4 ms·

> An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions How can anyone publish

> An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions How can anyone publish their packages?

deleted 1y ago
[deleted]
pneff 1y ago
There is a detailed postmortem in the linked ticket explaining exactly how this happened.
- masfuerte 1y ago
  This is the same phishing attack that hit junon yesterday. https://news.ycombinator.com/item?id=45169657 https://news.ycombinator.com/item?id=45169657
OtherShrezzing 1y ago
The attacker emailed a maintainer from a legitimate looking email address. The maintainer clicked the link and reset their credentials on a legitimate looking website. The attacker then signs into the legitimate duckdb account and publishes their new package. This is the second high-profile instance of the technique this week.
- arewethereyeta 1y ago
  2FA for such high profile packages should be enforced
  - jsheard 1y ago
    It is, if your packages are popular enough then npm will force you to enable 2FA. They started doing that a few years ago. It clearly doesn't stop everything though, the big attack yesterday went through 2FA by tricking the author into doing a "2FA reset".
    - frizlab 1y ago
      Passkeys should be enforced
      - frizlab 1y ago
        I take the downvote but I’d like to know why? Passkeys are effectively and objectively a better security solution than password+2FA. Among other things, they are completely unfishable.
        cesarb 1y ago
        > Among other things, they are completely unfishable. From what I've heard, they're also unbackupable, and tied to the ecosystem used to create them (so if you started with an Apple desktop, you can't later migrate the passkeys to a Windows desktop, you have to go to every single site you've ever used and create new ones).
        smw 1y ago
        You can't really backup hardware tokens, either? It's quite possible to use something like bitwarden/vaultwarden/1password as a password manager, and you can "backup" tokens quite easily without being tied to a particular mobile/desktop ecosystem.
        frizlab 1y ago
        That’s not true anymore; you can migrate passkeys to another password manager now.
        yawaramin 1y ago
        You can just create a new passkey on the new device after logging in. It's a non-issue.
        3eb7988a1663 1y ago
        It is not a given that multiple services let you enroll multiple keys. How many year did it take before Amazon allowed multiple Yubikeys? Which means you are in a real pickle if you ever lose your one hardware device with keys (lost, stolen, bricked, whatever).
  - koakuma-chan 1y ago
    He would have entered 2FA too
  - skeeter2020 1y ago
    for popular packages - and in this case - they are. This attack (and yesterday's) are relay attacks, with the attacker in the middle between npm and the target.

> An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions How can anyone publish their packages?

deleted 1y ago

[deleted]

pneff 1y ago

There is a detailed postmortem in the linked ticket explaining exactly how this happened.

masfuerte 1y ago
This is the same phishing attack that hit junon yesterday. https://news.ycombinator.com/item?id=45169657 https://news.ycombinator.com/item?id=45169657

OtherShrezzing 1y ago

The attacker emailed a maintainer from a legitimate looking email address. The maintainer clicked the link and reset their credentials on a legitimate looking website. The attacker then signs into the legitimate duckdb account and publishes their new package. This is the second high-profile instance of the technique this week.

arewethereyeta 1y ago
2FA for such high profile packages should be enforced
- jsheard 1y ago
  It is, if your packages are popular enough then npm will force you to enable 2FA. They started doing that a few years ago. It clearly doesn't stop everything though, the big attack yesterday went through 2FA by tricking the author into doing a "2FA reset".
  - frizlab 1y ago
    Passkeys should be enforced
    - frizlab 1y ago
      I take the downvote but I’d like to know why? Passkeys are effectively and objectively a better security solution than password+2FA. Among other things, they are completely unfishable.
      - cesarb 1y ago
        > Among other things, they are completely unfishable. From what I've heard, they're also unbackupable, and tied to the ecosystem used to create them (so if you started with an Apple desktop, you can't later migrate the passkeys to a Windows desktop, you have to go to every single site you've ever used and create new ones).
        smw 1y ago
        You can't really backup hardware tokens, either? It's quite possible to use something like bitwarden/vaultwarden/1password as a password manager, and you can "backup" tokens quite easily without being tied to a particular mobile/desktop ecosystem.
        frizlab 1y ago
        That’s not true anymore; you can migrate passkeys to another password manager now.
        yawaramin 1y ago
        You can just create a new passkey on the new device after logging in. It's a non-issue.
        3eb7988a1663 1y ago
        It is not a given that multiple services let you enroll multiple keys. How many year did it take before Amazon allowed multiple Yubikeys? Which means you are in a real pickle if you ever lose your one hardware device with keys (lost, stolen, bricked, whatever).
- koakuma-chan 1y ago
  He would have entered 2FA too
- skeeter2020 1y ago
  for popular packages - and in this case - they are. This attack (and yesterday's) are relay attacks, with the attacker in the middle between npm and the target.