louislang

16 ms·

91.
by louislang 4y ago
npm does something similar with their scoped packages. It fixes the problem for the top level packages, but you'd still have to contend with the transitive dependencies written by smaller organizations or individual contributors. In th
92.
by louislang 4y ago
The problem is large, sprawling and complex. In an ideal case, we'd have high quality packages maintained by reputable people/organizations. But today this just isn't true. Open source takes contributions from a large number
93.
by louislang 4y ago
A lot of the malware targeting developers is leveraging the installation hooks as the execution mechanism. So sandboxing the install helps stop this particular attack vector - which is why it gets talked about so much. If you put code in th
94.
by louislang 4y ago
It's totally happening. We've seen packages targeting a lot of the big exchanges. Most of the packages are targeting developers directly though; attempting to exfil the users wallets/keys.
95.
by louislang 4y ago
It definitely does help. We've seen malicious actors introduce "bad things" into legitimate packages [1]. So hashes help identify what you got, but doesn't necessarily prevent you from getting something you didn't i
96.
by louislang 4y ago
> I think the better solution is transparent sandboxing for dev environments. I don't disagree at all. We're building an open source sandbox for devs right now for this exact reason. Linked it in another comment.
97.
by louislang 4y ago
Exactly, I don't think you can rely on a naïve import to determine maliciousness. We've basically had to build out heuristics that are capable of walking function calls for this exact reason. Otherwise things are just too noisy.
98.
by louislang 4y ago
I'm honestly not sure the benefits of executing code during compilation/install outweigh the bad. Most attacks we have seen leverage this as the attack vector.
99.
by louislang 4y ago
They are trying. The level of effort to release these things is so low, the effort required to catch it and remove it at scale is much harder, unfortunately.
100.
by louislang 4y ago
Yes, this works really well. But as soon as you deploy it, the actors change tactics. We've had to build a defense in depth approach to discovering malicious packages as they are introduced into the system.
101.
by louislang 4y ago
Full disclosure, I am a co-founder at Phylum. We are actively working on a solution that will fully sandbox package installations for npm, yarn, poetry and others. It's rolled up as part of our core CLI [1], but is totally open source
102.
by louislang 4y ago
It's a slew of checks for passwords and other things on the developers machine. The data is extracted and sent to a remote endpoint controlled by the attacker.
103.
by louislang 4y ago
> Yeah a time/activity based trust system like thepiratebay uses could be helpful. This is an excellent idea. Authors are something we are digging into heavily as part of an ongoing effort to improve trust in the open source ecosyst
104.
by louislang 4y ago
For what it's worth, this happens in pretty much all the ecosystems. We have seen similar behavior in NPM, rubygems, and others. PyPI is just really popular.
105.
by louislang 4y ago
That's correct, it's exfiltrating data from the developer machine
106.
Dozens of malicious PyPI packages discovered targeting developers(blog.phylum.io)
754 points by louislang 4y ago|320 comments
107.
Semi-untethered permasigned jailbreak for iOS 15(github.com)
3 points by louislang 4y ago|0 comments
108.
List of software (un)affected by OpenSSL vulnerability(github.com)
2 points by louislang 4y ago|0 comments
109.
by louislang 4y ago
Phylum | 100% Remote | Full-time | Senior Software Engineer | https://phylum.io Phylum is a venture backed cyber security company focusing on securing the software supply chain. We focus on the analysis of open source packages,
110.
RCE via GitHub import(gitlab.com)
184 points by louislang 4y ago|54 comments
111.
Are we alone? The search for intelligent life in the universe(astronomy.com)
4 points by louislang 4y ago|1 comments
112.
Fuzzing Trackmania Nations Forever for RCE(blog.bricked.tech)
41 points by louislang 4y ago|0 comments
113.
Active Typosquatting Campaign Against NPM(blog.phylum.io)
4 points by louislang 4y ago|0 comments
114.
0-Day RCE Vulnerability Against Microsoft Exchange Servers(gteltsc.vn)
5 points by louislang 4y ago|0 comments
115.
The Dependency Network Shows the Complexity of the Software Ecosystem(blog.phylum.io)
1 points by louislang 4y ago|0 comments
116.
A Chinese Spy Wanted GE’s Secrets, but the US Got China’s Instead(bloomberg.com)
3 points by louislang 4y ago|0 comments
117.
Another Tale of IBM I (AS/400) Hacking (2022)(blog.silentsignal.eu)
1 points by louislang 4y ago|0 comments
118.
by louislang 4y ago
This is covered quite well in "Honeybee Democracy" by Seeley. Absolutely fascinating read about swarm intelligence.
119.
WhatsApp Remote Code Execution in Video Call(nvd.nist.gov)
385 points by louislang 4y ago|149 comments
120.
by louislang 4y ago
I suspect you're probably right to be apprehensive, but it's a slight step forward from a few months back when they were signaling that a bill wasn't necessary. Progress, I guess?

More ›