3 ms·

So in principle, it's doing the same thing as: $ curl http://get.example.io | sh which we all know is bad. But in this case, it's hidden deep enough that

by clarkm 12y ago

So in principle, it's doing the same thing as: $ curl http://get.example.io | sh which we all know is bad. But in this case, it's hidden deep enough that most people don't even know it's happening.

akerl_ 12y ago
Sort-of. That has the additional non-malicious risks. A broken connection turns "rm -r /var/lib/cool/place" into "rm -r /var/" and the shell processes that.
- technomancy 12y ago
  It's also different in that the artifact signatures are there for you to check if you want to; it's just that most people don't bother, and even if you do, you probably can't tell which keys you should trust to begin with.
yonran 12y ago
Downloading from HTTP is not an issue (as far as integrity is concerned) if maven were to validate the downloads against some chain of trust. But apparently it is not. Now I am wondering what tool actually uses those .asc files that I have to generate using mvn gpg:sign-and-deploy-file when I upload new packages to sonatype...
- technomancy 12y ago
  Running `lein deps :verify` does this.
  - brl 12y ago
    How does it know what the correct signing key is? edit: Looked up answer myself. Lein downloads whatever key the signature claims to be made with from public keyservers. How does this provide any additional security over not bothering to verify signatures?
    - technomancy 12y ago
      The difference is that you could track down the keys either directly from the author or by someone who has already personally verified and signed the author's key. In practice this is very difficult, and using a key that you haven't gotten your friends and co-workers to sign is not any better than skipping the signing altogether.
      - brl 12y ago
        Even if you have carefully installed the correct key from the author, if your download is intercepted and an attacker sends you a bogus artifact and signature it looks like Lein will just retrieve the attackers key from the keyserver and validate the signature.
        technomancy 12y ago
        This is true; at the time of implementation so few Clojure libraries were signed that taking it the rest of the way was not a clear win. But clearly the job isn't finished; even if Clojure developers do a good job of signing packages and signing each others keys, (which is not generally true today) it still needs to distinguish between signed packages and trusted packages. Hopefully the next version can add this. But as with anything that requires extra steps from the developer community, a thorough solution is going to take time.
- GaryRowe 12y ago
  Nexus and Artifactory can be configured to check the signatures, but you're into Web of Trust territory. I wrote an article about mitigating this attack vector a while back which might be useful: http://gary-rowe.com/agilestack/2013/07/03/preventing-dependency-chain-attacks-in-maven/ http://gary-rowe.com/agilestack/2013/07/03/preventing-depend...
stevekemp 12y ago
Exactly and sadly this is all too common. Did you know that Xine, the media-player, has a similar thing behind the scenes? I didn't http://blog.steve.org.uk/did_you_know_xine_will_download_and_execute_scripts_.html http://blog.steve.org.uk/did_you_know_xine_will_download_and...

by clarkm 12y ago

So in principle, it's doing the same thing as: $ curl http://get.example.io | sh which we all know is bad. But in this case, it's hidden deep enough that most people don't even know it's happening.

akerl_ 12y ago

Sort-of. That has the additional non-malicious risks. A broken connection turns "rm -r /var/lib/cool/place" into "rm -r /var/" and the shell processes that.

technomancy 12y ago
It's also different in that the artifact signatures are there for you to check if you want to; it's just that most people don't bother, and even if you do, you probably can't tell which keys you should trust to begin with.

yonran 12y ago

Downloading from HTTP is not an issue (as far as integrity is concerned) if maven were to validate the downloads against some chain of trust. But apparently it is not. Now I am wondering what tool actually uses those .asc files that I have to generate using mvn gpg:sign-and-deploy-file when I upload new packages to sonatype...

technomancy 12y ago
Running `lein deps :verify` does this.
- brl 12y ago
  How does it know what the correct signing key is? edit: Looked up answer myself. Lein downloads whatever key the signature claims to be made with from public keyservers. How does this provide any additional security over not bothering to verify signatures?
  - technomancy 12y ago
    The difference is that you could track down the keys either directly from the author or by someone who has already personally verified and signed the author's key. In practice this is very difficult, and using a key that you haven't gotten your friends and co-workers to sign is not any better than skipping the signing altogether.
    - brl 12y ago
      Even if you have carefully installed the correct key from the author, if your download is intercepted and an attacker sends you a bogus artifact and signature it looks like Lein will just retrieve the attackers key from the keyserver and validate the signature.
      - technomancy 12y ago
        This is true; at the time of implementation so few Clojure libraries were signed that taking it the rest of the way was not a clear win. But clearly the job isn't finished; even if Clojure developers do a good job of signing packages and signing each others keys, (which is not generally true today) it still needs to distinguish between signed packages and trusted packages. Hopefully the next version can add this. But as with anything that requires extra steps from the developer community, a thorough solution is going to take time.
GaryRowe 12y ago
Nexus and Artifactory can be configured to check the signatures, but you're into Web of Trust territory. I wrote an article about mitigating this attack vector a while back which might be useful: http://gary-rowe.com/agilestack/2013/07/03/preventing-dependency-chain-attacks-in-maven/ http://gary-rowe.com/agilestack/2013/07/03/preventing-depend...

stevekemp 12y ago

Exactly and sadly this is all too common. Did you know that Xine, the media-player, has a similar thing behind the scenes? I didn't http://blog.steve.org.uk/did_you_know_xine_will_download_and_execute_scripts_.html http://blog.steve.org.uk/did_you_know_xine_will_download_and...