longer requires a central point of failure. ;) I will say there are downsides to cryptographic keys being required for updating a package: One of the biggest pain points we have in Sandstorm is we both verify authors using their PGP key (from Keybase, as it happens, it's an old project), and we have a keypair for each app which you need to update it. The end result unfortunately is sometimes we have trivial one-line fixes for apps which are abandoned by the author, and it is very difficult to deploy said fix to end users. This can hypothetically manifest in the form of unfixable security problems. We do have a way to forcibly change the key, but it's intentionally a pain to do, and of course, is possible because ultimately the central authority has the ability to code the platform to circumvent that key anyways. Which is to say, you do trade some security risks for other security risks, whether it's a better situation is an exercise for the reader.
  - 0xCMP 1y ago
    One of the founders is doing exactly that: https://foks.pub/ https://foks.pub/ Thread with comments announcing it: https://news.ycombinator.com/item?id=44520419 https://news.ycombinator.com/item?id=44520419
    - zokier 1y ago
jonhohle 1y ago
This isn’t limited to just domains, though it’s good to consider. What happens when Google, Microsoft, or anyone else recycles unused accounts? Unfortunately for them, it seems like email addresses have been so tightly coupled with identity that it seems unreasonable that an address could be reused after any period of account inactivity.
- srini_reddy 1y ago
  Google wont allow you to register with the deleted/suspended/inactive email address
  - nottorp 1y ago
    Why is Google notifying me that they'll delete the account associated with <some email address that i do own> lately then? They'll delete the storage, or make that email available for new registrations?
    - nullwarp 1y ago
      FWIW I am unable to register a gmail for an account I deleted probably 8 years ago at this point. That said I don't know if there is anywhere where it explicitly outlines if it is or is not possible.
      - nottorp 1y ago
        Ah so I either click on it and recover password or give up on it. Decisions decisions...
        nottorp 1y ago
        Oh funny. They started the recovery process then wanted me to add a phone number so they can send a recovery code. In spite of them first sending a recovery code to the email that I do control and me entering it. I pressed 'try another way' and they told me they don't have enough information to prove the account is mine. Fuck off Google basically. They could at least be honest and state that a phone number is required, instead of pretending that it's for verification.
blibble 1y ago
great! this was one of the major problems with doing maven style domain based namespacing namespaces when?!
michalpleban 1y ago
The presented domain expiration model looks like .com and other global domains. What about .de, .uk and countless other country domains, each having its unique expiration policy? Will it work with them, or only with .com domains?
- miketheman 1y ago
  This largely depends on the ICANN policies and their definitions of Renewal and Registration Grace Periods. The Renewal period is variable, but the Registration Grace Period is pretty much 30 days everywhere. https://www.icann.org/en/contracted-parties/consensus-policies/expired-registration-recovery-policy/expired-registration-recovery-policy-21-02-2024-en https://www.icann.org/en/contracted-parties/consensus-polici... Here's an example from denic.de: https://www.denic.de/en/domains/de-domains/domain-deletion#code-563-0 https://www.denic.de/en/domains/de-domains/domain-deletion#c...
  - TLDRisk 1y ago
    The ERRP only covers gTLDs, right? Have you seen any ICANN policies requiring ccTLDs to adopt the same grace periods. As far as I know, ccTLDs can do whatever they want.
  - michalpleban 1y ago
    ICANN policies only govern global domains. Country domains set their own policies; for example, .eu expiration period is 45 days, not 30. WHO IS policies also vary wildly, for example .de domains do not show registration date in the WHO IS, so it's not possible to know if a domain was dropped and re-registered.
TLDRisk 1y ago
Domain expiration is something that's more complicated than most people realize. As an example, I'm not sure if there's a definitive source stating that auto-renew grace is part of the ERRP. In my opinion it's not and the ERRP typically won't trigger for high value domains because they'll be sold or auctioned by the registrar instead. As far as I know, the ERRP rules describe the policies for the deletion of expired domains, which isn't required, so working off the auto-renew grace status was a good choice here. Most people don't realize that expired domains aren't guaranteed to go through the ERRP lifecycle [1]. > You should be aware that during the auto-renew period, the domain name may be available to third parties for registration, depending on your registrar's terms of service. You may also run the risk of having your domain name auctioned to a third party by your registrar during this period (depending on your terms of service) The process described here sounds like a pretty reasonable approach to a hard problem. It won't catch everything, but it's a good approach and it's nice to see some effort put into the issue. 1. https://www.icann.org/resources/pages/registrant-about-errp-2018-12-07-en https://www.icann.org/resources/pages/registrant-about-errp-...
Dunedan 1y ago
dupe of https://news.ycombinator.com/item?id=44942432 https://news.ycombinator.com/item?id=44942432
selinkocalar 1y ago
This is exactly the kind of proactive security thinking we need more of. Supply chain attacks are getting more sophisticated, and preventing domain resurrection attacks is smart defensive strategy. Too many security incidents happen because someone thought "that'll never happen to us." PyPI is thinking ahead about attack vectors before they become widespread problems.

136 points by pabs3 1y ago

One of the places this worried me the most was Golang, where domains for repositories are used as a package source. Credit where credit's due, when I contacted Google about a developer who had passed before their domain expired, and they were able to lock out the domain from pulling anything new into their cache.

snickerdoodle12 1y ago
On the other hand it's pretty crazy you could just get a domain blacklisted like that
- ocdtrekkie 1y ago
  It was quite possible to independently prove my report was genuine. I am confident they didn't take my word for it. I give Google a lot of well-deserved criticism, but they handled this issue pretty well and quite promptly.
  - sidewndr46 1y ago
    Couldn't you pay pretty much any random official in a corrupt country to produce a death certificate in any name you want? Maybe it's a bigger bribe than normal, but it seems like it would be routine
    - ocdtrekkie 1y ago
      So this is where I'd highlight the benefits that an actual human looked at and responded to my email (a rarity for Google), and hence could use human discretion to decide that what I indicated was indeed accurate, and not randomly from a random corrupt country. I really have to emphasize: Any security process that actually works has humans in the loop! (Security doesn't scale.) The other thing of course, is that the domain was expiring. So similar to PyPI just accepting in the parent article that an expired domain isn't trustworthy, Google could verify shortly thereafter whether or not the domain was renewed by the developer in question. And ultimately, you're suggesting paying off an official to pretend someone is dead, so you can block package updates to a domain, which doesn't really introduce a security issue, and of course, is trivially reversible when the person in question is, in fact, still alive. As Tony Stark would say, "Not a good plan".
      - sidewndr46 1y ago
        I don't think you've ever dealt with the likes of US credit bureaus if you think getting something like a death announcement is "trivially reversible". I forever am and forever will be a civil engineer somewhere in upstate New York thanks to them. Nevermind I was still in high school at the time and don't even have a shred of engineering qualifications. Whoever you are, thanks for the borrowed ladder my friend.
        vdqtp3 1y ago
        Reminds me of this presentation from a decade ago https://www.youtube.com/watch?v=9FdHq3WfJgs https://www.youtube.com/watch?v=9FdHq3WfJgs
sneak 1y ago
go’s lockfiles include cryptographic hashes which prevent even Google from maliciously replacing packages in the cache.
- ocdtrekkie 1y ago
  A malicious actor could, however, quite trivially add one to the version number. ;)
  - arccy 1y ago
    No technical solution is going to save you from an upstream going rogue and you blindly updating. The only way is to properly review your dependencies.
    - dwattttt 1y ago
      The problem isn't an upstream going rogue; it's an upstream going dark, and someone taking advantage of that. Upstreams going dark happens much more often than them going rogue. A system that requires you to prove more than you just control a domain isn't as vulnerable to this problem.
- junon 1y ago
  This doesn't address availability or discoverability though. There are no upsides other than a fleeting sense of "decentralization", without any of the securities of a real decentralized protocol.
- tsimionescu 1y ago
  For a given version, yes. But the security risk here is about publishing a new (malicious) version of a previously trusted package, by taking control of an expired domain. Say I'm using mydomain.org/abc and it's a perfectly fine package. I'm currently using v1.25.7. Two months later, I see a new version of mydomain.org/abc, v1.25.8. I will likely update to it and use it relatively confidently. But, unbeknownst to me, mydomain.org's registration expired one month ago, and a malicious actor has grabbed it in the meantime; and they have now released a malicious version of this package. Nothing in Go's security model prevents this type of attack, except that Google's package "cache" (the package repo that Go downloads things from) can be configured by Google to not provide that malicious package. This is a major design flaw with the silly idea of using an extremely imparmenent identifier - DNS names, which can only be leased for a limited time and are automatically auctioned off after they expire - as the main identifier for something as long lived as Go packages. No other package ecosystem has this terrible design concept - even when they do use DNS, they use it only for an initial authentication, not as the only identifier. For example, in Java's Maven repo, to publish a package org.mydomain.abc from a Maven Central account, you need to prove that you have ownership of abc.mydomain.org once when associating this package. Afterwards, the package name remains associated with your Maven Central account, forever. If you lose access to that domain name and someone else obtains, they can't go through the same steps, Maven Central won't let them, since that package name is already tied to your account.
junon 1y ago
This is why URI based imports make little sense to me, honestly.
WhyNotHugo 1y ago
go.mod keeps checksums, so this should come up easily for downstream consumers. However, when devs change dependencies, an innocent `go mod …` might update to a new (compromised) version of a dependency.

sneak 1y ago

All of this because we still haven’t solved durable long-term strong cryptographic identity on the internet. (Actually we have, but nobody wants to make people install Metamask or similar to log into websites.)

zokier 1y ago
Keybase had good concept originally and they even had some momentum for a sec, but then they took VC money and imploded. Considering how simple system it was, I feel it should be something we could implement again (without spof)
- ocdtrekkie 1y ago
  I really liked Keybase, and do note that Keyoxide exists as an open-source project where annotations of proofs are made directly on the PGP keys and no longer requires a central point of failure. ;) I will say there are downsides to cryptographic keys being required for updating a package: One of the biggest pain points we have in Sandstorm is we both verify authors using their PGP key (from Keybase, as it happens, it's an old project), and we have a keypair for each app which you need to update it. The end result unfortunately is sometimes we have trivial one-line fixes for apps which are abandoned by the author, and it is very difficult to deploy said fix to end users. This can hypothetically manifest in the form of unfixable security problems. We do have a way to forcibly change the key, but it's intentionally a pain to do, and of course, is possible because ultimately the central authority has the ability to code the platform to circumvent that key anyways. Which is to say, you do trade some security risks for other security risks, whether it's a better situation is an exercise for the reader.
- 0xCMP 1y ago
  One of the founders is doing exactly that: https://foks.pub/ https://foks.pub/ Thread with comments announcing it: https://news.ycombinator.com/item?id=44520419 https://news.ycombinator.com/item?id=44520419
  - zokier 1y ago

jonhohle 1y ago

This isn’t limited to just domains, though it’s good to consider. What happens when Google, Microsoft, or anyone else recycles unused accounts? Unfortunately for them, it seems like email addresses have been so tightly coupled with identity that it seems unreasonable that an address could be reused after any period of account inactivity.

srini_reddy 1y ago
Google wont allow you to register with the deleted/suspended/inactive email address
- nottorp 1y ago
  Why is Google notifying me that they'll delete the account associated with <some email address that i do own> lately then? They'll delete the storage, or make that email available for new registrations?
  - nullwarp 1y ago
    FWIW I am unable to register a gmail for an account I deleted probably 8 years ago at this point. That said I don't know if there is anywhere where it explicitly outlines if it is or is not possible.
    - nottorp 1y ago
      Ah so I either click on it and recover password or give up on it. Decisions decisions...
      - nottorp 1y ago
        Oh funny. They started the recovery process then wanted me to add a phone number so they can send a recovery code. In spite of them first sending a recovery code to the email that I do control and me entering it. I pressed 'try another way' and they told me they don't have enough information to prove the account is mine. Fuck off Google basically. They could at least be honest and state that a phone number is required, instead of pretending that it's for verification.

blibble 1y ago

great! this was one of the major problems with doing maven style domain based namespacing namespaces when?!

michalpleban 1y ago

The presented domain expiration model looks like .com and other global domains. What about .de, .uk and countless other country domains, each having its unique expiration policy? Will it work with them, or only with .com domains?

miketheman 1y ago
This largely depends on the ICANN policies and their definitions of Renewal and Registration Grace Periods. The Renewal period is variable, but the Registration Grace Period is pretty much 30 days everywhere. https://www.icann.org/en/contracted-parties/consensus-policies/expired-registration-recovery-policy/expired-registration-recovery-policy-21-02-2024-en https://www.icann.org/en/contracted-parties/consensus-polici... Here's an example from denic.de: https://www.denic.de/en/domains/de-domains/domain-deletion#code-563-0 https://www.denic.de/en/domains/de-domains/domain-deletion#c...
- TLDRisk 1y ago
  The ERRP only covers gTLDs, right? Have you seen any ICANN policies requiring ccTLDs to adopt the same grace periods. As far as I know, ccTLDs can do whatever they want.
- michalpleban 1y ago
  ICANN policies only govern global domains. Country domains set their own policies; for example, .eu expiration period is 45 days, not 30. WHO IS policies also vary wildly, for example .de domains do not show registration date in the WHO IS, so it's not possible to know if a domain was dropped and re-registered.

TLDRisk 1y ago

Domain expiration is something that's more complicated than most people realize. As an example, I'm not sure if there's a definitive source stating that auto-renew grace is part of the ERRP. In my opinion it's not and the ERRP typically won't trigger for high value domains because they'll be sold or auctioned by the registrar instead. As far as I know, the ERRP rules describe the policies for the deletion of expired domains, which isn't required, so working off the auto-renew grace status was a good choice here. Most people don't realize that expired domains aren't guaranteed to go through the ERRP lifecycle [1]. > You should be aware that during the auto-renew period, the domain name may be available to third parties for registration, depending on your registrar's terms of service. You may also run the risk of having your domain name auctioned to a third party by your registrar during this period (depending on your terms of service) The process described here sounds like a pretty reasonable approach to a hard problem. It won't catch everything, but it's a good approach and it's nice to see some effort put into the issue. 1. https://www.icann.org/resources/pages/registrant-about-errp-2018-12-07-en https://www.icann.org/resources/pages/registrant-about-errp-...

Dunedan 1y ago

dupe of https://news.ycombinator.com/item?id=44942432 https://news.ycombinator.com/item?id=44942432

selinkocalar 1y ago

This is exactly the kind of proactive security thinking we need more of. Supply chain attacks are getting more sophisticated, and preventing domain resurrection attacks is smart defensive strategy. Too many security incidents happen because someone thought "that'll never happen to us." PyPI is thinking ahead about attack vectors before they become widespread problems.