News for hackers. Stuff that matters.

A comment on Dozens of malicious PyPI packages discovered targeting developers. Parent comment

Re:Dozens of malicious PyPI packages discovered targeting de... by kibwen on Wednesday November 02, 2022 @02:31PM (#33440730)
This is a good approach, though presumably the VM still has access to your Github credentials (via the browser) and your SSH keys? It'll limit the fallout of getting owned to anything reachable from Github (is it against Github's TOS to have multiple accounts?), less if you have 2FA (does there exist 2FA for SSH keys (I don't mean passphrases)?), but I think it would be better for just my build/run/test cycles to be cordoned off into their own universe, with a way for just the source code itself to cross the boundary.
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by namaria on Wednesday November 02, 2022 @02:51PM (#33441059)
It might be too cumbersome for most, and I might be more paranoid than average, but each project for me means a fresh VM, a new Keepass database and dedicated accounts. Then again I work mostly in ops, and I've seen first hand how badly things can go wrong so isolation and limiting blast radius takes precedence over daily convenience for me.
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by bt1a on Wednesday November 02, 2022 @03:23PM (#33441554)
Could you please share some resources/tactics for protecting your host machine from these development VMs? If I were to do this, I would want some assurances (never 100%) that my host is protected from the VM to the best of my ability.

(If it makes any difference, I would probably be using VMWare Workstation Pro)

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by namaria on Wednesday November 02, 2022 @06:52PM (#33443973)
I can't give you what you're looking for. You need to decide on the trade offs for yourself. There will always be a risk. Directed attacks can get out of VMs. You could slip up and log into a personal account inside the VM.
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by bt1a on Wednesday November 02, 2022 @09:53PM (#33445796)
I tried to make it clear in my reply that I understood there are no guarantees. What I’m asking is if you have any guidance on reducing the likelihood of these attacks succeeding
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by 0cf8612b2e1e on Wednesday November 02, 2022 @04:44PM (#33442668)
That does sound incredibly cumbersome. I suppose that means you are an ace at provisioning machines.

How do you move data in/out of the guests? I always found that part of interacting with VMs to be annoyingly painful.

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by namaria on Wednesday November 02, 2022 @06:54PM (#33444001)
There are always trade offs. You do get better at things you do a lot. My mother won't use a password vault because copying and pasting is too much work for her. I'd just rather pay with my time and inconvenience than one day find out some python package I fiddled with for a late night project once means I need to call my bank.
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by fbhabbed on Wednesday November 02, 2022 @07:05PM (#33444096)
SSH.

Doesn't even need to be command line, you can just open remote addresses in your favourite graphical file browser, at least under Linux.

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by fsflover on Thursday November 03, 2022 @04:49AM (#33448520)
Why wouldn't you use disposable VMs [0] and secure inter-VM copy [1] on Qubes OS instead? It's much less cumbersome and more secure.

[0] https://www.qubes-os.org/doc/how-to-use-disposables/

[1] https://www.qubes-os.org/doc/how-to-copy-and-move-files/

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by AlexAndScripts on Friday November 04, 2022 @03:44PM (#33472687)
That sounds like precisely QubeOS's use case.
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by fsflover on Wednesday November 02, 2022 @04:30PM (#33442528)
> though presumably the VM still has access to your Github credentials (via the browser) and your SSH keys?

Not in Qubes OS:

https://github.com/Qubes-Community/Contents/blob/master/docs...

https://www.qubes-os.org/doc/split-gpg/

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by jve on Wednesday November 02, 2022 @06:29PM (#33443779)
> does there exist 2FA for SSH keys (I don't mean passphrases

Yes. Yubikey. ecdsa-sk key requires you to tap yubikey to have a working key. It consists of 2 parts - a private key file, but which is useless without yubikey. https://developers.yubico.com/SSH/

https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by jve on Wednesday November 02, 2022 @06:32PM (#33443802)
Github offers fine grained personal access tokens. https://docs.github.com/en/authentication/keeping-your-accou...

Azure DevOps does it too

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by Riverheart on Friday November 04, 2022 @08:29AM (#33465478)
Far as I know, in AzDO you can't even limit a PAT to a single project/repository. Not good for limiting access cause even a read only can see private stuff in other projects. You might create a specific account and assign to only that project but what a pain.
[ Parent | on HN ]