ashishbijlani

13 ms·

91.
by ashishbijlani 4y ago
Thanks! Would love to receive code contributions from rare folks like you who have binary analysis expertise. Currently, it uses strace to track process/net/fs system calls on Linux.
92.
by ashishbijlani 4y ago
Packj https://github.com/ossillate-inc/packj can easily detect such malicious packages by pointing out if a package accesses sensitive files (e.g., SSH keys), spawns executables, exfiltrates data, is abandoned, lacks 2
93.
by ashishbijlani 4y ago
Plug: I've been building tooling to easily audit third-party open-source dependencies for supply chain attacks. Packj [1] analyzes Python/NPM/Rubygems packages for several risky code and attributes such as Network/File p
94.
Rubygems packages found carrying out dependency confusion research(github.com)
2 points by ashishbijlani 4y ago|0 comments
95.
by ashishbijlani 4y ago
We've created a Github action [1]. It pulls data from our backend service https://packj.dev that continuously scans packages. You will have to create a free account. 1. https://github.com/marketplace/ac
96.
by ashishbijlani 4y ago
By pinning versions, running Packj on deps and manual analysis :)
97.
by ashishbijlani 4y ago
Sure. Please email me (in profile) for the list. You can also look at the following resources for malware samples: 1. https://github.com/IQTLabs/software-supply-chain-compromises 2. https://github.com/r
98.
by ashishbijlani 4y ago
Yes, we are incorporating strace-based dynamic analysis (containerized) to collect system calls. However, Packj can currently flag use of getattr() API as it is equivalent to "runtime code generation" [1]; a developer can go and
99.
by ashishbijlani 4y ago
Packj currently uses static code analysis to derive permissions (e.g., file/network accesses). Therefore, it can detect open() calls if used by the malware directly (e.g., not obfuscated in a base64 encoded string). But, Packj can also
100.
by ashishbijlani 4y ago
> a base 64 encrypted string that gets decrypted and then passed to a shell. This is a very common malicious behavior. Packj detects obfuscation [1] as well as spawning of shell commands (exec system call) [2]. I've updated threats.
101.
by ashishbijlani 4y ago
Thanks for trying it out and sharing your feedback! I will fix this issue and also create a Dockerfile for easy testing.
102.
by ashishbijlani 4y ago
I've been building tooling to mitigate supply chain attacks like these. Packj [1] analyzes Python/NPM packages for risky code and attributes such as Network/File permissions, expired email domains, etc. Auditing hundreds of d
103.
by ashishbijlani 4y ago
Have they already enforced 2FA? The tool that I built to detect "risky" NPM/PyPI packages [1] still shows expired email domain for browserify (a top NPM package) 1. https://github.com/ossillate-inc/packj
104.
by ashishbijlani 4y ago
Would love to integrate this in https://github.com/ossillate-inc/packj
105.
by ashishbijlani 4y ago
I've been building tooling to mitigate open-source supply chain attacks. Packj [1] analyzes Python/NPM packages for risky code and attributes such as Network/File permissions, expired email domains, etc. Auditing hundreds of
106.
by ashishbijlani 4y ago
Packj tool ( https://github.com/ossillate-inc/packj ) analyzes Python/NPM packages for risky code and attributes such as Network/File permissions expired email domains. It uses static code analysis. We are addi
107.
by ashishbijlani 4y ago
https://github.com/ossillate-inc/packj analyzes Python/NPM packages for risky code and metadata attributes. Uses static code analysis. We found a bunch of malicious packages on PyPI using the tool, which have now
108.
Where did my 256 GB go? Mobile Storage Analysis(dl.acm.org)
7 points by ashishbijlani 5y ago|0 comments
109.
by ashishbijlani 5y ago
fork here is COW on the host kernel (i.e., copying EPT entries). We will post detailed technical documentation soon.
110.
by ashishbijlani 5y ago
No, gVisor is from Google. They emulate system calls in user-space and use VMs, which increases runtime performance overhead. We use hardware virtualization to directly run containers -- no I/O emulation, no expensive VM exits, scale a
111.
by ashishbijlani 5y ago
> Can we somehow combine the advantages of the docker ecosystem with VMs? Shameless plug: this is exactly what our goal is with https://kwarantine.xyz We are creating a new hypervisor (from scratch) that can run strongly iso
112.
by ashishbijlani 5y ago
We've been working on a new hypervisor https://kwarantine.xyz that can run strongly isolated containers. It’s still a WIP though.
113.
by ashishbijlani 5y ago
Being security/systems researchers, that's exactly what our goals are as well.
114.
by ashishbijlani 5y ago
Yes, we will post the numbers soon. However, what I was alluding to in my last comment was that FC runtime performance is far from native (i.e., no VMs). Therefore, there's definitely room for improvement. Depending on the use case, th
115.
by ashishbijlani 5y ago
It depends on the requirements. We can start as early as next month. Would it be possible for you to get in touch on our Slack?
116.
by ashishbijlani 5y ago
Thanks! We will post detailed technical docs on design/features soon. FC improved kernel boot up time (by stripping unnecessary functionality). However, runtime performance takes a hit due to I/O virtualization/emulation: ht
117.
by ashishbijlani 5y ago
Thanks for the feedback! We are still trying to figure out the business model.
118.
by ashishbijlani 5y ago
There was a question (now deleted) on difference between this and Firecracker. FC/gVisor/Kata use VMs to sandbox containers. However, VMs incur high runtime overhead (not to be confused with fast booting) and need to be provisione
119.
by ashishbijlani 5y ago
Hello HN! We've been working on a new hypervisor https://kwarantine.xyz that can run strongly isolated containers. This is still a WIP, but we wanted to give the community an idea about our approach, its benefits, and vario
120.
Hypervisor for multi-tenant computing, like it should be(kwarantine.xyz)
16 points by ashishbijlani 5y ago|19 comments

More ›