Codecov breach impacts GoDaddy, Atlassian, P&G etc.

Re:Codecov breach impacts GoDaddy, Atlassian, P&G etc. by goatinaboat on Sunday April 18, 2021 @11:06AM (#26853098)

is fundamentally not really different than downloading and running a setup.exe a foo.dmg or a foo.deb, running npm/pip/gem/bundle install, or ./configure && make && sudo make install.

Well, it is, because any .EXE or .MSI or .DMG I download will pass through one or more virus scanners. You can also do this by forcing users through a proxy such as Artifactory that can also do scanning of Linux packages. But it's futile to rely on automated solutions for NPM or PyPI where there is no curation of the repo so anyone can do typosquatting.

[ Parent | on HN ]

Re:Codecov breach impacts GoDaddy, Atlassian, P&G etc. by lloeki on Tuesday April 20, 2021 @12:04PM (#26876509)

A virus scanner doesn't help about supply chain attacks, where malicious code is often bespoke and looks entirely like original code except for actual humans auditing the code/binary.

[ Parent | on HN ]

Re:Codecov breach impacts GoDaddy, Atlassian, P&G etc. by goatinaboat on Wednesday April 21, 2021 @02:22AM (#26886013)

It does when the malicious file is discovered and its signature added to the database. Even if it was allowed to run before, subsequent runs can be blocked and the sysadmin notified.

[ Parent | on HN ]