nah. over 100k sites ignored dependency risks, even after the original owners warned them this exact thing would happen.
the real story is 100k sites not being run appropriately.
this post was submitted on 26 Jun 2024
908 points (98.9% liked)
Technology
59675 readers
4666 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
The hackers just engaged in a little bit of technical debt collecting ;)
I'm stealing this phrase
Please do! I’ve been trying to make it stick for almost a decade!
That's not how systemic problems work.
This is probably one of the most security ignorant takes on here.
People will ALWAYS fuck up. The world we craft for ourselves must take the "human factor" into account, otherwise we amplify the consequences of what are predictable outcomes. And ignoring predictable outcomes to take some high ground doesn't cary far.
The majority of industries that actually have immediate and potentially fatal consequences do exactly this, and have been for more than a generation now.
Damn near everything you interact with on a regular basis has been designed at some point in time with human psychology in mind. Built on the shoulders of decades of research and study results, that have matured to the point of becoming "standard practices".
load more comments
(10 replies)
One place I worked at recently was still using Node version 8. Running npm install would give me a mini heart attack... Like 400+ critical vulnerabilities, it was several thousand vulnerabilities all around.
Running
npm installwould give me a mini heart attack
It should; but more because it installs things right off the net with no validation. Consistency of code product is not the only thing you're tossing.
How else would you get LPAD ? Expect me to write 2 lines of code when I could just import a 100 Mb library to do it for me?
load more comments
(1 replies)
load more comments
(2 replies)
the real story is 100k sites not being run appropriately.
Same as it ever was. Same as it ever was. Same as it ever was.
Yeah this is just capitalistic business in general. Don’t do anything proactive if it might reduce the bottom line in the short term. Blame others and beg for help when you weren’t proactive. Succeed singularly, fail collectively
load more comments
(2 replies)
load more comments
(1 replies)
100k sites ignored dependency risks
JS: typing systems are boring, warnings are boring, security is boring.
load more comments
(5 replies)
load more comments
(6 replies)
This is why ublock origin is an essential security tool.
What rules can we add that solve this problem? (I've tried DDG but didn't find any results)
This one is already in the default uBlock filters - Badware risks
I also strongly suggest adding https://big.oisd.nl/ as a filter list. It's a large and well maintained domain blocklist (sourced from combining lots of other blocklists) that usually adds lots of these sorts of domains quickly and has very few false positives.
If you want to take it even further, check out the Pro list and Thread Intelligence Feeds list here https://github.com/hagezi/dns-blocklists
These can all be added to a pihole too if you use one.
load more comments
(1 replies)
load more comments
(1 replies)
My favourite part is that the developers that currently own it said:
Someone has maliciously defamed us. We have no supply chain risks because all content is statically cached
https://github.com/polyfillpolyfill/polyfill-service/issues/2890#issuecomment-2191461961
Completely missing the point that they are the supply chain risk, and the fact that malicious code was already detected in their system (to the point where Google started blocking ads for sites that loaded polyfill .io scripts.
We don't even know who they are - the repo is owned by an anonymous account called "polyfillpolyfill", and that comment comes from another anonymous account "polyfillcust".
I'm not into JS stuff, but when I read that google is blocking ads, shit must be flowing in gargantuan amounts...
Reposting my comment from Github:
A good reminder to be extremely careful loading scripts from a third-party CDN unless you trust the owner 100% (and even then, ownership can change over time, as shown here). You're essentially giving the maintainer of that CDN full control of your site. Ideally, never do it, as it's just begging for a supply chain attack. If you need polyfills for older browsers, host the JS yourself. :)
If you really must load scripts from a third-party, use subresource integrity so that the browser refuses to load it if the hash changes. A broken site is better than a hacked one.
And on the value of dynamic polyfills (which is what this service provides):
Often it's sufficient to just have two variants of your JS bundles, for example "very old browsers" (all the polyfills required by the oldest browser versions your product supports) and "somewhat new browsers" (just polyfills required for browsers released in the last year or so), which you can do with browserslist and caniuse-lite data.
load more comments
(5 replies)
Man, the Chinese are becoming a new major nuisancec on internet.
Is therea way to ground them for a month while they think about what they did?
~~Take away his honey~~ No more honey on school nights
Edit: could the US/NATO ground China in some debilliting/deterrent way? Like geopolitically/economically spank them and send them to bed without dinner until they come to Jesus?
All Chinese businesses are owned by the CCP, except the ones that get caught being naughty. Suddenly those are a private business with no ties to the party.
All it would really take is internet providers to black hole the China AS numbers in their BGP configs. Then boom China basically can't talk to the rest of the world.
This should be done with the new axis of evil and let them see how much they truly hate and "need" the destruction of the decadent West. Its insane their shenanigans are still being tolerated at all, cut em off and let them build their own self-sustaining economies and force the West to eliminate their dependance on mercurial and malicious actors on the world stage.
Let's not make the splinternet a reality, pretty please.
Chinese scaling and manufacturing, Russian IT expertise, Iranian experience of sanctions evasion and North Korean hacking and remote operations mastery are not the combo you want to bet against.
They would absolutely build the self-sustaining economy and rival networks, but in the process it would destroy the Internet as we know it, and break communication channels that are vital for democracy and international peace, while also breaking communications between relatives and friends on the two sides.
load more comments
(1 replies)
load more comments
(4 replies)
Whichever editor let them post "100 thousand" should be spanked one 100 times with the severed hand of whatever asshole wrote it in the first place.
load more comments
(2 replies)
What's the malware do?
Frustrating that the article doesn't specify and simply links to a different Github page which doesn't clearly specify the problem either.
I have to assume the site's article was dynamically generated, without any actual tech journalist doing the reporting. The byline is "Sansec Forensics Team" which doesn't even link out to the group. Also, the "Chinese Company" isn't named either it the article or the references, which is incredibly shoddy reporting. The archive link is dead.
This whole page is indicative of the failed state of tech journalism. A genuinely explosive story but its so threadbare and vague that it becomes meaningless.
load more comments
(1 replies)
Makes you hungry an hour later.
Ah frick
load more comments
(2 replies)
that's not very nice to call javascript malware. i know it's bad but still.
That GitHub "archive here" link leads to a page where it hasn't been archived... (or was the archive removed??).
Looks like someone tried to archive an archived page. You can see https://web.archive.org/... is listed twice in the url. I just trimmed off the first one then it works: https://web.archive.org/web/20240229113710/https://github.com/polyfillpolyfill/polyfill-service/issues/2834
Again?
This is probably connected to China cloning the entire GitHub website to their own servers.
view more: next ›