Slashdot Mirror
Node.js Event-Stream Hack Reveals Open Source 'Developer Infrastructure' Exploit (arstechnica.com)
"[O]n Nov. 26 it was publicly revealed that a widely deployed open-source Node.js programming language module known as event-stream had been injected with malicious code that looked to steal cryptocurrency wallets," reports eWeek, adding "The event-stream library has over two million downloads."
An anonymous reader quotes Ars Technica: The backdoor came to light [November 20th] with this report from Github user Ayrton Sparling. Officials with the NPM, the open source project manager that hosted event-stream, didn't issue an advisory until six days later.... "This compromise was not targeting module developers in general or really even developers," an NPM official told Ars in an email. "It targeted a select few developers at a company, Copay, that had a very specific development environment set up. Even then, the payload itself didn't run on those developers' computers; rather, it would be packaged into a consumer-facing app when the developers built a release. The goal was to steal Bitcoin from this application's end users...."
According to the Github discussion that exposed the backdoor, the longtime event-stream developer no longer had time to provide updates. So several months ago, he accepted the help of an unknown developer. The new developer took care to keep the backdoor from being discovered. Besides being gradually implemented in stages, it also narrowly targeted only the Copay wallet app. The malicious code was also hard to spot because the flatmap-stream module was encrypted. The attack is the latest to exploit weaknesses in a widely used supply chain to target downstream end users... The supply-chain attacks show one of the weaknesses of open source code. Because of its openness and the lack of funds of many of its hobbyist developers and users, open source code can be subject to malicious modifications that often escape notice.
"The time has come," concludes Ars Technica, "for maintainers and users of open source software to devise new measures to better police the millions of packages being used all around us." Sophos' security blog also asks why so many developers "immediately and blindly trusted the new maintainer," and shared a concerned comment from developer named Chris Northwood.
"Nothing's stopping this happening again, and it's terrifying."
An anonymous reader quotes Ars Technica: The backdoor came to light [November 20th] with this report from Github user Ayrton Sparling. Officials with the NPM, the open source project manager that hosted event-stream, didn't issue an advisory until six days later.... "This compromise was not targeting module developers in general or really even developers," an NPM official told Ars in an email. "It targeted a select few developers at a company, Copay, that had a very specific development environment set up. Even then, the payload itself didn't run on those developers' computers; rather, it would be packaged into a consumer-facing app when the developers built a release. The goal was to steal Bitcoin from this application's end users...."
According to the Github discussion that exposed the backdoor, the longtime event-stream developer no longer had time to provide updates. So several months ago, he accepted the help of an unknown developer. The new developer took care to keep the backdoor from being discovered. Besides being gradually implemented in stages, it also narrowly targeted only the Copay wallet app. The malicious code was also hard to spot because the flatmap-stream module was encrypted. The attack is the latest to exploit weaknesses in a widely used supply chain to target downstream end users... The supply-chain attacks show one of the weaknesses of open source code. Because of its openness and the lack of funds of many of its hobbyist developers and users, open source code can be subject to malicious modifications that often escape notice.
"The time has come," concludes Ars Technica, "for maintainers and users of open source software to devise new measures to better police the millions of packages being used all around us." Sophos' security blog also asks why so many developers "immediately and blindly trusted the new maintainer," and shared a concerned comment from developer named Chris Northwood.
"Nothing's stopping this happening again, and it's terrifying."
Many eyes mean nothing if they aren't looking.
Good thing they used a safe language like Javascript so exploits can't happen.
"First they came for the slanderers and i said nothing."
There's your problem.
If you're that much of a blackeyer, there's nothing in the world that can protect you. You might as well become a pro-NSA Alex Jones, and go around calling everyone a "conspiracy theorist", who ever dares thinking and isn't currently dead asleep.
Just because an open source program seems to be developed with security in mind doesn't mean that the other thousand open source packages that it relies on aren't full of security holes. Especially since nobody is looking anymore at a lot of these packages.
The supply-chain attacks show one of the weaknesses of open source code. Because of its openness and the lack of funds of many of its hobbyist developers and users, open source code can be subject to malicious modifications that often escape notice.
Every time I read something like this I have to imagine it was written by someone who works for or owns stock in one of those companies that produces "compliance" tools/services targeted at businesses that use open source.
I mean, come on. This exact same problem exists for closed source software. Face it, you know about as much about the developers of any random closed source application or library as you do about any random open source application or library. In fact, it is less likely that a malicious change will be discovered if you do not have access to the source code.
A sure sign that development is being taken over by normies and retards
Thank god WebAssembly is rapidly advancing with the fever of someone trapped in an elevator with fat guy who ate nothing but beans for lunch and the entire clusterfuck that is Javascript/Node is about to be dumped on the garbage heap of dead tech.
Unfortunately I think that developers of nonfree software are doing QA on their code, but blindly trusting & using OSS libraries assuming that because the source is out there, it's good quality. As we have proven time and again, this is a bad (and dangerous) assumption to make.
This problem is far more prevalent in certain language communities, most notably JavaScript (but there are others). Communities where, to put it bluntly, most developers don't understand or care how their stack works, they just toss another dependency on the giant pile and fetch the newest version from github every time they build and deploy. Communities where it's considered normal to install something by piping a wget into a root shell. Without even pausing to think, they automatically cargo-cult the first monkeyman who touched the monolith and wrote a library.
Here's a pro tip, kids: don't add dependencies you don't need (and you probably don't). But if you have to, import them into your local source tree so that you have a predictable, reliable build that's also resilient against github going down. Unless you just enjoy being fucked unpredictably by a thousand possible events outside your control.
> If you said that 10 years ago, people would've looked you like you just said that the president ... bad example.
My god are you lame.
I mean really shouldn't we have been expecting this and continue to expect this kind of thing to happen every so often just due to the illusionary nature of security it self. Security is a motivation game if you can be motivate someone to continue trying different methods before they find one that works they may choose to move on. Anybody who doesn't quit will eventually bypass any security.
This is what happens when you drop your standards to let the gay and the trans and the negro and the woman contribute because equality....
This is what happens when you BLINDLY use another persons code without looking at it once.
If you yourself cannot understand the code of others, don't fucking use it, it will bite you in the ass.
If it has barely any contributors, or even one, trust it even less so!
I don't care who the person claims to be, or if they were even a deity in human form, their code ain't going on any of my systems, no way.
And if any sudden changes just came out of the blue for no reason other than chaaaaange, it can go to 10 kinds of hell for all I care because most of the time it is ads, exploits or usually incompatible with everything before it. (this has happened from Chrome to [insert any app ever] to even LInux!)
This is why the whole systemd branch of Linux can suck a fat one. Fuck Harry Poettering and his shitware.
Dude doesn't even understand basic Linux foundations and standards. (see that time his shit software ignored rm flags)
I don't know why anyone listens to him when he has proven his shoddy code is broken at the rotten core. Either they are being paid off or sucked off.
I look forward to the next shitfest that wreck of a suite causes. Calling it for January.
The dare devil driver jumps in the car, rips the mirror out, and screams "I don't need it! What's behind me is of no concern!"
Move Fast! Break Things! Disrupt!!!
gack
what could possibly go wrong? The ridiculously oversized dependency-trees of node.js software, along with the lack of any decent web-of-trust structure backed by cryptographic signatures, makes this a "will happen again and again" event.
Before irresponsible "programmers" started to include even 5-lines-of-code snippets from unknown authors from the Internet, it was common sense to only depend on sizeable libraries of significant complexity, and only a few of them.
With the insane fragmentation of node.js code, there is no chance anyone can reasonably rule out that parts of that code come from an adversary.
the crypto will not save you, j:st makes it harder. all code, source or compiled, is subject to a well-executed, long-play code injection attack. Look at all the unintended zero-days that get discovered all the time.
What does this mean?
I am shocked - SHOCKED - that there is gambling going on in this establishment!
... how totally sneaky those "hacker" bogeymen of the cyberwebs with their cyber "hacks" and their "hacking" the cyber are!
Obviously, as soon as you invoke "hack", "hacked", "hackers", it cannot possibly be your fault no matter what actually happened. Or maybe you're just an idiot, just like EditorDavid.
It's not a language problem - it's an economic problem. There's no money in being an open source developer. I suspect more than 50% of packages on NPM are de facto abandoned.
The old model for FOSS development went like this: write some Free Software that many people use. Build up you cred as a developer. Land sweet consulting gigs and collect big bucks.
But that model has failed. Companies (for the most part) don't care what software you wrote. All they care about is price. So now a developer can waste a bunch of time writing a cool, widely used package - but the high dollar consulting gigs just don't materialize.
Instead companies will hire cheap code monkeys to glue together open source components. And the dev who actually wrote the FOSS gets zero dollars for his efforts. So he stops working on it.
That's where we are now. The FOSS model has produced massive gains in productivity. But all that value has accrued to leeches. While the FOSS developers got nothing; and by raising the productivity of lower skilled devs, in fact helped drive down their own pay.
Unless we can figure out a viable economic model for Free-like-speech software, I see an implosion coming. As more and more projects are abandoned, the whole edifice built atop them becomes shaky and eventually collapses.
The Death Star has blown up a planet! Not at all the sign of a dying weapons platform.
Possibly Tidelift?
Whether Tidelift will "fly" (cringing at metaphor mixing), I have no idea....
"The malicious code was also hard to spot because the flatmap-stream module was encrypted."
Seems like a problem here is the code was not in fact by any rational definition, "open".
Yeah, because Cisco has never ever been victim to a supply chain attack. (Hint: more than half of Cisco's physical products are manufactured in China.) *cough* CVE-2012-5445 *cough*
WTF does the language have to do with it?