Malicious PyPI packages stealing credit cards and injecting code

Re:Malicious PyPI packages stealing credit cards and injecti... by yjftsjthsd-h on Tuesday August 03, 2021 @11:24AM (#28050293)

Sorry, I don't quite see how this would protect against supply chain attacks. If an upstream dependency is back-doored, they just have to silently add their code in an otherwise reasonable sounding release, and now you will happily download that version, add it to your internal mirrors, and pin its version forever. Unless you actually read the diff on every update, which I think is impractical (although you're welcome to correct me), I don't see how this is buying you much.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by ozzythecat on Tuesday August 03, 2021 @11:36AM (#28050463)

It’s not 100% bullet proof, but it’s safer than pulling any random repos directly from the internet.

It’s also good that your business doesn’t have to rely on a third party every time you need to pull down your dependencies and build your software.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by DSingularity on Tuesday August 03, 2021 @12:04PM (#28050848)

Protects you against a dependency being hijacked and retroactively embedding malware in prior versions . Check summing would protect against that without the trouble of manually hosting the dependency.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by cortesoft on Tuesday August 03, 2021 @01:08PM (#28051620)

I think part of the idea is that if you only use versions that have been released for a little while, you are hoping SOMEONE notices the malicious code before you finally update.

There are a number of issues with this approach, although the practice still might be a net benefit.

One, you are going to be behind on security patches. You have to figure out, are you more at risk from running unpatched code for longer, or from someone compromising an upstream package?

Two, if too many people use this approach, there won't be anyone who is actually looking at the code. Everyone assumes someone else would have looked, so no one looks.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by polynomial on Tuesday August 03, 2021 @12:22PM (#28051054)

My read was GP is implying they do read the diff every time, and only change the pinned version after a manual review- "only after we are happy."

This does seem impractical at even a modest scale.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by zerkten on Tuesday August 03, 2021 @12:53PM (#28051434)

What does "modest scale" mean? Some people have to have all dependency updates reviewed and have some level of independent security team monitoring dependency changes. Not everyone has this, but the context is key as some domains have this consistently.

Some of this is cultural in addition to being paranoid about security, or having strict compliance requirements. For your average startup, they may not have any time to dedicate to this and other fires, but that's not a universal situation.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by staticassertion on Tuesday August 03, 2021 @01:12PM (#28051667)

> What does "modest scale" mean? Some people have to have all dependency updates reviewed and have some level of independent security team monitoring dependency changes.

Who? Seems totally intractable to me.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by yardstick on Tuesday August 03, 2021 @03:44PM (#28053254)

We periodically review all dependencies change logs, security advisories etc and update based on risk review. We also keep an eye out for critical vulnerabilities that need immediate patching. There are tools to help with this, plus communities like HN are relevant for breaking news.

[ Parent | on HN ]