Guarding the JavaScript Supply Chain: Preventing NPM Attacks with Feross Aboukhadijeh - JSJ 695

WEBVTT
1
00:00:05.440 --> 00:00:08.919
Hello everybody, Welcome to another thrilling episode of JavaScript Jabber.
2
00:00:08.919 --> 00:00:10.960
I am Steve Edwards, the host with the face for
3
00:00:11.039 --> 00:00:13.039
radio and the voice for being a mine. But I'm
4
00:00:13.039 --> 00:00:16.160
still your host, and sirih thinks I'm talking to her
5
00:00:16.160 --> 00:00:19.440
for some reason. With me today we have a special
6
00:00:20.000 --> 00:00:22.760
returning Yes, mister Farross, a book a DJ.
7
00:00:22.839 --> 00:00:23.960
How you doing, Fross?
8
00:00:24.239 --> 00:00:26.199
I'm doing good. Thanks for having me here.
9
00:00:26.960 --> 00:00:30.559
Yes, for those of you that wonder how to say
10
00:00:30.559 --> 00:00:32.840
his name, it's think about like booking a DJ for
11
00:00:32.960 --> 00:00:34.840
a show or something like that.
12
00:00:34.840 --> 00:00:36.560
That's what he told me, and it still works for me.
13
00:00:36.840 --> 00:00:40.439
I'm impressed you remember that, Steve, because yes, it is
14
00:00:40.439 --> 00:00:41.560
pretty memorable ized pose.
15
00:00:42.039 --> 00:00:45.679
Yes, yes, so Fross.
16
00:00:45.960 --> 00:00:49.359
Before we get into our lovely dark world of internet
17
00:00:49.399 --> 00:00:51.960
hacks and people trying to steal cryptocurrency, why don't you
18
00:00:51.960 --> 00:00:54.200
give us a little background on who you are and
19
00:00:54.240 --> 00:00:57.159
why you're famous, and your company and what it does
20
00:00:57.200 --> 00:00:58.240
and all that good stuff.
21
00:00:58.679 --> 00:00:58.880
Cool.
22
00:00:58.920 --> 00:01:00.880
Yeah, I wouldn't say I'm famous, but I'm happy to
23
00:01:00.920 --> 00:01:02.280
give you a background on.
24
00:01:02.399 --> 00:01:03.000
What I would.
25
00:01:03.240 --> 00:01:06.040
But that what I've done today. Yeah.
26
00:01:06.079 --> 00:01:10.079
So I started off kind of writing open source software.
27
00:01:10.079 --> 00:01:11.239
That was kind of what I did for most of
28
00:01:11.280 --> 00:01:14.599
my career. I found the early no JS community to
29
00:01:14.680 --> 00:01:17.879
be like a really welcoming and awesome place. Kind of
30
00:01:19.239 --> 00:01:22.519
found my way to the early node con conferences in
31
00:01:22.640 --> 00:01:25.959
the one in in San Francisco that Michael Rodgers organized,
32
00:01:26.439 --> 00:01:31.079
as well as the note Confee you and kind of
33
00:01:32.000 --> 00:01:35.480
just got really addicted to publishing NPM packages. Published a
34
00:01:35.480 --> 00:01:38.640
bunch of those over the years, some projects like webparrent.
35
00:01:38.280 --> 00:01:39.480
And standard js.
36
00:01:40.120 --> 00:01:43.239
Uh and uh, yeah, I just learned a lot about
37
00:01:43.280 --> 00:01:46.200
the you know, the supply chain, the way that open
38
00:01:46.200 --> 00:01:51.120
source software is used by companies, the way that you know,
39
00:01:51.159 --> 00:01:54.239
open source development happens, and and I got really addicted
40
00:01:54.239 --> 00:01:55.120
to it and it was really fun.
41
00:01:55.159 --> 00:01:56.159
It's an amazing community.
42
00:01:56.799 --> 00:02:01.840
Uh And ultimately that kind of to me starting Socket
43
00:02:01.879 --> 00:02:04.879
in twenty twenty, after seeing a ton of attacks happening
44
00:02:05.200 --> 00:02:09.520
against JavaScript packages, I got kind of obsessed with like
45
00:02:09.560 --> 00:02:10.520
trying to fix the problem.
46
00:02:10.759 --> 00:02:13.960
I was like, why why do we accept that.
47
00:02:14.080 --> 00:02:16.879
Packages are just going to keep getting compromised and every
48
00:02:16.919 --> 00:02:18.560
time that happens, we're just going to have to hope
49
00:02:18.560 --> 00:02:21.000
that we were lucky and not affected by that in
50
00:02:21.039 --> 00:02:23.840
some way or another, Like, can't we actually be proactive
51
00:02:23.840 --> 00:02:24.199
about this?
52
00:02:24.439 --> 00:02:28.240
Scan for this prevent this, and so I.
53
00:02:28.159 --> 00:02:30.000
Started a company Socket to do that, and now we're like,
54
00:02:30.840 --> 00:02:33.039
it's a big company now, I mean we're like seventy
55
00:02:33.120 --> 00:02:36.560
five people. We have a ton of big customers, a
56
00:02:36.560 --> 00:02:39.159
lot of companies you probably recognize, and just trying to
57
00:02:39.159 --> 00:02:40.639
help people use open source safely.
58
00:02:42.199 --> 00:02:44.360
So just to clarify for us and I were talking
59
00:02:44.400 --> 00:02:47.080
about this ahead of time, his website is socket dot dev,
60
00:02:47.199 --> 00:02:51.080
not socket dot io, if you make that mistake. Socket
61
00:02:51.120 --> 00:02:54.639
io is Girmo Rouscher's old library for doing web sockets.
62
00:02:55.280 --> 00:02:59.919
Socket dot dev is Frost's entity that helps keep supply
63
00:03:00.280 --> 00:03:07.000
chain stuff safe. So for us, that's quite the list
64
00:03:07.039 --> 00:03:11.879
of recent compromises and attempts to compromise the NPM supply chain.
65
00:03:12.960 --> 00:03:13.840
I know that.
66
00:03:15.240 --> 00:03:16.919
The most recent one that comes to my mind that
67
00:03:16.960 --> 00:03:18.960
we got hit with was the one, and we'll get
68
00:03:18.960 --> 00:03:23.120
to this, the Chalk Library and all those libraries by
69
00:03:23.120 --> 00:03:26.400
that same author that got compromised with a crypto trying
70
00:03:26.439 --> 00:03:29.759
to steal cryptocurrency stuff. And fortunately for us, we weren't
71
00:03:29.840 --> 00:03:35.000
using those libraries, so we were okay. But apparently that's just
72
00:03:35.080 --> 00:03:38.960
one in a string of recent compromise attempts.
73
00:03:39.000 --> 00:03:40.319
So with further Ado.
74
00:03:40.439 --> 00:03:43.000
I'll let Frost take over and talk about what's been
75
00:03:43.039 --> 00:03:43.800
going on lately.
76
00:03:44.719 --> 00:03:45.000
Yeah.
77
00:03:45.039 --> 00:03:47.120
Sure, So we've seen a bunch of attacks over the
78
00:03:47.199 --> 00:03:49.400
last couple of months. I'll try to give you like
79
00:03:49.439 --> 00:03:51.560
a high level summary and then we can dig into
80
00:03:51.599 --> 00:03:54.639
the the different details if that's interesting to you.
81
00:03:56.319 --> 00:03:56.520
Yeah.
82
00:03:56.520 --> 00:03:59.719
So we saw a phishing campaign that started about two
83
00:03:59.759 --> 00:04:03.280
months to go back in July where a lot of
84
00:04:04.240 --> 00:04:06.960
kind of popular MPM maintainers got this phishing email that
85
00:04:07.159 --> 00:04:10.680
was impersonating npm and asking them to like add to
86
00:04:10.840 --> 00:04:13.879
FA to their account. And it turns out that that
87
00:04:13.960 --> 00:04:16.759
email was actually sent from well, it appeared to be
88
00:04:16.800 --> 00:04:19.639
sent from support at npmjs dot org, which is like
89
00:04:19.920 --> 00:04:23.879
a real email that npm uses, but actually it wasn't
90
00:04:23.879 --> 00:04:24.439
sent from there.
91
00:04:24.480 --> 00:04:25.360
It was just spoofed.
92
00:04:26.240 --> 00:04:32.399
And unfortunately the npm js dot org domain didn't have
93
00:04:32.439 --> 00:04:34.720
the proper like email headers set up d mark and
94
00:04:34.839 --> 00:04:38.600
SPF headers that would would have helped different email clients
95
00:04:38.639 --> 00:04:42.199
to know that that that email, you know, wasn't legit
96
00:04:42.439 --> 00:04:45.680
from from npmjs dot org. Turns out like they send
97
00:04:45.680 --> 00:04:49.160
email from npmjs dot com, uh, and that had the
98
00:04:49.199 --> 00:04:52.399
headers set up, but npmjs dot org is a real
99
00:04:52.439 --> 00:04:56.399
domain that NPM uses, so it was still quite convincing
100
00:04:56.439 --> 00:04:59.720
to get an email from that for people. So Lesson
101
00:04:59.800 --> 00:05:01.160
learned there is like you need to set up these
102
00:05:01.160 --> 00:05:04.680
email headers in these email these DNS records that help
103
00:05:05.199 --> 00:05:09.480
you know, block spoofed emails even on domains that you're
104
00:05:09.480 --> 00:05:11.399
not sending email from. As long as they're like a
105
00:05:11.399 --> 00:05:14.199
domain that your users recognize that you use, you know,
106
00:05:14.199 --> 00:05:14.639
you got.
107
00:05:14.519 --> 00:05:17.519
To protect them with those same with those same GNS records.
108
00:05:18.600 --> 00:05:20.720
So what happened is if people clicked on the link
109
00:05:20.800 --> 00:05:23.519
in the email, it would take you to a website
110
00:05:23.560 --> 00:05:26.959
that looked exactly like NPM, but it was a proxy,
111
00:05:27.120 --> 00:05:29.319
so it sort of anything you clicked on would work,
112
00:05:29.360 --> 00:05:31.199
and it would let you navigate through the whole site
113
00:05:31.560 --> 00:05:34.399
just like you were on the real site, but the
114
00:05:34.480 --> 00:05:36.879
domain was off by a letter, so it wasn't the
115
00:05:36.879 --> 00:05:39.199
real site. And then of course if you logged in
116
00:05:39.199 --> 00:05:41.720
it would it would steal your credentials. So that that
117
00:05:41.800 --> 00:05:44.879
was something that was going around back in July, and
118
00:05:46.399 --> 00:05:49.439
we kind of noticed it over at Socket because some
119
00:05:49.600 --> 00:05:51.040
of the folks on our team got this got this
120
00:05:51.079 --> 00:05:53.240
fishing email, and we were like, oh, this is interesting,
121
00:05:53.360 --> 00:05:55.839
So we wrote about it, tried to warn people about it,
122
00:05:56.600 --> 00:05:59.319
but nonetheless, a couple of days later there was kind
123
00:05:59.319 --> 00:06:02.240
of the first prolific maintainers that were starting to get
124
00:06:02.240 --> 00:06:06.120
affected by this, and that started with a Prettier project.
125
00:06:06.160 --> 00:06:08.720
So the Prettier package, a.
126
00:06:08.680 --> 00:06:11.879
Couple of Prettier packages were compromised, including yes lint can
127
00:06:11.879 --> 00:06:16.360
fike Prettier, which is the reusable yes link configuration that
128
00:06:16.480 --> 00:06:20.040
kind of has the the rules for es lint in
129
00:06:20.120 --> 00:06:24.319
it that you can kind of apply to to to
130
00:06:24.480 --> 00:06:27.360
yes lint, and so that was compromised with a with
131
00:06:27.000 --> 00:06:31.600
a like a Windows specific DLL file. So for those
132
00:06:31.639 --> 00:06:33.560
who don't know, that's basically just like a kind of
133
00:06:33.560 --> 00:06:36.800
a compiled code file that that you know, you can
134
00:06:36.879 --> 00:06:40.519
run on Windows machines, and that when that ran, it
135
00:06:40.519 --> 00:06:44.079
would it would steal a bunch of system system information
136
00:06:44.279 --> 00:06:48.360
like your environment variables. Uh, and then it would open
137
00:06:48.360 --> 00:06:51.360
a web socket, speaking of web sockets, uh, It would
138
00:06:51.360 --> 00:06:55.240
open a web socket to the attacker and it would
139
00:06:55.319 --> 00:06:59.519
leave that connection open. And so then the attacker could
140
00:06:59.560 --> 00:07:02.160
have base to be like an interactive shell, so they
141
00:07:02.199 --> 00:07:05.120
would any text that they sent over that web socket
142
00:07:05.360 --> 00:07:08.480
would be received on your your computer, your machine, or
143
00:07:08.519 --> 00:07:11.279
your server and it would get run like in a shell,
144
00:07:11.639 --> 00:07:13.680
and then the output would get sent back to the attacker.
145
00:07:13.959 --> 00:07:16.199
So it's like they were almost acessation into your system,
146
00:07:16.319 --> 00:07:19.160
but using a web socket to kind of run commands
147
00:07:19.160 --> 00:07:24.000
on your computer or on your server. That's bad, right, Yeah,
148
00:07:23.279 --> 00:07:28.480
it goes out saying that's bad. Yeah, yeah, they so,
149
00:07:28.480 --> 00:07:32.000
so I think, you know it was it was cross
150
00:07:32.040 --> 00:07:33.800
platform in that way, so there was the Windows piece
151
00:07:33.879 --> 00:07:35.399
that the doll file, but then it was also like
152
00:07:35.639 --> 00:07:38.199
it would also affect you on Mac and Linux because of.
153
00:07:38.160 --> 00:07:40.639
The web socket, and yeah, not good.
154
00:07:42.000 --> 00:07:44.240
They also kind of tried to hide their tracks through
155
00:07:44.360 --> 00:07:47.879
through different like anti analysis techniques, so they would encrypt
156
00:07:47.920 --> 00:07:51.240
the data going across the web socket, so if you
157
00:07:51.240 --> 00:07:54.240
were like looking at the text, you wouldn't see, like,
158
00:07:54.560 --> 00:07:55.519
you know, what was going.
159
00:07:55.360 --> 00:07:57.480
Across that that socket.
160
00:07:59.079 --> 00:08:00.879
So that was kind of the first first sort of
161
00:08:00.920 --> 00:08:03.279
effect of this fishing campaign was it actually hit you know,
162
00:08:03.560 --> 00:08:08.279
this popular library. Then it was kind of all quiet
163
00:08:08.360 --> 00:08:10.839
for a little while for about a month there until
164
00:08:10.879 --> 00:08:17.680
August when the popular NX build system was had one
165
00:08:17.680 --> 00:08:22.800
of their packages compromised. And this this attack was interesting
166
00:08:22.800 --> 00:08:25.800
for a couple of reasons. I'd say the first reason. Well,
167
00:08:25.839 --> 00:08:27.519
for first of all, it just it was similar and
168
00:08:27.519 --> 00:08:29.560
that it still just tried to steal credentials. So it
169
00:08:29.600 --> 00:08:32.080
would like search your system for you know, s s
170
00:08:32.240 --> 00:08:35.960
H keys, NPM tokens, basically any file that you might
171
00:08:35.960 --> 00:08:37.960
have on your system that contains like a key or
172
00:08:37.960 --> 00:08:39.559
a token in it. It was it would just hunt
173
00:08:39.559 --> 00:08:41.600
through the file system looking for that and send it
174
00:08:41.639 --> 00:08:43.840
off to the attacker. But what was interesting about how
175
00:08:43.879 --> 00:08:46.080
they did it was it didn't just use like it
176
00:08:46.480 --> 00:08:50.240
you know, just code to do that. It instead abused
177
00:08:50.279 --> 00:08:53.440
AI tools like Claude and Gemini to scan your file
178
00:08:53.480 --> 00:08:56.240
system for sensitive data, which is a technique that we
179
00:08:56.279 --> 00:08:59.600
had never seen before. So this means that it would
180
00:08:59.639 --> 00:09:03.519
look for or uh Claude or Gemini installed on your
181
00:09:03.519 --> 00:09:05.919
system like this the cli tool that lets you interface
182
00:09:05.960 --> 00:09:08.720
with these AI agents and these AI tools, and it
183
00:09:08.720 --> 00:09:13.120
would use them to with a prompt asking the agent
184
00:09:13.200 --> 00:09:16.519
to go and like search your file system for interesting files,
185
00:09:16.759 --> 00:09:18.440
and then it listed out a whole bunch of file
186
00:09:18.480 --> 00:09:21.600
extensions in the prompt like dot t x T, dot log,
187
00:09:21.720 --> 00:09:25.519
dot n you know, uh, dot back, you know, just
188
00:09:25.519 --> 00:09:28.799
different different kind of interesting extensions that could have keys
189
00:09:28.879 --> 00:09:31.519
or data in it. That might be interesting to the attacker,
190
00:09:32.000 --> 00:09:33.759
and then the agent would go and find all those
191
00:09:33.759 --> 00:09:36.679
files and then collect them in one in one place
192
00:09:37.000 --> 00:09:39.519
that could then be sent off to the attacker. So
193
00:09:39.639 --> 00:09:41.480
I'd never seen like an LM being used in this
194
00:09:41.559 --> 00:09:44.440
way kind of kind of you know, as a like
195
00:09:44.600 --> 00:09:46.840
like effectively that the payload of the attack is not
196
00:09:47.279 --> 00:09:49.600
like some malicious code, it's actually just a couple of
197
00:09:49.639 --> 00:09:53.279
sentences in English. So that was that really blew my
198
00:09:53.320 --> 00:09:54.399
mind when when I saw that.
199
00:09:57.200 --> 00:09:59.919
So why is that effective? Then you find it wor
200
00:10:00.080 --> 00:10:01.720
inner or just that that was the attempt.
201
00:10:02.279 --> 00:10:03.399
Oh no, it was effective. Yeah.
202
00:10:03.399 --> 00:10:04.480
I mean if you had if you had to have
203
00:10:04.559 --> 00:10:06.279
claud or Gemini on your system for it to work,
204
00:10:06.320 --> 00:10:08.279
if you didn't, it wouldn't do anything. So that was
205
00:10:08.639 --> 00:10:10.320
that was kind of the funny part was that it
206
00:10:10.399 --> 00:10:12.559
wasn't you know, it wouldn't affect you if you didn't
207
00:10:12.600 --> 00:10:13.960
have those CLI tools installed.
208
00:10:14.279 --> 00:10:16.120
So they kind of limited their reach a little bit.
209
00:10:16.200 --> 00:10:19.720
But I suspect they did it because it it was
210
00:10:19.720 --> 00:10:22.159
an attempt to get past code scanning tools that look
211
00:10:22.240 --> 00:10:25.679
for you know, suspicious code and if you know, if
212
00:10:25.679 --> 00:10:27.240
it's just a string, then a lot of those scanners
213
00:10:27.200 --> 00:10:28.480
will skip it, skip it.
214
00:10:29.519 --> 00:10:29.759
That's it.
215
00:10:29.919 --> 00:10:33.960
Socket socket wasn't wasn't tricked by this because we use ourselves.
216
00:10:34.039 --> 00:10:35.799
We use l ll ms to look at the code,
217
00:10:36.000 --> 00:10:37.960
which is a newer technique.
218
00:10:38.039 --> 00:10:38.159
Right.
219
00:10:38.159 --> 00:10:40.240
A lot of the sort of other security tools do
220
00:10:40.360 --> 00:10:43.080
static analysis on the code alone. But if you actually
221
00:10:43.159 --> 00:10:46.039
use an l M to look at the code, an
222
00:10:46.120 --> 00:10:48.440
l N isn't going to be tricked by a sentence.
223
00:10:48.639 --> 00:10:50.440
You know, you can ask the l M like what
224
00:10:50.559 --> 00:10:52.200
is this code doing, and it'll look at the prompt
225
00:10:52.200 --> 00:10:53.679
and it will tell you. So this, you know, with
226
00:10:53.679 --> 00:10:57.639
with the right prompting that actually it's possible for like defenders,
227
00:10:57.720 --> 00:10:59.679
for the good guys to also you know, use these
228
00:10:59.679 --> 00:11:02.879
AI tools to catch the bad guys.
229
00:11:02.720 --> 00:11:03.480
Using a tools.
230
00:11:03.519 --> 00:11:05.360
So it's it's it is a cat and mouse game
231
00:11:05.600 --> 00:11:09.159
some extent. But but I think you know, it didn't
232
00:11:09.200 --> 00:11:11.039
get past us. But but I would say it was.
233
00:11:11.080 --> 00:11:13.159
It was effective in that that if you actually ran
234
00:11:13.200 --> 00:11:19.840
the code, it worked as it was intended to. Okay, yeah,
235
00:11:19.879 --> 00:11:21.759
so that's uh, that's we're still not to the chalk
236
00:11:21.799 --> 00:11:23.720
attack yet. But but I wanted to say one other
237
00:11:23.720 --> 00:11:26.080
thing about this one. So NX, I don't know if
238
00:11:26.080 --> 00:11:28.240
you're familiar with. It's this build system, so it's it's
239
00:11:28.320 --> 00:11:30.279
kind of an open source it's an open source project.
240
00:11:30.360 --> 00:11:32.759
They have a GitHub repo that folks can contribute to.
241
00:11:33.759 --> 00:11:35.759
It's just a kind of a standard you know, NPM
242
00:11:35.840 --> 00:11:38.720
open source project like people are familiar with, and so
243
00:11:38.759 --> 00:11:40.559
they accept pull requests from the community.
244
00:11:41.039 --> 00:11:45.200
And one thing that was interesting about the uh.
245
00:11:44.320 --> 00:11:46.200
The way that this attack happened was it didn't use
246
00:11:46.240 --> 00:11:48.279
the phishing email, so that's not how they got the
247
00:11:48.320 --> 00:11:51.559
attack or got access. They used a different method, and
248
00:11:51.600 --> 00:11:53.039
so I wanted to talk through that because I think
249
00:11:53.120 --> 00:11:57.519
that the method was quite quite impressive. So they they
250
00:11:57.600 --> 00:12:01.159
used a get of action workflow that the an X
251
00:12:01.240 --> 00:12:04.600
project had, you know, added to their EPO, and it
252
00:12:04.679 --> 00:12:07.039
had some vulnerabilities in it that the attacker was able
253
00:12:07.080 --> 00:12:07.480
to use.
254
00:12:07.960 --> 00:12:09.720
And so I want to walk through that because I
255
00:12:09.720 --> 00:12:10.000
want to.
256
00:12:09.960 --> 00:12:12.639
Make sure people are aware that get up actions are,
257
00:12:13.360 --> 00:12:15.440
like they're very powerful, they're very useful. I use them
258
00:12:15.440 --> 00:12:18.440
all the time, but they're also very dangerous if you
259
00:12:18.440 --> 00:12:21.679
don't use them correctly. And there's a lot of foot guns,
260
00:12:21.720 --> 00:12:23.960
like just ways that you can just think you're doing
261
00:12:23.960 --> 00:12:27.120
something very innocent, very very very you know that looks
262
00:12:27.159 --> 00:12:30.679
doesn't look dangerous, but it's actually like a like a trick,
263
00:12:30.720 --> 00:12:32.840
like you're you're you're actually doing something very dangerous and
264
00:12:33.240 --> 00:12:35.960
it's just it doesn't seem that way. So the thing
265
00:12:35.960 --> 00:12:37.320
that they did, so they did a couple of things.
266
00:12:37.360 --> 00:12:39.960
But the first one was they they were trying to
267
00:12:40.000 --> 00:12:43.039
print out the PR title in the action. So they
268
00:12:43.080 --> 00:12:45.960
had this echo command that just said like echo PR
269
00:12:46.039 --> 00:12:49.240
title and then it put the variable you know, into
270
00:12:49.279 --> 00:12:51.399
the command that that was that would print out the
271
00:12:51.399 --> 00:12:55.679
PR title. The way they did that with echo, right,
272
00:12:56.000 --> 00:12:58.600
and by putting the variable in there created a shell injection,
273
00:12:59.120 --> 00:13:02.000
which is it's very similar to a SQL injection if
274
00:13:02.000 --> 00:13:04.759
people are familiar with probably more familiar with SQL sql
275
00:13:04.759 --> 00:13:09.000
injection attacks, and that just means that an attacker can
276
00:13:09.480 --> 00:13:15.240
effectively insert their code into the command, so it's your
277
00:13:15.639 --> 00:13:19.000
instead of the instead of something being treated as data,
278
00:13:19.240 --> 00:13:22.399
it is inadvertently treated as code and executed. And so
279
00:13:22.480 --> 00:13:24.240
the way you do that here is you as an attacker,
280
00:13:24.279 --> 00:13:27.759
you'd just open a PR to this an x open
281
00:13:27.799 --> 00:13:30.480
source project, and you'd put your attack code in the
282
00:13:30.480 --> 00:13:33.039
title of the PR, but you'd start it with like
283
00:13:33.080 --> 00:13:36.720
a double quote to sort of close off the quote
284
00:13:36.720 --> 00:13:38.519
that they had in their command and then and then
285
00:13:38.559 --> 00:13:41.879
the rest would be kind of run as runs as
286
00:13:41.919 --> 00:13:44.080
a command, So you could get code effectively running in
287
00:13:44.159 --> 00:13:47.480
the in the environment of the you know, of the project.
288
00:13:47.639 --> 00:13:51.480
Now that is in and of itself not that like interesting,
289
00:13:51.559 --> 00:13:54.559
because like there has to be some something in that
290
00:13:54.679 --> 00:13:56.240
environment that you want to take or you want to
291
00:13:56.279 --> 00:14:00.440
steal as an attacker. And uh so that this is
292
00:14:00.480 --> 00:14:02.000
the kind of where you get to the second part
293
00:14:02.159 --> 00:14:06.720
where get of actions support two ways of responding to
294
00:14:06.759 --> 00:14:10.960
pull requests. So they have these triggers where you say, effectively,
295
00:14:11.000 --> 00:14:13.399
when this thing happens, run my git of action right.
296
00:14:13.840 --> 00:14:15.879
And so the thing that happens is the pull request
297
00:14:15.879 --> 00:14:19.000
has been opened, right, And they have two ways to
298
00:14:19.080 --> 00:14:21.240
react to pull requests that are being opened. One of
299
00:14:21.279 --> 00:14:23.320
them is called pull requests and one of them is
300
00:14:23.320 --> 00:14:26.919
called pull request target. And for many years, pull request
301
00:14:26.919 --> 00:14:29.159
target was the one that was recommended in the getub
302
00:14:29.159 --> 00:14:32.120
docs and was what a lot of tutorials and code
303
00:14:32.159 --> 00:14:34.000
samples were using. So it's probably the one that a
304
00:14:34.039 --> 00:14:36.720
lot of people chose to use. The problem with that
305
00:14:36.759 --> 00:14:40.679
one is that, unlike the standard pull request trigger, the
306
00:14:40.720 --> 00:14:44.519
poll request target one will will run the workflow with
307
00:14:44.559 --> 00:14:49.320
elevated permissions, and it includes this get up token environment
308
00:14:49.399 --> 00:14:52.720
variable that gives you full read and write access to
309
00:14:52.759 --> 00:14:53.559
their pository.
310
00:14:54.240 --> 00:14:56.519
So that token is just sitting there in the environment.
311
00:14:57.320 --> 00:14:58.240
And so if.
312
00:14:58.080 --> 00:15:01.000
You use pull request target in your project, it means
313
00:15:01.000 --> 00:15:03.919
now anyone can open a PR on your project, and
314
00:15:04.840 --> 00:15:06.799
if they can run code in that environment, you know
315
00:15:06.840 --> 00:15:09.240
that can look at the environment vables. There's going to
316
00:15:09.279 --> 00:15:11.840
be a really juicy environment vable there that lets them
317
00:15:12.039 --> 00:15:15.679
effectively commit to your repository. So the combination of those
318
00:15:15.720 --> 00:15:18.639
two things meant that an attacker could put code into
319
00:15:18.679 --> 00:15:21.240
the title of a PR, send it to just just
320
00:15:21.279 --> 00:15:22.960
open it on, you know, send a PR to the project,
321
00:15:23.000 --> 00:15:24.919
and then that code would run. And they made that
322
00:15:24.960 --> 00:15:28.399
code basically look for that environment variable and steal it
323
00:15:28.440 --> 00:15:31.240
and send it off to them via an HTTP request.
324
00:15:31.519 --> 00:15:33.600
So now they have the get up token, they can
325
00:15:33.679 --> 00:15:37.240
commit to this, you know, important open source project, even
326
00:15:37.240 --> 00:15:38.360
though they're not supposed.
327
00:15:38.000 --> 00:15:39.840
To be able to do that. So what do they
328
00:15:39.840 --> 00:15:42.960
do with that, Well, they were trying to get onto NPM,
329
00:15:43.000 --> 00:15:44.679
They're trying to compromise the NPM.
330
00:15:44.480 --> 00:15:48.519
Package, but they only have the get up token. So
331
00:15:49.720 --> 00:15:53.799
this project like a lot of projects have a published workflow,
332
00:15:53.960 --> 00:15:56.320
which is just another get of action that they've set
333
00:15:56.399 --> 00:15:59.960
up that will published NPM, and they made sure that
334
00:16:00.080 --> 00:16:03.039
the NPM published token was only available to.
335
00:16:03.000 --> 00:16:08.799
That publish workflow, so it was isolated over there, which
336
00:16:08.840 --> 00:16:10.600
is great. They did a good job of that. But
337
00:16:11.840 --> 00:16:14.879
now the attacker can write to the entire repository.
338
00:16:14.919 --> 00:16:16.320
So all they had to do was going and they
339
00:16:16.360 --> 00:16:19.279
just they just edited the publish workflow file and just
340
00:16:19.320 --> 00:16:22.159
added an extra step that would I think print out
341
00:16:22.480 --> 00:16:24.960
or send the NPM token to them, because once you
342
00:16:25.000 --> 00:16:26.919
can write to the repo, you know, then you can
343
00:16:27.000 --> 00:16:29.440
just edit any of the workflows and just it doesn't
344
00:16:29.480 --> 00:16:31.679
matter that the NPM token was only available to some
345
00:16:31.720 --> 00:16:33.679
of the workflows. They can just edit the workflow and
346
00:16:33.919 --> 00:16:36.320
print out the tokens and stuff. So that's how they
347
00:16:36.639 --> 00:16:39.799
they basically stole the NPM token and then published the
348
00:16:39.840 --> 00:16:42.440
malicious packages. So that was a lot of information, but
349
00:16:42.559 --> 00:16:44.000
I just wanted to walk through it because I think
350
00:16:44.279 --> 00:16:46.600
I don't know if you were following all of it
351
00:16:46.679 --> 00:16:48.480
or it was interesting to you, but I think it's
352
00:16:48.519 --> 00:16:52.000
fascinating because it's just like you're just using gid of actions,
353
00:16:52.000 --> 00:16:53.720
you like don't think about like I'm going to like
354
00:16:54.159 --> 00:16:55.879
my entire repo was going to get hacked and my
355
00:16:55.960 --> 00:16:58.399
NPM package is going to get a compromise because I
356
00:16:58.639 --> 00:17:03.279
just like you know, printed out a PR title like
357
00:17:03.519 --> 00:17:05.519
in my in my get of action, Like that doesn't
358
00:17:05.559 --> 00:17:08.960
seem like it should lead to that. So it's, uh,
359
00:17:09.079 --> 00:17:09.839
it's pretty wild.
360
00:17:10.799 --> 00:17:11.799
So a couple of things.
361
00:17:11.839 --> 00:17:16.160
One, for those who want a good example of sequel
362
00:17:16.200 --> 00:17:20.359
injection attacks, look up xk CD number three twenty seven,
363
00:17:20.480 --> 00:17:26.000
otherwise titled Exploits of a mom and you're recognized Bobby Tables.
364
00:17:26.599 --> 00:17:28.240
Yeah, just leave that to you to look up.
365
00:17:28.480 --> 00:17:30.960
That's one of the few xkcds that I have memorized,
366
00:17:32.240 --> 00:17:37.039
the number that and nerd sniping. But so a question
367
00:17:37.119 --> 00:17:42.440
for you then regarding how you know, like you just said,
368
00:17:42.440 --> 00:17:47.440
you wouldn't think that a GitHub action could expose you know,
369
00:17:47.519 --> 00:17:48.839
you just somebody stealing your token?
370
00:17:48.960 --> 00:17:51.839
Is that on the is that on GitHub?
371
00:17:52.000 --> 00:17:54.000
Is that on the creator of the action they have
372
00:17:54.039 --> 00:17:56.720
to know the finding security details of creating a GitHub
373
00:17:56.759 --> 00:18:02.279
action or is it just the nature of you know
374
00:18:02.680 --> 00:18:06.400
what it is that you can everybody's looking for vulnerability
375
00:18:06.519 --> 00:18:10.119
somewhere and somebody happened to be created creative or how
376
00:18:10.119 --> 00:18:10.759
do you look at that?
377
00:18:12.079 --> 00:18:14.880
I mean, as with security, all things in security, it's
378
00:18:14.920 --> 00:18:18.440
it's a complicated answer. I think there's blame to be
379
00:18:18.519 --> 00:18:21.279
shared on all sides. But I put probably more of
380
00:18:21.279 --> 00:18:24.960
the blame on the design of get of actions because it,
381
00:18:26.279 --> 00:18:28.240
you know, it's not fair. I don't think it's fair
382
00:18:28.359 --> 00:18:33.079
to you know, have kind of a bad design or
383
00:18:33.119 --> 00:18:36.440
bad defaults and then just say, oh, well I documented it.
384
00:18:36.519 --> 00:18:38.200
You know, go read the docks. The docks tell you
385
00:18:38.279 --> 00:18:40.599
how how you know how not to use this.
386
00:18:40.880 --> 00:18:42.519
If it's if it's too if it's if you have
387
00:18:42.599 --> 00:18:45.599
too many like booby traps or you know what sometimes
388
00:18:45.599 --> 00:18:48.559
called foot guns in the design of of something, then
389
00:18:48.799 --> 00:18:50.400
you know, you you definitely have some of the blame
390
00:18:50.440 --> 00:18:52.400
on the creator of that design. So there were a
391
00:18:52.440 --> 00:18:54.079
few things in the design here that we're just that
392
00:18:54.119 --> 00:18:57.400
we're not obvious to people. I think, you know, the
393
00:18:57.440 --> 00:18:59.759
fact that they were recommending pull request target for a
394
00:18:59.839 --> 00:19:03.599
year instead of the safer pull request trigger is definitely
395
00:19:03.599 --> 00:19:07.000
on GitHub. They've now documented that very well. So it
396
00:19:07.039 --> 00:19:09.559
is all documented. But you know, there's a lot of
397
00:19:09.559 --> 00:19:12.279
tutorials and guides and things that are going to still
398
00:19:12.319 --> 00:19:15.839
have the old information, so, you know, and then I
399
00:19:15.880 --> 00:19:19.759
think the other part of the design that is probably
400
00:19:20.640 --> 00:19:23.319
not that obvious is so that the I mean the
401
00:19:23.400 --> 00:19:25.839
NX the credit of the NX project. I was very
402
00:19:25.880 --> 00:19:28.640
impressed they actually figured out that they had this shell
403
00:19:28.680 --> 00:19:31.960
injection vulnerability and they fixed their get of action two
404
00:19:32.039 --> 00:19:37.039
years before this attack happened. So from their perspective, they
405
00:19:37.079 --> 00:19:40.079
fixed the problem, like they fixed the echo issue, you know,
406
00:19:40.200 --> 00:19:42.160
and so how are they still affected?
407
00:19:42.240 --> 00:19:44.680
Right? That's kind of another interesting part of the story.
408
00:19:45.680 --> 00:19:47.759
It turns out that if you have an old branch
409
00:19:48.039 --> 00:19:51.240
that still has the you know, still has an action
410
00:19:51.759 --> 00:19:54.799
on that branch, then anyone can open a PR against
411
00:19:54.839 --> 00:19:57.480
an old branch, right like when you open prs, you
412
00:19:57.519 --> 00:19:59.480
can target any branch. You don't have to open the
413
00:19:59.480 --> 00:20:02.000
PR on or on Maine. You can open the PR
414
00:20:02.319 --> 00:20:04.200
on something from two years ago if if the branch
415
00:20:04.240 --> 00:20:07.079
is still there. And so they had fixed this issue
416
00:20:07.359 --> 00:20:09.920
two years before, but it was still lying around on
417
00:20:09.920 --> 00:20:12.200
a whole branch, and so again to me, that's like,
418
00:20:12.359 --> 00:20:16.319
I guess technically that's probably explained somewhere in the get
419
00:20:16.319 --> 00:20:20.720
of Actions documentation, but I you know, I as security
420
00:20:20.799 --> 00:20:23.039
person probably wouldn't have made that connection.
421
00:20:23.160 --> 00:20:25.400
Like I you know, I don't. I like to be kind.
422
00:20:25.480 --> 00:20:28.400
I like to sort of be try to have some
423
00:20:28.440 --> 00:20:29.960
grace for people that are just trying to do their
424
00:20:29.960 --> 00:20:31.559
best to like do things right. And I think there
425
00:20:31.640 --> 00:20:33.079
was a lot of things that the NX team did
426
00:20:33.119 --> 00:20:35.160
really well here and yet despite all that, like they
427
00:20:35.200 --> 00:20:35.920
were still affected.
428
00:20:35.920 --> 00:20:37.400
So I definitely put some of the blame on the
429
00:20:37.400 --> 00:20:38.680
design to get of actions here.
430
00:20:38.799 --> 00:20:41.000
Well. You know that's interesting because I can remember, I
431
00:20:41.000 --> 00:20:42.759
don't remember when it was, I want to say, within
432
00:20:42.799 --> 00:20:48.200
the past year somebody raising a question with GitHub regarding
433
00:20:48.480 --> 00:20:51.599
the deletion of branches and whether or not they're truly deleted,
434
00:20:52.599 --> 00:20:56.720
and you know, because they're thinking, Okay, I'm deleting a branch,
435
00:20:56.759 --> 00:20:59.480
it's gone, and getthub saying no, that's a beat or
436
00:20:59.480 --> 00:21:02.200
not a bove ug, you know, as they purposely keep
437
00:21:02.240 --> 00:21:04.680
old branches around if you say you've deleted them. And
438
00:21:04.720 --> 00:21:09.039
I was like, okay, and I can think of I
439
00:21:09.079 --> 00:21:14.720
can think of a time where that has been useful,
440
00:21:15.599 --> 00:21:17.559
you know, where I wanted to recuperate an old branch
441
00:21:17.640 --> 00:21:19.359
for some reason and it's still and I know they
442
00:21:19.400 --> 00:21:22.319
get up and deleted, but you know, at the same time,
443
00:21:22.319 --> 00:21:25.240
that looks like a two edged sword in the case
444
00:21:25.240 --> 00:21:27.440
that you're describing that someone thinks they deleted it, but
445
00:21:27.519 --> 00:21:30.039
it's really not. And so now you got to worry
446
00:21:30.079 --> 00:21:32.400
about old branch you supposedly deleted, which is still around.
447
00:21:32.400 --> 00:21:35.799
It can be used as an attack vector. Yeah, my
448
00:21:35.839 --> 00:21:38.599
head spins just thinking about it. So anyway, this.
449
00:21:38.640 --> 00:21:40.759
Also matters a lot when you're trying to clean up
450
00:21:40.799 --> 00:21:44.279
like an accidental commit that contains a secret or token
451
00:21:44.480 --> 00:21:47.359
and you go intro you forced push to try to
452
00:21:47.359 --> 00:21:50.680
get rid of it from the history, and but then
453
00:21:50.680 --> 00:21:53.759
it's actually like still lying around on GitHub.
454
00:21:54.200 --> 00:21:58.319
So for those folks that don't know, if you know, to.
455
00:21:58.240 --> 00:22:03.960
Commit hash of the the commit that contains the the
456
00:22:04.000 --> 00:22:05.400
secret or the you know, the one that you thought
457
00:22:05.400 --> 00:22:06.839
you did, the commit that you thought you deleted, if
458
00:22:06.880 --> 00:22:09.240
you put that commit hash into GitHub, it'll actually still
459
00:22:09.279 --> 00:22:12.200
be there forever. It's just immutable, like it's just the
460
00:22:12.440 --> 00:22:15.799
URL that just will exist forever with whatever you whatever
461
00:22:15.880 --> 00:22:18.119
data you thought you deleted. So if you want to
462
00:22:18.119 --> 00:22:20.039
actually fully delete it, you have to contact get up
463
00:22:20.079 --> 00:22:24.599
support and basically ask them to going manually. Yeah yeah,
464
00:22:24.640 --> 00:22:27.799
so yeah, even if you force pushed, the only only truly. Truly,
465
00:22:27.960 --> 00:22:29.359
I think the clean way to fix it is to
466
00:22:29.440 --> 00:22:33.599
completely delete their entire repo. But even then you might
467
00:22:33.680 --> 00:22:36.119
have forks. If it's been a public repo and someone's
468
00:22:36.160 --> 00:22:39.640
forked it, then my understanding is that that the fork
469
00:22:40.200 --> 00:22:43.599
actually then kind of keeps a reference to all those
470
00:22:43.640 --> 00:22:47.240
commits and then still won't get deleted. So yeah, you
471
00:22:47.240 --> 00:22:49.039
should just assume if it's been ever in a commit
472
00:22:49.119 --> 00:22:51.079
and it's been pushed to get hub like, it's public forever.
473
00:22:51.119 --> 00:22:53.599
Even if you've force pushed over it like, it's basically
474
00:22:53.880 --> 00:22:57.039
you can't bring you can't put the toothpaste back in
475
00:22:57.039 --> 00:23:00.880
the tube.
476
00:23:02.839 --> 00:23:05.680
Interesting, Yeah, well it makes you nervous. So the only
477
00:23:05.759 --> 00:23:06.680
so if you delete it.
478
00:23:06.759 --> 00:23:08.599
So what you're saying, and if I understand at least
479
00:23:08.640 --> 00:23:11.400
forget up, I use getting lab in my day to
480
00:23:11.480 --> 00:23:13.200
day work, we're using get labs, so I'm not sure
481
00:23:13.240 --> 00:23:14.799
if all of this carries.
482
00:23:14.480 --> 00:23:15.359
Over there as well.
483
00:23:16.079 --> 00:23:19.880
But the so, if you delete the entire repo, then
484
00:23:20.119 --> 00:23:23.279
you know, say it was private and nobody's forked, then
485
00:23:23.319 --> 00:23:28.119
it should be gone. But individual branches are not truly
486
00:23:28.200 --> 00:23:32.119
deleted within a repo that's still up.
487
00:23:32.680 --> 00:23:36.079
Yeah, the repo's up then then the commits, the then
488
00:23:36.160 --> 00:23:40.680
specific commit hashes if you know, those hashes will allow
489
00:23:40.720 --> 00:23:45.519
you to recover the data. So, uh, the question is
490
00:23:45.519 --> 00:23:47.240
how do you find that hash. I'm not an expert
491
00:23:47.279 --> 00:23:52.759
in this stuff, so I'm kind of uh talking mostly
492
00:23:52.839 --> 00:23:54.599
based off of some research I read that was put
493
00:23:54.599 --> 00:23:57.279
out by the truffle Hog team. You know, a truffle
494
00:23:57.279 --> 00:24:00.480
hog is like a security tool that lets use for
495
00:24:01.400 --> 00:24:05.519
tokens and secrets in things like get ub repos and
496
00:24:05.519 --> 00:24:07.359
they've done a lot of research on this area. So
497
00:24:07.359 --> 00:24:09.240
if if you search for their blog, you can kind
498
00:24:09.240 --> 00:24:10.680
of find out find out some of this stuff that
499
00:24:10.960 --> 00:24:12.000
Dylan Iri.
500
00:24:12.000 --> 00:24:14.000
Is the the.
501
00:24:13.799 --> 00:24:16.480
Founder and creator of that project over there, and it's
502
00:24:16.480 --> 00:24:17.960
where I kind of learned most of the stuff from.
503
00:24:18.000 --> 00:24:20.119
But yeah, I think so the short version is just
504
00:24:20.200 --> 00:24:22.079
if it's if if you've ever pushed it up to
505
00:24:22.079 --> 00:24:25.319
get hub, assume it's gone and you know, assume it's
506
00:24:25.319 --> 00:24:27.240
out there, and then there is a there is a
507
00:24:27.240 --> 00:24:29.880
way to kind of contact support and get those those
508
00:24:29.880 --> 00:24:31.039
commit hashes removed.
509
00:24:31.119 --> 00:24:37.480
But you you know, you you should just you should
510
00:24:37.480 --> 00:24:40.240
still obviously rotate the tokens and you know, revoke them
511
00:24:40.240 --> 00:24:42.359
if you can, and try to try to assume all
512
00:24:42.400 --> 00:24:44.400
that data is just gone even even if you do that.
513
00:24:45.720 --> 00:24:48.240
Right, Yeah, I don't know how it works get lab.
514
00:24:48.279 --> 00:24:50.720
That's that's another that's another interesting question though.
515
00:24:52.759 --> 00:24:54.519
Yeah, so, uh, do you want to talk about the
516
00:24:54.640 --> 00:24:56.559
uh the chalk one now?
517
00:24:56.640 --> 00:25:00.759
The ones that go to yeah, okay in regards to
518
00:25:00.799 --> 00:25:05.000
another two f a email reset and being compromised.
519
00:25:04.839 --> 00:25:07.359
Yeah, that's right. That one was was a similar email.
520
00:25:07.559 --> 00:25:10.759
This time the email originated from support at npm JS
521
00:25:10.880 --> 00:25:11.519
dot help.
522
00:25:13.079 --> 00:25:15.599
So, uh, I don't know. I I kind of feel
523
00:25:15.599 --> 00:25:15.759
like that.
524
00:25:15.799 --> 00:25:20.079
Email is obviously not not not legit, but that then
525
00:25:20.200 --> 00:25:23.160
that said, you know, there are a lot of companies
526
00:25:23.160 --> 00:25:23.839
these days.
527
00:25:23.680 --> 00:25:26.319
Using these these interesting new TLDs.
528
00:25:26.920 --> 00:25:28.240
And is help legit?
529
00:25:28.359 --> 00:25:28.720
Is that a?
530
00:25:29.039 --> 00:25:29.680
Is that a tl D?
531
00:25:30.880 --> 00:25:32.799
I suppose it is? Yeah, let me see uh Google
532
00:25:32.920 --> 00:25:33.680
really quickly.
533
00:25:33.440 --> 00:25:36.720
Here, Yeah, Google looked. There's so many it's hard to
534
00:25:36.759 --> 00:25:37.680
keep track from all.
535
00:25:37.880 --> 00:25:39.519
Yeah, it's like any word, you know. The one that
536
00:25:39.559 --> 00:25:40.599
really the world only really.
537
00:25:40.519 --> 00:25:42.039
Still bothers me that they made it to a TLD
538
00:25:42.160 --> 00:25:46.000
is dot zip because now you can Yeah, you can
539
00:25:46.039 --> 00:25:48.079
have a file name that's like dot zip and you're
540
00:25:48.119 --> 00:25:49.559
just typing it out the name of it and then
541
00:25:49.559 --> 00:25:52.079
it'll get it'll automatically turn into a link in a
542
00:25:52.079 --> 00:25:55.440
lot of programs now and it's like, yeah.
543
00:25:54.599 --> 00:25:55.519
I'm trying to do here.
544
00:25:56.000 --> 00:26:00.119
Yeah, but anyway, uh yeah, so so so it. But
545
00:26:00.160 --> 00:26:01.759
I think, you know, again, like the phishing email stuff,
546
00:26:01.759 --> 00:26:04.960
it's really effective, surprisingly effective. Even people that are security
547
00:26:05.000 --> 00:26:07.000
experts fall for this stuff sometimes. So I don't want
548
00:26:07.039 --> 00:26:08.759
to put any blame on the on the maintainer. The
549
00:26:08.759 --> 00:26:12.240
only thing I'll say is, like, you know, phishing resistant
550
00:26:12.240 --> 00:26:15.759
to FA would have would have solved these problems. And
551
00:26:15.799 --> 00:26:17.880
so for those who don't know what is fishing resistant
552
00:26:17.920 --> 00:26:19.519
t FA, I'm just going.
553
00:26:19.440 --> 00:26:21.279
To ask that. Yeah.
554
00:26:21.319 --> 00:26:23.519
So two FA is just you know, a second factor right,
555
00:26:23.599 --> 00:26:26.079
second factor to two factor authentication. It's just the idea
556
00:26:26.119 --> 00:26:29.640
that you provide, you know, some other evidence that you
557
00:26:29.680 --> 00:26:33.039
are who you are besides your password. Typically you'll see
558
00:26:33.039 --> 00:26:35.240
things like a time based code, or you'll see like
559
00:26:35.480 --> 00:26:37.880
a text, like a two factor a text or by
560
00:26:37.960 --> 00:26:41.680
another app or something like that. That's all great, it's
561
00:26:41.680 --> 00:26:45.119
better than than just having a password alone. But the
562
00:26:45.160 --> 00:26:47.039
gold standard what you really want to have is phishing
563
00:26:47.119 --> 00:26:50.119
resistant TUFA. And what that is is it's basically a
564
00:26:50.119 --> 00:26:54.160
two FA method that is resistant to phishing attacks.
565
00:26:55.079 --> 00:26:55.720
What does that mean?
566
00:26:55.759 --> 00:26:59.240
That means that there's no way to trick a person,
567
00:26:59.319 --> 00:27:02.640
a human ofulnerable, you know, human to take that to
568
00:27:02.759 --> 00:27:05.599
a fake token and to put it into the wrong website,
569
00:27:05.759 --> 00:27:08.240
to put it onto a fake website. So how is
570
00:27:08.240 --> 00:27:11.880
that enforced. Well, let's let's take a simple example of
571
00:27:12.039 --> 00:27:12.680
one of those methods.
572
00:27:12.680 --> 00:27:13.559
It would be a UBI key.
573
00:27:13.720 --> 00:27:15.720
So for those who haven't seen them, they're the diesel
574
00:27:15.880 --> 00:27:17.799
you know, hardware tokens that you can.
575
00:27:17.839 --> 00:27:18.440
You can buy it.
576
00:27:18.920 --> 00:27:21.640
I've used those, yeah, yeah, So what's what's one of
577
00:27:21.720 --> 00:27:24.680
the best things about those is that they will refuse
578
00:27:24.839 --> 00:27:28.039
to give up the you know, the key material to
579
00:27:28.119 --> 00:27:31.480
the wrong domain. So if you're on a fake website,
580
00:27:31.480 --> 00:27:34.359
you're on a fake NPM website and you you ask
581
00:27:34.480 --> 00:27:36.079
that you know, you touch the key and you ask
582
00:27:36.160 --> 00:27:38.559
it to provide key material, it won't provide the key
583
00:27:38.599 --> 00:27:41.359
material to the wrong domain. It's going to provide different
584
00:27:41.400 --> 00:27:43.960
key material to the to the attacker. So what that
585
00:27:44.039 --> 00:27:47.519
means is that it can't be tricked. Right, it works
586
00:27:47.559 --> 00:27:50.319
directly with the browser to enforce that it's you know,
587
00:27:50.799 --> 00:27:53.279
providing material to the correct domain.
588
00:27:53.440 --> 00:27:56.039
And and so that's that's why it's awesome. The other
589
00:27:56.079 --> 00:27:57.200
one you bought one of these.
590
00:27:57.279 --> 00:27:58.160
I've used these before.
591
00:27:58.200 --> 00:28:01.039
We had a fob, yeah, and they're there's another one
592
00:28:01.079 --> 00:28:02.960
that I had and I can't find where it was.
593
00:28:03.119 --> 00:28:05.599
I would plug it into a port on the laptop
594
00:28:05.680 --> 00:28:09.759
and you had to touch it yep, like USBC type port.
595
00:28:10.079 --> 00:28:12.599
Yeah, So that the only kind it's it's all like
596
00:28:12.640 --> 00:28:15.960
the real benefit of it is just that it it's
597
00:28:16.000 --> 00:28:18.799
sort of the site get The site knows that, Okay,
598
00:28:18.799 --> 00:28:21.400
I'm talking to the person who's in physical possession of
599
00:28:21.400 --> 00:28:24.559
this device, so they know that, you know, someone some
600
00:28:24.680 --> 00:28:27.200
attacker isn't unless they stole the device from you, right, Like,
601
00:28:27.759 --> 00:28:29.599
what they're validating is that you have this physically in
602
00:28:29.599 --> 00:28:31.440
your possession. But the other piece of it is the
603
00:28:31.440 --> 00:28:33.759
fishing resistance. So the device is smart enough to not
604
00:28:33.799 --> 00:28:36.440
give up the material to the wrong domain because it's
605
00:28:36.480 --> 00:28:38.640
it's literally working with the browser to check the domain
606
00:28:38.720 --> 00:28:41.200
and only provide it to the correct domain.
607
00:28:41.440 --> 00:28:42.640
So that's the kind of power of it.
608
00:28:42.839 --> 00:28:44.440
The other thing you've probably seen a lot more of
609
00:28:44.480 --> 00:28:47.160
these days is past keys, and there's a lot of
610
00:28:47.200 --> 00:28:49.319
sites that are prompting you now for past keys. And
611
00:28:51.200 --> 00:28:53.200
for a while I was like another thing I have
612
00:28:53.240 --> 00:28:55.680
to learn. But but past keys are also really cool.
613
00:28:56.039 --> 00:29:01.799
Passkeys have the same property in that they uh, it's
614
00:29:01.880 --> 00:29:04.039
it's working with either your you know, your your pastor
615
00:29:04.079 --> 00:29:07.480
manager or your operating system to store this pass key.
616
00:29:07.720 --> 00:29:09.640
And this pass key will only ever be given up
617
00:29:09.680 --> 00:29:12.319
to the correct domain. So again it's fishing resistant. It
618
00:29:12.319 --> 00:29:15.759
can't be tricked to you know, it won't get entered
619
00:29:15.799 --> 00:29:18.720
into a into a fake site.
620
00:29:18.920 --> 00:29:21.799
So appractically if I'm wrong, But a pass key is
621
00:29:21.799 --> 00:29:24.680
is specific to the device, right, So you can't have
622
00:29:24.759 --> 00:29:27.480
one key passkey that you use in multiple places or
623
00:29:27.559 --> 00:29:28.079
is that wrong?
624
00:29:28.559 --> 00:29:31.279
It does lock you to a device in theory, although
625
00:29:31.279 --> 00:29:32.960
I can, like I have one password and I put
626
00:29:33.000 --> 00:29:35.400
my pass key into my one password, and you.
627
00:29:35.400 --> 00:29:35.759
Can do that.
628
00:29:35.839 --> 00:29:37.720
Yeah, you can do that. Yeah, And in that way,
629
00:29:37.960 --> 00:29:40.519
if you get a new device or you get a you.
630
00:29:40.480 --> 00:29:42.920
Know, like I can set up my pass key once
631
00:29:42.960 --> 00:29:45.160
on my computer and then when I'm on my phone,
632
00:29:45.279 --> 00:29:46.960
I have my one password there as well, and I
633
00:29:47.000 --> 00:29:48.720
can just log into the same site. I don't have
634
00:29:48.759 --> 00:29:52.079
to keep binding numerous pass keys on every device and
635
00:29:52.079 --> 00:29:53.640
do it all over again when I get a new device.
636
00:29:54.319 --> 00:29:56.039
Yeah, because I have that same setup because we use
637
00:29:56.079 --> 00:29:57.960
one password at work and I use it like for
638
00:29:58.079 --> 00:30:01.240
a DP which is our you know, personal HR management stuff,
639
00:30:01.680 --> 00:30:03.680
and I use it there all the time with you know,
640
00:30:03.799 --> 00:30:07.160
with the fingerprint you know on my MacBook, which is
641
00:30:07.200 --> 00:30:09.200
tied to one password which then gets me in.
642
00:30:09.200 --> 00:30:11.599
But I didn't realize I could use that across devices.
643
00:30:11.880 --> 00:30:13.680
That's cool, Okay, yeah.
644
00:30:13.519 --> 00:30:15.200
I think you can. So I'm not sure that the
645
00:30:15.200 --> 00:30:16.319
standard is very complicated.
646
00:30:16.400 --> 00:30:18.400
There might be a way that some sites can like
647
00:30:18.519 --> 00:30:22.480
prevent you from putting your pass key into something that
648
00:30:22.759 --> 00:30:26.440
has cloud sync, but don't quote me on that.
649
00:30:26.480 --> 00:30:28.039
I'm not I'm not, like, I just know there's.
650
00:30:27.839 --> 00:30:30.480
A lot of complicated options, and sites can demand certain
651
00:30:30.720 --> 00:30:33.960
properties of the of the device, of the.
652
00:30:33.839 --> 00:30:35.119
Of where the pass key is being stored.
653
00:30:35.359 --> 00:30:38.200
But generally Mike had I already put it on Twitter
654
00:30:38.359 --> 00:30:40.279
Frost said that pass key I'm kidding.
655
00:30:41.200 --> 00:30:43.799
No, it's a bit but but but in my experience,
656
00:30:43.799 --> 00:30:45.519
I can basically put a pass key into one password
657
00:30:45.559 --> 00:30:47.799
any any any any.
658
00:30:47.720 --> 00:30:50.039
Any time I've been prompted, So it's pretty cool.
659
00:30:50.279 --> 00:30:51.759
So anyway, the reason I bring all that up is
660
00:30:51.759 --> 00:30:55.599
just to say that like like basically, like the the
661
00:30:55.640 --> 00:30:57.680
maintainers wouldn't have been able to be tricked if if
662
00:30:57.799 --> 00:31:01.559
NPM had mandated to f A with this fishing resistant property.
663
00:31:02.519 --> 00:31:05.799
So it's somewhat disappointing that, you know, this was, you know,
664
00:31:06.400 --> 00:31:09.240
somewhat preventable, you know, if NPM would have been willing
665
00:31:09.279 --> 00:31:12.799
to kind of force this on maintainers, which is, you know,
666
00:31:12.920 --> 00:31:14.119
I'm not saying it's costless.
667
00:31:14.160 --> 00:31:16.880
Obviously, there's there's some cost of kind of making everybody.
668
00:31:16.839 --> 00:31:20.759
Go through this, but but for prolific maintainers with access
669
00:31:20.839 --> 00:31:25.920
to you know, billions and billions of downloads per week,
670
00:31:26.359 --> 00:31:29.599
you know, I think it's it's probably a it's obviously,
671
00:31:29.640 --> 00:31:31.319
in my opinion, a good trade off to make those
672
00:31:31.400 --> 00:31:35.079
maintainers take this extra step. So what happened here was
673
00:31:35.119 --> 00:31:38.000
this Kicks maintainer was compromised, he fell for the fishing attack,
674
00:31:38.440 --> 00:31:40.559
and then he had access to a lot of Cinder
675
00:31:40.599 --> 00:31:45.799
sources packages and cinder sources. An awesome, amazing prolific maintainer
676
00:31:45.880 --> 00:31:47.720
who has some of the most useful and.
677
00:31:47.680 --> 00:31:48.960
Popular packages on NPM.
678
00:31:50.039 --> 00:31:53.079
Power is a huge, huge portion of the job script ecosystem,
679
00:31:53.640 --> 00:31:58.359
and so that compromise was was able to get able
680
00:31:58.359 --> 00:32:02.440
to allow the attacker to insert some code into those packages.
681
00:32:02.799 --> 00:32:05.039
In this case, the code was a scrypto stealing code.
682
00:32:05.960 --> 00:32:10.240
So it worked by hooking into the fetch API and
683
00:32:10.279 --> 00:32:16.440
the xml httpeer quest API and various like wallet provider APIs.
684
00:32:16.519 --> 00:32:18.440
And so what it did was it was if you
685
00:32:18.480 --> 00:32:20.720
called those functions in your in your front end of
686
00:32:20.720 --> 00:32:22.880
your site, it would be able to be able to
687
00:32:22.920 --> 00:32:26.519
rewrite the transaction data and replace the legitimate addresses with
688
00:32:26.920 --> 00:32:29.880
tackle control addresses. So they were just actively trying to
689
00:32:30.480 --> 00:32:32.680
you know, insert themselves in the flow and like make
690
00:32:32.720 --> 00:32:34.359
sure that you sent the money to them instead of
691
00:32:34.359 --> 00:32:35.799
to your intended recipient.
692
00:32:38.440 --> 00:32:40.000
Yeah. I remember when that came out, there was a
693
00:32:40.039 --> 00:32:44.160
bunch of them, and by the time we got notification
694
00:32:44.200 --> 00:32:45.079
and looked, I know that.
695
00:32:46.599 --> 00:32:48.000
Uh was I talk.
696
00:32:48.160 --> 00:32:49.640
That's the one that comes to mind. I know there's
697
00:32:49.640 --> 00:32:52.319
some other libraries that already had an updated version. I
698
00:32:52.319 --> 00:32:54.480
think they'd rolled back to a previous commit or something
699
00:32:54.559 --> 00:32:56.599
like that. I don't remember how they did it. And
700
00:32:56.680 --> 00:32:58.400
so if you installed that then you were pretty good.
701
00:32:59.279 --> 00:33:01.039
Yeah, but this was a lot of popular packages.
702
00:33:01.079 --> 00:33:07.720
There was like chalk color packages, debug it's a big
703
00:33:07.720 --> 00:33:08.720
one that people use.
704
00:33:08.519 --> 00:33:09.480
I use dbug.
705
00:33:10.960 --> 00:33:12.359
Yeah, so there's just a lot of these, a lot
706
00:33:12.359 --> 00:33:15.559
of like low level, widely widely used packages.
707
00:33:16.119 --> 00:33:17.960
Sort of a left pad type thing again.
708
00:33:18.720 --> 00:33:22.079
Yeah, yeah, exactly. Yeah, So that was that was a
709
00:33:22.200 --> 00:33:24.279
very big one. Fortunately it was only live for like
710
00:33:24.319 --> 00:33:26.200
four hours, but if you were unlucky enough to install
711
00:33:26.279 --> 00:33:28.640
during those four hours, you know, you were you were affected.
712
00:33:28.680 --> 00:33:31.279
So this is kind of what why like we started
713
00:33:31.279 --> 00:33:33.119
stock it to be totally honest with you, because it
714
00:33:33.160 --> 00:33:37.319
seems like everybody is like reactive to these things. You know,
715
00:33:37.400 --> 00:33:39.319
Oh I read about oh chalk was compromised. Oh let
716
00:33:39.319 --> 00:33:41.279
me check my system. Did I install the vulnerable version
717
00:33:41.359 --> 00:33:43.319
or the malicious version? And then you just kind of
718
00:33:43.319 --> 00:33:46.200
hope that you were lucky enough to not have run
719
00:33:46.240 --> 00:33:49.880
an NPM update during that window of time. And it
720
00:33:49.880 --> 00:33:51.640
feels like, you know, we got we ought to be
721
00:33:51.640 --> 00:33:53.640
able to do better than this as a community, you know,
722
00:33:53.720 --> 00:33:56.920
as a as an industry, like we can you know,
723
00:33:58.079 --> 00:34:00.279
I mean fundamentally, the problem is we're installing code that
724
00:34:00.319 --> 00:34:02.400
we haven't evaluated. We haven't looked at the code that
725
00:34:02.400 --> 00:34:04.119
we're running. That's really what it comes down to is
726
00:34:04.119 --> 00:34:06.240
we're hitting install, we're pulling code.
727
00:34:06.000 --> 00:34:08.400
In on the internet. We're not looking at it and
728
00:34:08.440 --> 00:34:10.239
then it's we're executing it.
729
00:34:11.039 --> 00:34:16.039
So that's where I think, you know, treat treating this
730
00:34:16.079 --> 00:34:20.159
code differently, treating it as something that's part of your application,
731
00:34:20.920 --> 00:34:23.880
that is your responsibility, is something that isn't just a
732
00:34:23.880 --> 00:34:26.360
black box. It can can change, can help you know,
733
00:34:26.440 --> 00:34:29.320
change change this sort of risk profile.
734
00:34:28.960 --> 00:34:30.880
Here, or you know, you can use a tool to
735
00:34:30.920 --> 00:34:31.199
help you.
736
00:34:31.280 --> 00:34:34.199
And that's what we try to help is looking at
737
00:34:34.239 --> 00:34:38.039
the at the code for you, using a bunch of automation,
738
00:34:38.199 --> 00:34:40.559
a bunch of static analysis, and a bunch of l
739
00:34:40.639 --> 00:34:42.880
ll M kind of like AI analysis to find these
740
00:34:42.880 --> 00:34:47.440
attacks even before uh, you know, anyone else, anyone has
741
00:34:47.519 --> 00:34:49.360
kind of discovered these, Like we're we're scanning of the
742
00:34:49.400 --> 00:34:52.599
automated in an automated manner, all of NPM as well
743
00:34:52.639 --> 00:34:55.920
as all of a bunch of the top ecosystems like
744
00:34:56.000 --> 00:35:02.039
the Python, dot Net, Rust, Ruby, Goo, Scalah, et cetera.
745
00:35:03.559 --> 00:35:05.880
So yeah, so then hopefully you know, we can we
746
00:35:05.920 --> 00:35:08.519
can sort of be in the middle of that and
747
00:35:08.519 --> 00:35:12.159
and and and and prevent those those packages from getting
748
00:35:12.199 --> 00:35:18.440
on your system. Yeah, So that's that's that one, and
749
00:35:18.440 --> 00:35:19.960
then there's there's a few more that came after that.
750
00:35:20.000 --> 00:35:22.079
If you're if you're interested to kind Oh, let's.
751
00:35:21.960 --> 00:35:23.000
Keep going, keep going.
752
00:35:23.039 --> 00:35:26.440
Okay, it sounds like I knew about that last one,
753
00:35:26.920 --> 00:35:31.199
the one Chalk, that's all. But you were telling me
754
00:35:31.239 --> 00:35:33.400
about the newer ones that I apparently haven't heard, so
755
00:35:34.440 --> 00:35:35.599
I want to hear about them.
756
00:35:35.719 --> 00:35:37.800
So after the after the Chalk one, there was another
757
00:35:37.800 --> 00:35:40.840
one that followed the following day, uh, compromised this project
758
00:35:40.840 --> 00:35:43.880
called duck dB, which has three hundred thousand weekly downloads.
759
00:35:43.760 --> 00:35:48.840
And that one duck dB. Yeah, and you did hear
760
00:35:48.840 --> 00:35:49.119
about it.
761
00:35:49.119 --> 00:35:51.079
Okay, well, no, not that, I mean just duck dB.
762
00:35:51.199 --> 00:35:55.599
It's a it's a the tool itself, right right, Okay, Yeah,
763
00:35:55.639 --> 00:35:57.239
And this one was was the same attacker as the
764
00:35:57.280 --> 00:35:59.639
day before, so this was exactly the same malware that
765
00:35:59.679 --> 00:36:03.400
effect Chalk. So this one was clearly the same person.
766
00:36:04.639 --> 00:36:08.559
And then the following week there was another set of attacks.
767
00:36:08.599 --> 00:36:10.360
And this kind of brings us towards the end of
768
00:36:10.360 --> 00:36:14.239
the story. So this one was interesting because it affected
769
00:36:14.320 --> 00:36:16.199
another color library. I don't know why it's always a
770
00:36:16.239 --> 00:36:20.119
color library, but it was a color library called tiny Color.
771
00:36:22.159 --> 00:36:24.960
And on the Monday of September fifteenth, that hit about
772
00:36:24.960 --> 00:36:33.280
forty packages and basically the thing that made this attack
773
00:36:33.360 --> 00:36:40.199
interesting was that it searched your system for so the
774
00:36:40.320 --> 00:36:44.880
malar searched your system for NPM tokens, and if it
775
00:36:44.880 --> 00:36:47.719
found an NPM token, it wouldn't just steal it. It
776
00:36:47.719 --> 00:36:50.599
would actually figure out what are the packages that that
777
00:36:50.679 --> 00:36:54.639
token gives access to. It would download those packages the
778
00:36:54.679 --> 00:36:56.760
tar ball, you know, the actual code of the package,
779
00:36:56.840 --> 00:36:59.960
and it would insert like itself, it would replicate itself
780
00:37:00.039 --> 00:37:03.039
the malware into that package and then publish it back
781
00:37:03.039 --> 00:37:06.840
to NPM. So if your package as a as a
782
00:37:06.840 --> 00:37:08.760
new version of the existing.
783
00:37:08.360 --> 00:37:11.360
Package, oh wow, okay, so.
784
00:37:11.239 --> 00:37:13.519
If you like, like if if you were affected, you
785
00:37:13.559 --> 00:37:14.480
would you would.
786
00:37:14.199 --> 00:37:16.800
Not just have your NPM token stolen, but all your
787
00:37:16.880 --> 00:37:19.320
NPM packages that you maintained that you have access to
788
00:37:19.400 --> 00:37:22.440
would be infected with the same malware, so that it
789
00:37:22.599 --> 00:37:24.960
sort of spreads like a virus, like a worm, through
790
00:37:25.280 --> 00:37:27.719
through all of NPM. And so within like a day,
791
00:37:27.960 --> 00:37:30.400
so by by Tuesday, September sixteenth, By the following day,
792
00:37:30.599 --> 00:37:32.960
five hundred packages had been affected by this. It just
793
00:37:33.000 --> 00:37:36.519
spread like a like a worm, completely through NPM, infecting,
794
00:37:36.559 --> 00:37:40.960
infecting like even some some pretty uh like surprising packages
795
00:37:41.119 --> 00:37:45.960
like crowdstrikes packages, which is a security company that like
796
00:37:46.079 --> 00:37:47.199
a lot of people use, one of the.
797
00:37:47.239 --> 00:37:49.239
Largest security companies.
798
00:37:49.400 --> 00:37:52.159
So it's just interesting to see how wide, uh this
799
00:37:52.559 --> 00:37:54.639
kind of spread before it was before it was.
800
00:37:54.760 --> 00:37:55.360
You know killed.
801
00:37:56.840 --> 00:37:58.760
So I'm looking at the blog post on your side
802
00:37:58.760 --> 00:38:00.920
about this when I believe it is a shi hulud
803
00:38:01.119 --> 00:38:02.519
or is that.
804
00:38:03.000 --> 00:38:04.000
The one you're talking about?
805
00:38:04.079 --> 00:38:04.480
That's right?
806
00:38:04.559 --> 00:38:08.679
Yeah, okay, yeah, so the malware they called it that
807
00:38:08.719 --> 00:38:12.880
because of I think as a reference to the Dune.
808
00:38:14.960 --> 00:38:17.280
Oh that's right, Okay, I did hear that. I remember that.
809
00:38:18.159 --> 00:38:19.719
Yeah.
810
00:38:20.239 --> 00:38:21.880
Yeah, this was like the first line with that out
811
00:38:21.880 --> 00:38:25.480
there before it got probably like two days or so.
812
00:38:25.800 --> 00:38:27.639
It was probably like a couple of days it was
813
00:38:27.679 --> 00:38:30.079
out before it was caught. Report was fully shut.
814
00:38:29.920 --> 00:38:31.000
Down because it's a long time.
815
00:38:31.760 --> 00:38:32.800
Yeah, they kept.
816
00:38:33.039 --> 00:38:36.360
Changing the malware, like the actual payload, so that there
817
00:38:36.400 --> 00:38:38.400
was like six or seven different versions that we were
818
00:38:38.400 --> 00:38:42.599
able to identify across the different packages. So you know,
819
00:38:42.719 --> 00:38:44.360
they kept evolving it to make it a little bit
820
00:38:45.440 --> 00:38:50.360
better and fix different bugs in the worm. But the ultimately,
821
00:38:50.360 --> 00:38:53.320
you know, was kind of petered out I think due
822
00:38:53.320 --> 00:38:56.719
to kind of once NPM realized once you know, we
823
00:38:56.760 --> 00:38:58.599
had we and others had reported at ten PM. I
824
00:38:58.599 --> 00:39:05.079
think they have helped helped shred it down. So yeah,
825
00:39:05.079 --> 00:39:07.280
I mean, it's it's it's it's funny because like this
826
00:39:07.400 --> 00:39:10.599
concept of an NPM worm had been known about and
827
00:39:10.639 --> 00:39:13.480
talked about for several years before this happened. Like there'd
828
00:39:13.519 --> 00:39:16.840
been some some folks that had written posts about like, oh,
829
00:39:16.840 --> 00:39:18.239
I could make a worm and it would take over
830
00:39:18.280 --> 00:39:20.280
all of NPM and in a day. And you know,
831
00:39:20.280 --> 00:39:22.199
they just just blog posts on this that you can
832
00:39:22.199 --> 00:39:24.639
find find where people are you know, good, good, good
833
00:39:24.679 --> 00:39:27.360
folks like good maintainers were sort of speculating about this
834
00:39:27.400 --> 00:39:29.960
and writing about this, but we'd never actually seen it happen.
835
00:39:30.360 --> 00:39:32.920
So it seems like the attackers finally like realized that
836
00:39:33.000 --> 00:39:37.400
they should try to do that and and and you know,
837
00:39:37.400 --> 00:39:39.760
and it worked to some extent. I think that the
838
00:39:39.800 --> 00:39:41.440
issue with all these things though, is that they're so
839
00:39:41.559 --> 00:39:44.559
noisy that they end up being caught by the community
840
00:39:44.719 --> 00:39:47.840
or by security companies like Socket pretty quickly.
841
00:39:48.440 --> 00:39:48.800
Uh.
842
00:39:48.840 --> 00:39:51.880
And once once people are aware, then you know, we
843
00:39:51.920 --> 00:39:54.280
can put blocks in place for all of our customers
844
00:39:54.320 --> 00:39:57.079
to prevent them from bringing those in. And and then
845
00:39:57.880 --> 00:40:00.239
you know, once the registries alerted in there and if
846
00:40:00.400 --> 00:40:01.960
they're on top of things that can help shut these
847
00:40:01.960 --> 00:40:05.320
things down. So the real kind of reason we've been
848
00:40:05.440 --> 00:40:07.559
so lucky as a community that these things haven't been
849
00:40:07.599 --> 00:40:10.960
more deadly or more dangerous is that the attackers have
850
00:40:11.039 --> 00:40:14.800
been kind of noisy, i'd say, like loud and noisy,
851
00:40:14.840 --> 00:40:16.320
maybe a little clumsy.
852
00:40:15.920 --> 00:40:17.559
In the way that they've done these attacks.
853
00:40:17.840 --> 00:40:20.159
If you were smarter, you would actually be sneakier, and
854
00:40:20.199 --> 00:40:23.239
you would you know, try to last for several weeks
855
00:40:23.280 --> 00:40:26.440
or months without detection and then you know, and during
856
00:40:26.480 --> 00:40:29.840
that time kind of spread far and wide, whereas these
857
00:40:29.840 --> 00:40:31.920
things keep getting shut and shut down in a few hours.
858
00:40:32.360 --> 00:40:34.199
And so, yes, it still affects a lot of people.
859
00:40:34.239 --> 00:40:36.159
I mean, if you have a package with billions of
860
00:40:36.159 --> 00:40:38.320
downloads and it's live for four hours, that that's still.
861
00:40:38.159 --> 00:40:39.119
Going to hit a lot of people.
862
00:40:40.079 --> 00:40:42.639
But I think it would be much worse if it
863
00:40:42.679 --> 00:40:44.280
had been live for weeks, right, And that's kind of
864
00:40:44.280 --> 00:40:46.320
why I think they're failing to do right now today.
865
00:40:47.880 --> 00:40:50.599
Yeah, I can think of, you know, not necessarily the
866
00:40:50.679 --> 00:40:53.159
same thing, but in terms of data hacks or intrusions,
867
00:40:53.199 --> 00:40:55.519
you know that they find that have been around for
868
00:40:55.679 --> 00:40:58.280
months or you know, Microsoft, I thinks had a couple,
869
00:40:58.440 --> 00:41:00.719
and there's other ones that could to mine where they've
870
00:41:00.760 --> 00:41:02.719
been in there for months, you know, like, oh, good lord,
871
00:41:02.760 --> 00:41:04.239
they've had time to find everything.
872
00:41:04.760 --> 00:41:07.039
M yeah, totally.
873
00:41:08.079 --> 00:41:12.079
So I'm just thinking that sort of a you know,
874
00:41:12.119 --> 00:41:14.719
back to your two edged sword. It's like, Okay, you
875
00:41:14.760 --> 00:41:16.119
create a product of the great product.
876
00:41:16.199 --> 00:41:17.079
Everybody's using it.
877
00:41:17.159 --> 00:41:21.639
Now your responsibility increases with that too, to to you know,
878
00:41:21.760 --> 00:41:25.159
to protect your users, because I think I think of
879
00:41:25.159 --> 00:41:28.280
a lot of us assume oh MPM. Everybody's pushing packages
880
00:41:28.239 --> 00:41:31.599
the MPM. It must be safe. They're not any problems, right.
881
00:41:32.840 --> 00:41:37.960
But you were talking about the uh, the blog posts
882
00:41:37.960 --> 00:41:40.039
that you know, people had written, say hey, I wonder
883
00:41:40.159 --> 00:41:42.280
you know, I wanted to write a worm, I could
884
00:41:42.360 --> 00:41:45.239
do this and this. So were those in retrospect that
885
00:41:45.480 --> 00:41:47.719
you know, people noticed those blog posts that people had
886
00:41:47.760 --> 00:41:50.039
been writing, or was that you know, people had been
887
00:41:52.400 --> 00:41:54.679
somehow bad guy just read it, you know, saw those
888
00:41:54.719 --> 00:41:56.599
and said hey, let's try it. But was it in
889
00:41:56.599 --> 00:41:58.800
retrospect that people said, oh, yeah, somebody had been writing
890
00:41:58.840 --> 00:42:00.559
about this for a while, we should have done something
891
00:42:00.559 --> 00:42:01.000
about it.
892
00:42:03.519 --> 00:42:07.519
I think that likely the attackers probably just independently thought
893
00:42:07.559 --> 00:42:10.599
of it. I mean, so many I don't know, I mean.
894
00:42:10.519 --> 00:42:12.880
Who knows, but I feel like I feel like this
895
00:42:13.000 --> 00:42:15.920
is the kind of thing that if you have the
896
00:42:16.000 --> 00:42:19.039
attacker mindset or the security mindset that you know, you
897
00:42:19.079 --> 00:42:21.199
think of these things just for fun all the time,
898
00:42:21.320 --> 00:42:21.960
like you.
899
00:42:21.920 --> 00:42:24.599
Know, I mean, like hackers are.
900
00:42:25.840 --> 00:42:29.119
You know, it's it's obviously that all the things we've
901
00:42:29.119 --> 00:42:31.880
been talking about in this podcast are all bad in
902
00:42:31.920 --> 00:42:34.840
the sense that they're all you know, stealing data and
903
00:42:34.880 --> 00:42:38.440
it's all it's all crimes. But there's another angle by which,
904
00:42:38.719 --> 00:42:41.880
you know, hacking more generally is is kind of this
905
00:42:42.320 --> 00:42:45.920
creative endeavor, you know, where you're trying to find a
906
00:42:46.000 --> 00:42:48.800
gap between the written rules of a system and the
907
00:42:48.840 --> 00:42:52.320
actual rules of a system. So the written rules of
908
00:42:52.360 --> 00:42:54.559
the system say, you know, like yeah, n PM's a
909
00:42:54.559 --> 00:42:57.519
place you publish code, and you know it's you know,
910
00:42:59.119 --> 00:43:02.239
you know, legitimate, only legitimate people can publish code there,
911
00:43:02.280 --> 00:43:03.880
and you know therefore you can.
912
00:43:03.840 --> 00:43:04.639
Kind of rely on it.
913
00:43:04.679 --> 00:43:06.679
But the actual rules of the system are you know,
914
00:43:06.880 --> 00:43:09.000
there's any ways to get access to packages that you
915
00:43:09.039 --> 00:43:11.760
shouldn't have access to, and and kind of the attackers
916
00:43:11.800 --> 00:43:14.639
and these hackers are good at seeing those gaps, and
917
00:43:14.679 --> 00:43:18.199
that's that's really what hacking is is seeing these these
918
00:43:18.239 --> 00:43:21.000
gaps or these differences between the way the way the
919
00:43:21.000 --> 00:43:21.960
system is supposed to.
920
00:43:21.880 --> 00:43:23.800
Work, the way that works on paper, and the way
921
00:43:23.800 --> 00:43:24.679
that it actually works.
922
00:43:25.320 --> 00:43:27.559
And so I think any kind of creative mind or
923
00:43:27.719 --> 00:43:30.039
you know, good hacker mind could could have thought of
924
00:43:30.079 --> 00:43:33.079
something like this, this worm, and it's just a matter
925
00:43:33.119 --> 00:43:34.960
of you know, who's going to think of it and
926
00:43:34.960 --> 00:43:35.440
who's going.
927
00:43:35.360 --> 00:43:37.599
To do it. So that's why there's als be more attacks.
928
00:43:37.639 --> 00:43:40.639
I mean, that's why security is interesting really, to be
929
00:43:40.679 --> 00:43:44.760
honest with you, Like, I love it because it's always changing.
930
00:43:44.760 --> 00:43:47.639
You have you have an adversary that's evolving and changing.
931
00:43:47.800 --> 00:43:50.800
You know, if you learn like architecture or you learn
932
00:43:51.320 --> 00:43:53.599
you know, pick your peak, your whatever field that you pick.
933
00:43:53.960 --> 00:43:57.000
Like, you know, the laws of gravity don't change.
934
00:43:57.000 --> 00:43:58.840
So if you know how to build a bridge today,
935
00:43:58.920 --> 00:44:00.760
you know you know how to build a one hundred
936
00:44:00.840 --> 00:44:03.880
years from now. Like, it's the same constraints, gravity is
937
00:44:03.920 --> 00:44:07.519
the same physics, it's basically the same, right, Whereas in
938
00:44:07.519 --> 00:44:10.800
security that's not true. You have this sort of intelligent
939
00:44:10.920 --> 00:44:14.119
opponent who is adapting to what you do. And so
940
00:44:14.199 --> 00:44:16.760
it's a dynamic system. So it's kind of exciting in
941
00:44:16.800 --> 00:44:17.079
that way.
942
00:44:17.800 --> 00:44:20.119
Yeah, the term I've always used as a cat and
943
00:44:20.159 --> 00:44:24.880
mouse game, right, yep, Yeah, you know you mentioned that
944
00:44:24.920 --> 00:44:28.320
the old blog posted it brought to mind about I
945
00:44:28.360 --> 00:44:30.880
think it was twelve years ago. I was working on
946
00:44:30.960 --> 00:44:36.320
Drouple and maintaining some Drouple sites for a for an organization,
947
00:44:36.800 --> 00:44:39.719
and there was a bug that came out that got
948
00:44:39.760 --> 00:44:41.679
put in there and it was referred to as Drupal
949
00:44:41.719 --> 00:44:46.280
gedding because it was so bad that if your site
950
00:44:46.280 --> 00:44:48.800
got infected, you basically needed to start over with your
951
00:44:48.840 --> 00:44:51.599
database and somehow, you know, import it from somewhere else.
952
00:44:52.480 --> 00:44:58.840
And somebody went back in the in the issues history
953
00:44:58.840 --> 00:45:02.119
for the particular module or a piece of code that
954
00:45:02.199 --> 00:45:04.119
got it and found where somebody had filed the bug
955
00:45:04.159 --> 00:45:06.159
report that said hey, and it all had to do
956
00:45:06.280 --> 00:45:08.039
with an array that was passed in and how I
957
00:45:08.039 --> 00:45:09.920
had handled reading values out of an array. It was
958
00:45:09.960 --> 00:45:12.880
something super simple, just a couple of characters, and they
959
00:45:12.880 --> 00:45:16.480
had said, Okay, this issue is here. If somebody figures
960
00:45:16.519 --> 00:45:18.960
this out, we could be in some serious trouble. And
961
00:45:19.079 --> 00:45:21.719
somebody figured it out and nobody fixed it and ended
962
00:45:21.800 --> 00:45:25.599
up being just a huge, huge thudge thing. But you know,
963
00:45:25.639 --> 00:45:27.719
I was just thinking in terms of bug happens, somebody
964
00:45:27.760 --> 00:45:32.000
goes back, Oh yeah, somebody raised US flag a while ago. Right, yeah,
965
00:45:32.079 --> 00:45:35.360
I mean that hindsight is twenty twenty right in anything in.
966
00:45:35.239 --> 00:45:37.119
That in that sense, I mean, I guess yeah, I
967
00:45:37.119 --> 00:45:39.280
mean NPM has known about this risk for a while,
968
00:45:39.280 --> 00:45:40.960
but it's it's difficult. I mean, I don't want to
969
00:45:41.199 --> 00:45:43.320
keep all the blame on the on them.
970
00:45:44.119 --> 00:45:46.000
I do. I do think that there's definitely some blame.
971
00:45:46.239 --> 00:45:47.679
But like like with all things, there's blame to go
972
00:45:47.679 --> 00:45:50.400
around in kind of every every points of different places, right,
973
00:45:50.480 --> 00:45:53.239
you know, different people were at fault. But like, but
974
00:45:53.280 --> 00:45:56.320
it's a hard problem because you know they're balancing like
975
00:45:56.480 --> 00:46:00.480
usability of the package manager and you know, wanting to
976
00:46:00.519 --> 00:46:06.159
make publish workflows flexible for people like I mean, you know,
977
00:46:06.480 --> 00:46:08.119
it's useful to have to be able to have a
978
00:46:08.159 --> 00:46:10.000
get a action that can publish new versions of your
979
00:46:10.000 --> 00:46:13.760
package to ten PM, you know when without having to.
980
00:46:14.320 --> 00:46:15.440
Run that locally on your system.
981
00:46:15.440 --> 00:46:17.480
And if you try to do like a two FA there,
982
00:46:17.639 --> 00:46:20.400
you know, now you can't have automation. You can't have
983
00:46:20.519 --> 00:46:24.320
you know, uh, you know, you can't automatically do releases
984
00:46:24.360 --> 00:46:27.199
when you know when certain you know, you know, when
985
00:46:27.199 --> 00:46:29.199
when commits land and stuff like that. So a lot
986
00:46:29.199 --> 00:46:31.760
of like the maintainer workflows would be affected by by
987
00:46:31.960 --> 00:46:34.159
like a sort of a night you've change like that.
988
00:46:34.199 --> 00:46:36.599
So that and then there actually already has been pushed
989
00:46:36.599 --> 00:46:38.400
back to some So the NTEAM has actually done some
990
00:46:38.480 --> 00:46:39.960
things in the in the last couple of weeks to
991
00:46:40.000 --> 00:46:43.199
address these attacks. They made some security changes, but even
992
00:46:43.239 --> 00:46:47.199
those modest changes that they're making have gotten like a
993
00:46:47.239 --> 00:46:49.199
lot of pushback from maintainers who don't want to deal
994
00:46:49.199 --> 00:46:51.360
with you know, deal with the extra steps.
995
00:46:51.360 --> 00:46:53.239
And I don't blame them, I mean, it's it's annoying.
996
00:46:53.599 --> 00:46:57.559
It's just this direct trade off of security and usability,
997
00:46:57.719 --> 00:47:00.400
which we always see.
998
00:47:00.760 --> 00:47:03.000
All right, So we're getting close on times how we
999
00:47:03.079 --> 00:47:05.639
got a couple more recent incidents.
1000
00:47:05.760 --> 00:47:06.960
We made it through all of them, the ones that
1001
00:47:07.000 --> 00:47:09.039
we want it through all of them. Well, there's always more.
1002
00:47:09.079 --> 00:47:11.000
I mean, I can tell you there's probably like there's
1003
00:47:11.039 --> 00:47:12.480
we find stuff every day, Like I could tell you
1004
00:47:12.519 --> 00:47:14.360
about something we found probably an hour ago, like we
1005
00:47:14.360 --> 00:47:17.039
were always blogging about this stuff on Soccer contpt on
1006
00:47:17.039 --> 00:47:20.960
our blog. So but just in terms of like the
1007
00:47:20.960 --> 00:47:24.119
the sort of really big ones. Over the last little while,
1008
00:47:24.440 --> 00:47:26.360
I think I think we covered all the main ones.
1009
00:47:26.480 --> 00:47:29.039
I don't want to get into like every little piece
1010
00:47:29.039 --> 00:47:31.000
of malware. But maybe that is itself interesting to you.
1011
00:47:31.039 --> 00:47:33.840
I don't know, cause, like you know, just the idea
1012
00:47:33.880 --> 00:47:36.280
that this stuff is actually not it's not just when
1013
00:47:36.280 --> 00:47:37.639
you see it in the news that it's happening.
1014
00:47:37.639 --> 00:47:40.679
Like there is this constant.
1015
00:47:39.800 --> 00:47:45.360
Low level burn of daily malware, like dozens and sometimes
1016
00:47:45.480 --> 00:47:49.679
hundreds of malware packages being pushed every day to these registries,
1017
00:47:50.000 --> 00:47:52.119
and we're always out there looking for this stuff, trying
1018
00:47:52.159 --> 00:47:57.199
to get it taken down, trying to protect people. So yeah,
1019
00:47:57.239 --> 00:47:59.360
shout out to the to the socket Threat team for
1020
00:47:59.400 --> 00:48:01.360
doing such a great job like looking for these hunting
1021
00:48:01.400 --> 00:48:01.920
for these things.
1022
00:48:01.920 --> 00:48:04.760
And well, yeah, let's segue into that, since you've given
1023
00:48:04.800 --> 00:48:07.599
us all this information, we'll do some shameless plugging here.
1024
00:48:08.239 --> 00:48:12.920
So why don't to talk about socket dot dev not
1025
00:48:13.039 --> 00:48:18.119
io and look at tell us just about what you
1026
00:48:18.159 --> 00:48:20.920
do big picture, and then some of the products that
1027
00:48:20.960 --> 00:48:24.199
you offer to help with help.
1028
00:48:24.000 --> 00:48:26.159
You avoid these issues that we just talked about.
1029
00:48:26.639 --> 00:48:29.719
Yeah, so our whole mission is to help developers protect
1030
00:48:29.719 --> 00:48:31.679
themselves from exactly the kind of stuff that we've been
1031
00:48:31.679 --> 00:48:35.599
talking about. So we started in twenty twenty. We've been
1032
00:48:35.719 --> 00:48:38.800
working at this for a while. Today we find around
1033
00:48:38.920 --> 00:48:43.840
a thousand malicious open source packages every single week across NPM,
1034
00:48:44.199 --> 00:48:48.719
Python and about eight other ecosystems that we track. So
1035
00:48:49.760 --> 00:48:53.679
we're just trying to help developers stay safe. And there's
1036
00:48:53.679 --> 00:48:55.960
a couple of ways that developers can use socket to
1037
00:48:56.000 --> 00:48:59.559
stay safe. I'll mention actually the newest one, which is
1038
00:48:59.599 --> 00:49:02.079
I want to actually very excited about, called Socket Firewall,
1039
00:49:02.639 --> 00:49:04.880
and this is a free product that anyone can use.
1040
00:49:05.559 --> 00:49:07.960
It's really easy to get started with it. You just
1041
00:49:08.199 --> 00:49:13.440
NPM install SFW, which stands for Socket Firewall or stands
1042
00:49:13.440 --> 00:49:15.800
for Safer Work I guess depending on your.
1043
00:49:18.159 --> 00:49:20.039
You're the way you look at it. But once you
1044
00:49:20.119 --> 00:49:22.079
install SFW, all you have to do is.
1045
00:49:22.280 --> 00:49:26.480
Run your normal package manager commands, but you just prefix
1046
00:49:26.519 --> 00:49:29.599
it with SFW, So for instance, you'd run s FW
1047
00:49:29.840 --> 00:49:37.360
NPM install, FOU or SFW NPM update or SFW PNPM install.
1048
00:49:37.159 --> 00:49:38.039
Or yarn ad.
1049
00:49:38.239 --> 00:49:42.239
It works with everything, works with Rust and Python and
1050
00:49:42.280 --> 00:49:45.360
on all the jobscript package managers. And what will happen
1051
00:49:45.599 --> 00:49:48.880
is everything will install like normal, except for if you're
1052
00:49:48.880 --> 00:49:51.880
about to install something that's been compromised. So it's really
1053
00:49:51.960 --> 00:49:54.480
like a filter on the packages that come in. And
1054
00:49:54.519 --> 00:49:57.079
if we've identified that there's malware in any of those
1055
00:49:57.079 --> 00:50:00.280
packages or threats that you know could affect you, just
1056
00:50:00.920 --> 00:50:02.920
basically prevent them from coming in and we'll print a
1057
00:50:02.920 --> 00:50:05.519
message telling you this package was blocked for blah blah
1058
00:50:05.519 --> 00:50:06.199
blah reason.
1059
00:50:06.599 --> 00:50:08.599
So it's very simple to use. It's totally free.
1060
00:50:09.400 --> 00:50:11.159
People can just install it and start using it, and
1061
00:50:11.159 --> 00:50:13.199
we're just giving it away to the community to help
1062
00:50:13.239 --> 00:50:14.159
people stay protected.
1063
00:50:14.719 --> 00:50:17.599
Oh okay, yeah, here, it's not listed on your products,
1064
00:50:17.599 --> 00:50:18.719
but I see the blurb at.
1065
00:50:18.639 --> 00:50:19.760
The top of the page there.
1066
00:50:20.079 --> 00:50:22.639
Yeah. We just announced it literally last week, so it's
1067
00:50:23.199 --> 00:50:23.760
it's exciting.
1068
00:50:23.760 --> 00:50:25.000
I mean, we we are gonna we do have a
1069
00:50:25.000 --> 00:50:26.760
paid version of it for people that want to roll
1070
00:50:26.800 --> 00:50:28.679
it out at their companies. Like you can deploy it
1071
00:50:28.679 --> 00:50:31.760
in a in a server fashion, so instead of it
1072
00:50:32.119 --> 00:50:35.320
being a wrapper around the package manager command, you can
1073
00:50:35.320 --> 00:50:37.760
actually deploy it as like a server and then you
1074
00:50:37.800 --> 00:50:44.039
can point your your your different like package managers to
1075
00:50:44.199 --> 00:50:47.719
that server as a as your registry, so you can
1076
00:50:47.800 --> 00:50:50.559
kind of set the registry to be the socket.
1077
00:50:50.280 --> 00:50:53.599
Firewall, and then it'll like work in that fashion.
1078
00:50:53.239 --> 00:50:56.599
So so folks can look into that if they're interested
1079
00:50:56.599 --> 00:50:58.360
in like using another company. But the free version is
1080
00:50:58.360 --> 00:51:01.519
really powerful and like does everything that folks need to
1081
00:51:01.559 --> 00:51:04.960
do to protect themselves today. And I recommend that people
1082
00:51:04.960 --> 00:51:07.440
actually alias it so you can alias it in your
1083
00:51:07.480 --> 00:51:10.519
shell so that when you type NPM, it just runs
1084
00:51:10.559 --> 00:51:12.719
a s FWNPM behind the scenes and so you don't
1085
00:51:12.719 --> 00:51:14.559
have to remember anymore. You just put that in place
1086
00:51:14.639 --> 00:51:16.360
once and then you just protected forever.
1087
00:51:18.679 --> 00:51:22.800
Awesome. Yeah, you can see the details on Socca dot dev.
1088
00:51:24.039 --> 00:51:26.280
Yeah, and it's really it's really cool. Yeah, people should
1089
00:51:26.320 --> 00:51:27.719
definitely check it out. Sure feedback.
1090
00:51:27.800 --> 00:51:29.679
We tried to make it work really really well, and
1091
00:51:30.039 --> 00:51:38.119
it works with NPM, YARN, PNPM, PIP, cargo.
1092
00:51:39.079 --> 00:51:40.079
And UV.
1093
00:51:40.920 --> 00:51:42.840
There's a bunch of different package managers that works with
1094
00:51:43.079 --> 00:51:46.800
so cool. Yeah, and then the other thing people can
1095
00:51:46.840 --> 00:51:48.960
do is our main product, Like this is the main
1096
00:51:49.000 --> 00:51:51.559
thing we've been doing for like you know, years now.
1097
00:51:51.559 --> 00:51:52.719
This is our bread and butter is we have a
1098
00:51:52.760 --> 00:51:55.639
GitHub app or a CLI tool that you can use
1099
00:51:56.000 --> 00:51:58.400
to scan your projects and protect your projects.
1100
00:51:58.639 --> 00:52:00.000
So if you're on GitHub, it's really easy.
1101
00:52:00.039 --> 00:52:02.559
You just go to socker dot dev, you hit install
1102
00:52:02.719 --> 00:52:05.960
socket and it'll give you like two clicks. You'll just
1103
00:52:06.000 --> 00:52:07.239
ask you if you want to install this on your
1104
00:52:07.280 --> 00:52:10.599
gi hub organization. And once you do that, then all
1105
00:52:10.639 --> 00:52:14.360
your pull requests will automatically be protected. So if we
1106
00:52:14.440 --> 00:52:18.280
see you about to upgrade to a bad package, we'll
1107
00:52:18.360 --> 00:52:18.880
be able.
1108
00:52:18.679 --> 00:52:21.280
To put a comment on that poll request and.
1109
00:52:21.280 --> 00:52:24.079
Tell you why this package is risky or why you
1110
00:52:24.079 --> 00:52:26.320
shouldn't use it, or what would be a better alternative
1111
00:52:26.320 --> 00:52:29.320
and all that kind of information. So, and it's all configurable,
1112
00:52:29.320 --> 00:52:31.199
so you can go in and sort of tell it
1113
00:52:31.480 --> 00:52:34.559
I really care about, you know, preventing deprecated packages from
1114
00:52:34.559 --> 00:52:37.639
getting into our project, and then it'll warn you if
1115
00:52:37.679 --> 00:52:41.719
you're bringing in a new package that's deprecated, or you
1116
00:52:41.719 --> 00:52:44.320
could say, I really want to prevent unmaintained packages from
1117
00:52:44.320 --> 00:52:46.679
being brought into our project. And then we'll be able
1118
00:52:46.679 --> 00:52:48.840
to tell you when someone on your team is bringing
1119
00:52:48.880 --> 00:52:50.719
in a package that hasn't had an update in five years.
1120
00:52:50.719 --> 00:52:52.079
You know, we'll be able to print a little comment
1121
00:52:52.119 --> 00:52:54.159
and say, hey, this package hasn't an update in five years.
1122
00:52:54.280 --> 00:52:56.360
Are you sure you want to use it? And it's
1123
00:52:56.519 --> 00:52:58.199
up to you. You can block in that case, or
1124
00:52:58.239 --> 00:53:01.159
you can just warn and let them, let them decide
1125
00:53:01.199 --> 00:53:02.199
how they want to handle it.
1126
00:53:02.199 --> 00:53:04.320
It's really all up to you. So it's pretty.
1127
00:53:04.039 --> 00:53:09.119
Powerful awesome all right.
1128
00:53:09.639 --> 00:53:13.440
So before we get into picks, obviously we know about
1129
00:53:13.480 --> 00:53:14.280
soccer dot.
1130
00:53:14.159 --> 00:53:16.960
Dev and your blog on there.
1131
00:53:17.880 --> 00:53:21.039
Where else can people hear what you have to say
1132
00:53:21.119 --> 00:53:22.719
or give you money or anything like that?
1133
00:53:24.559 --> 00:53:26.920
Uh yeah, just check out check out soccer dot dev.
1134
00:53:27.440 --> 00:53:33.239
I'm personally on x and the different social media platforms
1135
00:53:33.639 --> 00:53:37.800
masted on, loose Sky all that stuff. My name is
1136
00:53:37.840 --> 00:53:40.400
just Faross F E R O S. S. And then
1137
00:53:40.480 --> 00:53:45.800
socket socket is is on there too under socket security. Yeah,
1138
00:53:45.840 --> 00:53:48.519
and I mean also just shout out to or let
1139
00:53:48.519 --> 00:53:51.039
people know like that. If anyone is interested in this
1140
00:53:51.039 --> 00:53:54.400
stuff and wants to talk about security or you know,
1141
00:53:55.159 --> 00:53:58.159
uh how to how to stay safe while using open source,
1142
00:53:58.320 --> 00:54:00.199
just hit me up. I'm happy to like to talk
1143
00:54:00.199 --> 00:54:02.719
about this with people, even separate from like becoming a
1144
00:54:02.719 --> 00:54:06.840
soccer customer. I'm I also have been a lecturer and
1145
00:54:06.880 --> 00:54:08.840
like a teacher in the past, so I love talking
1146
00:54:08.880 --> 00:54:13.840
about this stuff. So if if anyone listening wants to
1147
00:54:15.280 --> 00:54:19.480
kind of learn more about like what they can do
1148
00:54:19.559 --> 00:54:22.039
to protect themselves from these types of attacks, or just
1149
00:54:22.079 --> 00:54:24.320
wants to like hear more about the latest stuff that
1150
00:54:24.360 --> 00:54:27.280
we're seeing that I'm seeing. Let me know, I'm happy
1151
00:54:27.280 --> 00:54:30.320
to kind of consider doing a talk at your company
1152
00:54:30.800 --> 00:54:33.239
to your developer team and just talk about these issues,
1153
00:54:34.079 --> 00:54:35.920
not like a product pitch or anything, but just talking
1154
00:54:35.920 --> 00:54:38.400
about supply chain security. I like to do that from
1155
00:54:38.440 --> 00:54:40.880
time to time. So if you think your your company
1156
00:54:40.880 --> 00:54:43.199
would be interested, let me know, I'm happy to help.
1157
00:54:45.360 --> 00:54:49.599
All right, Well, I don't I wouldn't have any problem
1158
00:54:49.679 --> 00:54:52.800
with shamelessly plugging your company considering all the information you're
1159
00:54:52.800 --> 00:54:53.400
putting out there.
1160
00:54:53.440 --> 00:54:57.639
So so thanks. Yeah, we're trying advertising, we're.
1161
00:54:57.480 --> 00:54:58.320
Trying to do the right thing.
1162
00:54:58.320 --> 00:54:59.800
And like you know, all of our data is public
1163
00:54:59.800 --> 00:55:01.719
to you know, you can you can go to a
1164
00:55:01.760 --> 00:55:04.280
socket and search for any package and just we'll give
1165
00:55:04.320 --> 00:55:06.119
all the data back to you, so you'll see all
1166
00:55:06.119 --> 00:55:08.880
of our scores and all the findings and whether it's
1167
00:55:08.920 --> 00:55:11.960
safe and different risks and quality issues and it's all open.
1168
00:55:12.079 --> 00:55:15.159
So yeah, we're just trying to trying to be useful.
1169
00:55:16.639 --> 00:55:19.800
All righty, So with that we will move into picks.
1170
00:55:19.840 --> 00:55:21.480
Picks are part of the show where we get to
1171
00:55:21.519 --> 00:55:24.119
talk about whatever we want to within reason of course,
1172
00:55:24.199 --> 00:55:28.199
you know, books, movies, games, Chuck likes board games. Uh,
1173
00:55:28.639 --> 00:55:30.960
you know, tech could be non tech, could be whatever.
1174
00:55:32.039 --> 00:55:33.760
I always like to say. I'm the high point of
1175
00:55:33.840 --> 00:55:38.320
these with my dad jokes of the week. So we'll
1176
00:55:38.360 --> 00:55:38.800
start with.
1177
00:55:38.719 --> 00:55:41.800
That and then let for us save the best for last,
1178
00:55:41.840 --> 00:55:45.679
well almost the best for last. So anyway, a Roman
1179
00:55:46.239 --> 00:55:50.239
walks into a bar, holds up two fingers and says,
1180
00:55:50.800 --> 00:55:52.360
I'll have five beers, please.
1181
00:55:56.079 --> 00:55:59.920
The numerals. If you're wondering, yes, actually thanks.
1182
00:56:00.000 --> 00:56:06.840
A few people have said that to me an observation.
1183
00:56:07.000 --> 00:56:09.559
Humans are the only species that will cut down trees,
1184
00:56:10.280 --> 00:56:12.639
make paper out of them, and then write save the
1185
00:56:12.679 --> 00:56:20.960
trees on it. And then the other night my wife said, honey,
1186
00:56:21.000 --> 00:56:23.320
why is there a strange baby in the crib? I said,
1187
00:56:23.719 --> 00:56:26.519
you told me to change the baby.
1188
00:56:28.079 --> 00:56:29.840
Thank you. Those are the dad jokes of the week.
1189
00:56:31.320 --> 00:56:32.920
All right for us? What do you have for us?
1190
00:56:35.800 --> 00:56:39.800
I have a few picks. One is a book.
1191
00:56:39.519 --> 00:56:43.960
I read picked up last weekend called The Power of Now,
1192
00:56:44.360 --> 00:56:45.119
which is interesting.
1193
00:56:45.360 --> 00:56:46.719
It's about kind.
1194
00:56:46.519 --> 00:56:51.280
Of the idea of like living in the moment, being present,
1195
00:56:51.920 --> 00:56:55.559
and it's kind of like a spiritual kind of a book.
1196
00:56:55.599 --> 00:56:58.280
But I thought it was it was very interesting it's
1197
00:56:58.280 --> 00:57:00.920
it's it's really a simple idea that, like, you know,
1198
00:57:01.400 --> 00:57:06.159
your entire life is experienced in the moment, but yet
1199
00:57:06.199 --> 00:57:07.960
we spend so much time thinking of the past or
1200
00:57:08.000 --> 00:57:10.639
thinking of the future. And I'm someone who spends a
1201
00:57:10.679 --> 00:57:12.480
lot of time thinking more about the future than the past.
1202
00:57:12.519 --> 00:57:14.559
I don't tend to dwell on things, but I do.
1203
00:57:14.840 --> 00:57:17.800
I do worry a lot about, like, you know, what
1204
00:57:17.840 --> 00:57:19.880
I want to do, what I want to accomplish next,
1205
00:57:19.920 --> 00:57:21.920
Like what am I working on? I like to work
1206
00:57:21.920 --> 00:57:24.360
a lot, and and so I just thought it was
1207
00:57:24.440 --> 00:57:27.599
very eye opening kind of reminder that, you know, it's
1208
00:57:27.639 --> 00:57:29.880
not it's not a good idea to live your entire
1209
00:57:29.880 --> 00:57:33.960
life just thinking about you know what's to come, but
1210
00:57:34.079 --> 00:57:36.760
like actually take a breath and appreciate, you know, how
1211
00:57:36.840 --> 00:57:39.679
how awesome the current moment is. And and so anyway,
1212
00:57:39.840 --> 00:57:42.079
I recommend folks look at that if if they that
1213
00:57:42.159 --> 00:57:44.159
resonated at all.
1214
00:57:44.519 --> 00:57:46.519
And my other pick will be just a.
1215
00:57:46.440 --> 00:57:50.599
Classic book I always go back to you every few years,
1216
00:57:50.679 --> 00:57:54.639
which is the Enders game series. The Enders game series
1217
00:57:54.679 --> 00:57:58.519
is excellent, and even the prequels are are just amazing.
1218
00:57:59.719 --> 00:58:05.119
So uh, I've heard about those, Yeah, and what kind
1219
00:58:05.119 --> 00:58:05.920
of book is that is that?
1220
00:58:06.039 --> 00:58:06.760
Is it like sci fi?
1221
00:58:06.920 --> 00:58:09.159
Is it? Yeah?
1222
00:58:09.239 --> 00:58:10.159
What is it?
1223
00:58:10.159 --> 00:58:11.239
It's sci fi? It's sci fi.
1224
00:58:11.320 --> 00:58:14.599
Yeah, so it's it's uh, you know, it's about a
1225
00:58:14.599 --> 00:58:16.039
lot of people at bread enders game, I think, but
1226
00:58:16.079 --> 00:58:18.960
if they haven't. It's basically about a kid who has
1227
00:58:19.000 --> 00:58:21.760
to go into space and learn how to become like
1228
00:58:21.800 --> 00:58:28.679
an insanely competent commander of fleets so he can defend
1229
00:58:28.760 --> 00:58:33.000
Earth from an alien invasion that's coming. Uh. And the
1230
00:58:33.039 --> 00:58:36.119
series is like kind of it goes in the future,
1231
00:58:36.119 --> 00:58:38.519
it goes into like a really different direction, and it
1232
00:58:38.519 --> 00:58:40.840
goes like two thousand years into the future and follows
1233
00:58:40.960 --> 00:58:42.920
this this this is the kid as he kind of
1234
00:58:42.920 --> 00:58:47.559
travels through the Solar System and encounters like different new
1235
00:58:47.599 --> 00:58:48.440
alien species.
1236
00:58:48.639 --> 00:58:51.119
Uh. And then the prequels are about kind of the.
1237
00:58:51.119 --> 00:58:54.760
Earlier attacks that the aliens did on Earth and the
1238
00:58:54.840 --> 00:58:56.760
kind of the people, the humans that kind of fought them.
1239
00:58:56.800 --> 00:58:59.079
And it's just I just like the writing style a lot.
1240
00:58:59.079 --> 00:59:03.719
I think it's really media and really simple, clear, crisp,
1241
00:59:03.880 --> 00:59:06.159
like fast moving language. It's just a really a joy
1242
00:59:06.199 --> 00:59:08.519
to read it. It's like a really fun, fun read.
1243
00:59:10.920 --> 00:59:12.559
Awesome is that it?
1244
00:59:13.840 --> 00:59:16.639
Yeah? I'm supposed to more than two picks. No, no, nope.
1245
00:59:16.679 --> 00:59:18.880
Some people just have one. Some people are like, I
1246
00:59:18.880 --> 00:59:21.159
don't have any, so I'll shut it out.
1247
00:59:21.760 --> 00:59:23.599
I'll add a final one, which is just a reminder
1248
00:59:23.639 --> 00:59:27.119
for people to to NPM install s FW and check
1249
00:59:27.119 --> 00:59:30.199
out Socket Firewall, which we recently released. And please send
1250
00:59:30.239 --> 00:59:32.320
us your feedback if you run into any problems or
1251
00:59:32.559 --> 00:59:33.920
where you think it's awesome.
1252
00:59:34.079 --> 00:59:35.960
Or you you you know.
1253
00:59:36.000 --> 00:59:38.119
Use it at work or anything like that, let us know.
1254
00:59:38.159 --> 00:59:40.119
It would be awesome to get people's feedback on that.
1255
00:59:41.119 --> 00:59:41.440
Cool.
1256
00:59:42.519 --> 00:59:45.280
All righty well, thank you for coming back for us
1257
00:59:45.360 --> 00:59:48.239
and telling us about what's been going on in the
1258
00:59:48.320 --> 00:59:50.719
web safety world, or in some cases, the lack of
1259
00:59:50.800 --> 00:59:55.960
web safety. And thank you for listening to JavaScript Jabber
1260
00:59:56.559 --> 00:59:58.000
and we will talk to you next time.