8 ms·
Microsoft's open source tools were hacked to steal passwords of AI developers
- TZubiri 4mo agoanother day, another supply chain vulnerability
- axus 4mo agoTheir source has the list of the 73 disabled repositories: https://opensourcemalware.com/blog/miasma-reaches-azure https://opensourcemalware.com/blog/miasma-reaches-azure
- antiloper 4mo agoAI;DR: Azure (49) azure-functions-agents-runtime azure-functions-connector-extension azure-functions-core-tools azure-functions-docker azure-functions-dotnet-extensions azure-functions-dotnet-worker azure-functions-durable-extension azure-functions-durable-js azure-functions-durable-powershell azure-functions-durable-python azure-functions-extension-bundles azure-functions-golang-worker azure-functions-host azure-functions-java-library azure-functions-java-worker azure-functions-kafka-extension azure-functions-language-worker-protobuf azure-functions-mcp-extension azure-functions-nodejs-e2e-tests azure-functions-nodejs-library azure-functions-nodejs-opentelemetry azure-functions-nodejs-worker azure-functions-openai-extension azure-functions-powershell-library azure-functions-powershell-opentelemetry azure-functions-powershell-worker azure-functions-python-extensions azure-functions-python-library azure-functions-python-worker azure-functions-rabbitmq-extension azure-functions-skills azure-functions-sql-extension azure-functions-templates azure-functions-tooling-feed azure-functions-vs-build-sdk azure-webjobs-sdk azure-webjobs-sdk-extensions azure-websites-security checkaccess-v2-go-sdk Connectors-NET-LSP Connectors-NET-Samples Connectors-NET-SDK Connectors-NodeJS-SDK connectors-python-sdk durabletask functions-action functions-container-action homebrew-functions sonic-gnmi.msft microsoft (10) DurableFunctionsMonitor durabletask-dotnet durabletask-go durabletask-java durabletask-js durabletask-mssql durabletask-netherite durabletask-protobuf Microsoft-Performance-Tools-Apple secure-azureai-agent Azure-Samples (13) azure-ai-content-understanding-python azure-container-apps-multi-agent-workflow azure-container-apps-sandboxes azure-functions-java-flex-consumption-azd azure-functions-nodejs-opentelemetry-samples azure-search-openai-demo-purviewdatasecurity functions-connectors-python functions-connectors-typescript llm-fine-tuning openai-chat-app-entra-auth-builtin openai-chat-app-entra-auth-local rag-postgres-openai-python tutor MicrosoftDocs (1) windows-driver-docs
- sph 4mo agoThere is such a thing as too much software.
- trumpdong 4mo agoIndeed. Every line of code is like a liability, but managers suddenly decided to stack rank developers based on number of lines of code written, again, which is like ranking aircraft designs by how heavy they are.
- marcosdumay 4mo agoMicroservices have got all the attention, but at around the same time there existed the microlibraries fashion too. And just like the other one, the people proposing those microlibraries knew what they were doing and had actually reasonable ideas. But masses of FAANG developers took it and run wild.
- JdeBP 4mo agoThese seem related: * https://news.ycombinator.com/item?id=48418318 https://news.ycombinator.com/item?id=48418318 (The Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds) * https://news.ycombinator.com/item?id=48450543 https://news.ycombinator.com/item?id=48450543 (Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents) * https://news.ycombinator.com/item?id=48416155 https://news.ycombinator.com/item?id=48416155 * https://news.ycombinator.com/item?id=48416269 https://news.ycombinator.com/item?id=48416269 (Miasma Worm Targets AI Coding Agents via GitHub Repos)
- cookiengineer 4mo agoI created a mitigation tool that can be used to fix/remove the worm from all infected repositories, and did a writeup about this. On Monday, the Hades campaign introduced Composer, Go and Pip support. Before that it had only support for NPM and AI assistant editors. (Well, and Ruby btw but nobody uses Rubygems anymore it seems). What even Microsoft gets wrong: This is the first worm that runs on all platforms in the code ecosystem. Developer host machines, servers, ci/cd runners. And all of them spread the worm to all repositories that are accessible on those machines. You would have to completely shutdown 100% of all computers AND aws ec2 AND google cloud platform AND azure AND kubernetes clusters AT THE SAME TIME to beat this worm. It literally spreads across all infrastructure. Kill switch, as always with APT28 malware, is setting the host language to ru_RU.KOI8-R (LANG environment variable). That disables the spread mechanism. My Mitigation Tool (I'm updating it as new package systems are targeted ...): https://github.com/cookiengineer/antimiasma https://github.com/cookiengineer/antimiasma Blog post: https://cookie.engineer/weblog/articles/malware-insights-miasma-campaign.html https://cookie.engineer/weblog/articles/malware-insights-mia...
- philipwhiuk 4mo agoIt only spreads if you run the code...
- cookiengineer 4mo ago
- jbverschoor 4mo agoNote that also the homebrew-tap was affected: homebrew-functions
- dude250711 4mo agoThe Age of Agentic Development.
- sph 4mo agoI haven’t worked on any web app in months, I don’t use LLMs, I update my Linux system once a month, and I increasingly feel I should just not do anything, not install or update any software and for the love of God, do not touch anything that’s shipped with npm. Most of my userspace apps are in Flatpak sandboxes (yeah they are not great), but otherwise it feels like isolation and airgapping is the most sensible solution for now, and it’ll get increasingly worse unless the vibe coders somehow learn how to write robust software. It’s like during the black plague: the (software) world has become dangerous, we have no way to contain it, it is unfeasible to remove yourself completely from the world, so you better pray really hard you don’t catch the bug and infect your peers. How’s that for a field we used to call software engineering or computer science?
- ares623 4mo agoguys. what the fuck. are we even doing.
- larodi 4mo agogetting deeper and deeper. the question is what goes one when breaches reach opensource-based stuff running nuclear reactors. i'd be concerned.
- trumpdong 4mo agoPeople say nuclear reactors are completely safe if properly constructed and operated and the waste danger is overblown if properly managed. There aren't many institutions extant today that I could trust to properly construct and operate a nuclear reactor, never mind manage nuclear waste for the next 100000 years. The Trump government just decided that there is an acceptable level to irradiate the population by the way (abandoned the linear-no-threshold model of radiation's effects on an organism)
- nDRDY 4mo agoWe are ever-faster approaching the Anti Singularity, the moment when everything "tech" implodes and progress screeches to a halt.
- narrator 4mo agoWhat if this is "The Great Filter?" [Ominous music plays in the background]
- protoman3000 4mo agoAnd we trust these people with the root CA cert in our Secure Boot?
- deleted 4mo ago[deleted]
- justinclift 4mo agoMore like "forced to accept" rather than "trust". This latest event just continues Microsoft's track record of being a security problem rather than having their shit together. :(
- shakna 4mo agoYou mean the company that failed their 2023 security review? [0] > Individually, any one of the failings described above might be understandable. Taken together, they point to a failure of Microsoft’s organizational controls and governance, and of its corporate culture around security. Microsoft’s products and services are ubiquitous. It is one of the most important technology companies in the world, if not the most important. This position brings with it utmost and global responsibilities. It requires a security-focused corporate culture of accountability, which starts with the CEO, to ensure that financial or other go-to-market factors do not undermine cybersecurity and the protection of Microsoft’s customers. > Unfortunately, throughout this review, the Board identified a series of operational and strategic decisions that collectively point to a corporate culture in Microsoft that deprioritized both enterprise security investments and rigorous risk management. These decisions resulted in significant costs and harm for Microsoft customers around the world. > The Board is convinced that Microsoft should address its security culture. [0] https://www.cisa.gov/resources-tools/resources/CSRB-Review-Summer-2023-MEO-Intrusion https://www.cisa.gov/resources-tools/resources/CSRB-Review-S...
- stogot 4mo agoBonkers that this wasn’t bigger news
- magicalhippo 4mo ago
- minraws 4mo agoRemember folks Microsoft has Mythos access
- deleted 4mo ago[deleted]
- xeyownt 4mo agoNo, it's Mythos that has access to Microsoft now :-)
- Lapsa 4mo ago[dead]
- _pdp_ 4mo agoWhat follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has increased dramatically in the enterprise. Again, I am not saying it is related but I think it has an impact. Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing. I am not saying it is related but I feel that it coincides perfectly. I just cannot believe there is no underlaying thread going through all of these recent supply chain issues, and yes there are some hacking groups that specialise in this, sure, but it is because the bounty is plentiful.
- altairprime 4mo agoI argued for years that we had too few workers for our total project count and management argued that most projects were idle and so it was fine to have so many per worker. Welp.
- _pdp_ 4mo agoI think web-based IDEs like GitHub Codespaces (but even VSCode with tunnels) is part of the solution because at the very least you can get an isolated dev environment per project. I've been advocating for this for as long as I remember. Unfortunately, most developers don't like them so it is a though sell.
- altairprime 4mo agoIs the theory here that the browser cannot be co-opted to infect web-based repositories? Also: thinking of how yt-dlp can integrate with browser cookies now and the malware paths that opens up. (This is part of why Chrome wants HSM cookies, I expect: DRM and opsec!)
- zihotki 4mo agoAnd the best recommendation security teams can give - keep your SBOM strict, use min release age policy (sounds more like band-aid). That's a scary world to live in.
- wolfi1 4mo agoa friend of mine has a very different solution: he codes everything by hand. he says that the time you need to research to include a new package you can actually use to code the piece you need. and he for sure doesn't have the problems of transitive dependencies
- dgellow 4mo agoI assume that means he genAIs all his deps? Rather than writing by hand
- nicce 4mo agoDepending of the scenario, it can be very fine. E.g. if you just need one or two function call from the dependency. However, for some complex binary protocols it might be better to stick with libraries.
- hsbauauvhabzb 4mo agoBut now he needs to develop, test and maintain that code. Left pad is easily hand coded, react framework not so much.
- 4mo ago
- axegon_ 4mo agoI hate to be the "I told you" guy but... I told you and have been for years. And every time I do, a flock of sloppers come to say "but have you tried the claude sloppus, it's so good man, I haven't written any code in X months". Well.. Enjoy.
- glemmaPaul 4mo ago[dead]
- deleted 4mo ago[deleted]
- bilekas 4mo agoThe phrasing of the title is loaded and the content phrases it as some kind of fault of open source. Then, which I find the most amusing, proceeds to blame MicroSlop for the attempted suuply chain attack, > Microsoft did not immediately provide the specific number of customers affected, when asked by TechCrunch. Yeah, because that's how open source works. Tech crunch doing hard work no not explain that. > This is Microsoft’s second known breach over the past few weeks that has allowed hackers to compromise its open source projects, per Ars Technica. I, like many others love to knock on Microslop when I can, but in this case they did the right thing. The article phrases it like they did everything wrong, they're all at fault and shame on them for limiting the breach. This is not the first time I've seen an article from Zack Whittaker that just rubbed me the wrong way. > steal passwords of AI developers This phrasing has it's own connotations. AI developers versus developers who use AI? > This is the latest example in recent months of hackers breaching widely popular open source projects with the aim of planting malware on a large number of users who have the code installed on their computers. These hacks are known as “supply chain” attacks as they target code that is often used in a large number of software products, or by a specific kind of user, which may be advantageous to hack as they sometimes have access to cloud systems and large amounts of customers’ data. Describes literally nothing of what a supply chain attack is, just the result of one and the reasons for their attack surface. Very very bad reporting in my opinion. Bad breach, and I hate to admit M$ did the safe and right thing, but this 'reporting' leaves a lot to be desired.
- raffael_de 4mo agoWhat's your post mortem, then? As in - what happened and how should it be read?
- bilekas 4mo agoMicrosoft's open source projects the target of a supply chain attack and they decided to restrict access to understand and limit exposure ? Something a little more 'true' and less targetted?
- philipwhiuk 4mo ago
- bob1029 4mo agoI strongly suspect this is a case of classic personal access tokens being used in an unclean way. If you are going to be handing tokens to AI agents on weird openclaw contraptions, you should try to use the fine grained variants. My GitHub account spans 3 organizations with wildly differing policies. The fact that classic tokens are even still allowed blows my mind a bit. You should be required to manually opt in each organization at a minimum.
- test20201 4mo agoYou are correct but the issue is permission management with finegrained tokens is nighmare. It is not easy to decide what is correct and what is needed for some operation. Furthermore, often software devs think it is important to focus on code rather than permissions - as it is for someone else's responsibility....
- jerf 4mo agoSometimes the basic things missing in the programming world just shock me. How is anyone supposed to know what permissions to give in these systems that have literally hundreds of fine-grained permissions, many of which can also have scope? Even if they're "documented" we all know from experience that some textual descriptions of a permissions won't capture when it is actually used in the code. Why isn't it standard to have a security log that shows what permissions were requested, with what scope, so we can at least create a minimal set of permissions by trying an operation, seeing what permissions are necessary, and then setting just the needed permissions? If you're worried about that log itself becoming a compromise, make it something that is off by default, and maybe automatically turns off after some period of time, or make me use a burner token for this operation, or something, but the alternative is the world of excessively-broad permissions that we live in now. Why isn't there a helper mode that a dev can use to point at an interaction and say "now give me minimal permissions for those interactions", not only to configure a given key but so we can learn what permissions actually mean in practice? We're given these super complicated knobs, but all we get for using them is a few textual blurbs about the settings and the blame if we don't configure them exactly correctly, and also the blame if something breaks because we were too tight with the permissions. This seems such a basic tool to use these super complicated systems yet I've never seen them anywhere on the web. Perhaps ironically, perhaps just because it was already complicated enough and needed a way to approach usable, the notoriously difficult to use SELinux uses this as the more-or-less standard way of setting permissions. I can't believe I'm missing SELinux.
- raincole 4mo ago> steal passwords of AI developers What does this even mean? The malware specifically steals passwords from developers who use AI? From those who develop AI tool? Or it steals API tokens, which serve a similar function as passwords do for humans? Is this what journalism looks like today? Just slap the two holy letters on the title and you get views? (Yes, I read the article. No, I still don't think the title makes sense. You can skip this techchurch slop and read the real information here: https://opensourcemalware.com/blog/miasma-reaches-azure https://opensourcemalware.com/blog/miasma-reaches-azure)
- Ukv 4mo agohttps://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-... mentions that it plants `.claude/settings.json`, `.gemini/settings.json`, `.cursor/rules/setup.mdc`, and `.vscode/tasks.json` to execute its payload as a setup task. VSCode will be used by plenty of non-AI-using developers, and the credential harvester is not specific to AI API tokens, but that 3/4 of the targets are AI coding tools is I assume where the claim comes from.
- sourcecodeplz 4mo agoDo I remember correctly when techcrunch was charging $10k per month for a square banner on its website, 2005? And that was considered the top, for a tech blog. Even then they posted slop.
- trumpdong 4mo ago> you can skip the slop and read the real information here: (link that is obviously written by AI)
- raincole 4mo agoAnd? If the techchurch post is written by a human then I'll take this as an example that humans outslop AI.
- yossufyahia 4mo agoIt actually feels like nothing is safe now every day you hear about hacking is it from the ai making development weak or ai is getting strong in hacking
- Zolomon 4mo agoIt was never safe to begin with, that is why the security community has been screaming for resources since the 80s.
- trumpdong 4mo agoIf the security community had unlimited resources you wouldn't be able to do very much with computers. Security and usability are opposite ends of a spectrum. Either you can do a lot (usability) or you can do little (security).
- SAI_Peregrinus 4mo agoDisagree, availability is part of security. That's why denial of service attacks are a security issue. Bad enough usability is indistinguishable from a DoS attack.
- verminator468 4mo ago[dead]
- abc3354 4mo ago"No way to prevent this" say users of only package manager where this... Oh no sorry I thought this was Javascript Haters weekly meetup
- ashishb 4mo agoNobody should do 'npm install' or 'pip install' on their machine. Using a proper sandboxing(https://github.com/ashishb/amazing-sandbox https://github.com/ashishb/amazing-sandbox) regularly will drastically limit the blast radius of these attacks.
- graemep 4mo ago> Nobody should do 'npm install' or 'pip install' on their machine. What alternative do you suggest? Do you mean not install outside a sandbox?
- themafia 4mo agoDownload source. Extract. Move files to correct node_modules folder. If your distribution requires more than this, then it's not really a module, or combines too many non-modular components, and should be distributed differently. The ability for npm to run scripts on any level should be removed. Then we can go back to worrying about namespacing issues.
- dist-epoch 4mo agoIf an attacker can infect the post-install script of an npm package, they can also infect the package source code itself. So if you ever run the project outside the sandbox, you will still get compromised. It's like saying "I don't trust a software app with an installer, I just want a .zip with the binaries from the same source that I will run myself"
- themafia 4mo ago> they can also infect the package source code itself Which is where the concept of "safe levels" come in. I should be able to install this module in such a way where file operations and process operations are not available to it. That being said, presumably, this types of infiltration would seem to be _much_ easier to spot. "Why is this web framework calling 'spawn'?" > I just want a .zip with the binaries I want a .zip with the _code_. Just the code. None of the packaging nonsense. My distribution can handle that.
- haute_cuisine 4mo agoPlease, someone explain how it's possible to add obfuscated file to so many repositories? Do they don't have any code reviews? Also, the title is misleading, setup adds config to be auto executed by people who work on the repo. They would have to use vscode/cursor/claude/gemini. People who use codex / opencode / other harnesses are safe I guess. Details: https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-...
- vorticalbox 4mo agoif an account with the ability to push to the repo was taken over, there wouldn't be any PR review.
- axegon_ 4mo ago> Do they don't have any code reviews? I have a good friend that works for one of the giants(I can't say which one for obvious reasons but S&P 500). He's been working there for quite a while now, so far he hasn't seen what the project he works on looks like, has the repo cloned and knows what language is used but nothing beyond that. Everything is slopped together. His project is the authentication and authorization system for all the company products. In his own words "I hit Tab all day long and write 'this is intended' in the reviews, which are all ai, there is no human in the loop. This is what we are told to do by the CEO and CTO unironically. If something breaks, no one knows how any of this works since no one has seen the actual code. Our performance reviews are based on how many tokens we've used, not what we have done". I suspect this is the case in many companies now so it's not unreasonable to think that there are no actual code reviews.
- trumpdong 4mo agothe reasons are not obvious. I want to avoid their products.Does anyone else *cough* who has a throwaway account know the place?
- 4mo ago
- shevy-java 4mo agoGitHub keeps on having problems a LOT in the last months. Skynet is winning now.
- pluc 4mo agoIf you want to be taken seriously, don't use Windows.
- devilfileprong 4mo agoWaze can be a psi to vibe code vanilla at the end of the day or bubblesort (RBAC) Knit365,the clippy knitting assistant support hotline can hotnet to mortal Kombat as k2tog Cymux,we lost the Sigint.
- opsnooperfax 4mo agoAnd the criminals found that Microsoft has yet to produce and AI worth stealing. A deeply ironic twist.
- bdcravens 4mo agoThat makes for a funny tongue in cheek comment, but it's not MS's AI they're after, it's end user secrets, and the exploits target multiple LLMs. (by adding commands to relevant MD files)
- skeledrew 4mo agoCan't say I expect better. This is part of why I've been jumping away from things acquired/owned by them for the past 13+ years.
- 349187 4mo agoGood. Let it all implode.
- mortar 4mo agohttps://archive.is/bnm7u https://archive.is/bnm7u
- deleted 4mo ago[deleted]
- yoyohello13 4mo agoI had to reset my personal Microsoft account password yesterday because I got a two factor alert about a log in attempt from Romania. I can’t figure out how they got my password though because the only Microsoft product I own is an Xbox. Even before ai though Microsoft leaks like a sieve. I wish my company would move off them, but we are locked in.
- rspijker 4mo agoIt is almost impossible to set up personal Microsoft accounts that does not allow passwordless login. So what is more likely to have happened is that your account is set up like this and you are just getting MFA requests that are not a second factor, but simply an attempt to get access to your account. I was getting multiple of these a day and found that if you set up the Microsoft Authenticator app from a phone, it will force it to passwordless if you have any type of lock on your phone (facial, fingerprint, pin). The only way around it is to disable all of those while setting up the account in the authenticator app. I don't use my Microsoft account much, so just use a separate e-mail now for verification instead of the authenticator app. The fact that this is how it works is of course insane, but I'm guessing someone inside of Microsoft is hitting their KPIs for passwordless logins or something...
- yoyohello13 4mo agoThank you! I have a very strong password so I was worried about how this could happen, but your scenario makes sense. Especially since it only seems to be my Microsoft account having this problem.
- skinfaxi 4mo agoIn some organizations I've worked at, the multi-factor prompt would occur regardless of the password validity (wastes more of the attacker's time). Is that the case with Microsoft? I'm not sure.
- jrm4 4mo agoI have not read the article, but it's interesting to be at a point where the headline is so bad that it deserves commenting on its own; i.e. understanding that there is no way possible for the connotation (not denotation) of the headline to be "correct." The connotation here being either "open source is dangerous" or "Microsoft's specific brand of open source is dangerous" -- which coincidentally provides good clickbait for both "pro-open source" and "anti open source" types. Anyway, not reading. They should do better.
- giancarlostoro 4mo agoI was probably late to the party in realizing and saying it, but I've been saying for a little while, even if you don't want to use AI because "the code is bad" or whatever, I highly suggest you consider having AI auditing code and services for security, or literally anything that scans code for vulnerabilities. The attack vector isn't just plugins that steal your data, but also 0-day exploits in just about any software you use, and even your own web services being exploited by a script kiddy with an LLM. There will be an increase in hacks and it's only going to get worse, so anyone not investing in cyber security audits and auditing tools should really reconsider.
- yifanl 4mo agoAI harnesses were exploited, here's why it's actually good for AI.
- giancarlostoro 4mo agoNot what I'm saying at all, but okay. More like "don't sleep on cyber security" more than anything. I don't care if you use AI, though it can definitely be useful for security auditing. Red teams are going to become more invaluable these days.
- yifanl 4mo agoYou're talking about living in a world where we have to take entirely preventative steps, not reactive because hacking is going to be that much more prevalent. AI can tell you you're being zero-day'd, but that isn't much comfort - you're already expecting everyone to always be zero-day'd at all times!
- giancarlostoro 4mo agoWhat I'm suggesting is that AI and security tooling can help you minimize attack vectors.
- deleted 4mo ago
- Ile09 4mo ago[dead]
- synapsehire 4mo ago[flagged]
- jasonvorhe 4mo agoWasn't there some directive within Microsoft to fix their security issues? How many other OSS repos of similarly sized companies get compromised like this? No one ever got fired for choosing IBM or AWS - but apparently Microsoft has a decades long free pass everywhere. Insane.
- Rantenki 4mo agoI am inordinately amused by the fact that Microsoft's Github has suspended access by Microsoft's Azure (and anyone else) to their Microsoft code-base because of a TOS violation. Really drives home this org chart: https://www.businessinsider.com/big-tech-org-charts-2011-6 https://www.businessinsider.com/big-tech-org-charts-2011-6
- flowbarai 4mo ago[flagged]