Hacker News

I like how quickly this got dismissed as speculation as though we don't live in an age where election tampering and manipulation of public opinion for political reasons are so commonplace that incidents of it just blend in with the other forgettable global headlines.

Yes, a lot of compromised accounts are just put onto a marketplace of sorts, either selling the account itself directly or offered as services to promote a product / political talking point / propaganda / engagement.

Or it could just be that someone vibe coded the worm, and vibe coding is relatively young.

just get residential botnets to watch ur youtube channel click all the adds u dont need many bots..There are many ways to monetize things.

Governments just run sim farms etc. they dont need to use this kind of approach for political influece. Not to say that some dont but generally they will not be stealing accounts. (most bots involved in campaigns to get trump in his seat were not stolen accounts)

I suspect that politicians right before elections may pay more than standard gambling. They gamble with much higher stakes.

It doesn’t need to be profitable if it’s cheap - political manipulation by unsavory parties is worth a cheap botnet if it means they can keep power and keep grifting.

I will agree with a sibling up there that the political part is pure speculation, and I’d guess anyone running a moderately sized botnet is open to use for any nefarious purposes if the price is right.

On that level, power and control trumps profit

It's more profitable because it allows you to select political perspectives that allow you, the scammer and or gambler, to scam or gamble harder.

a kind of

You'd be surprised as how there's individuals and organizations willing to pay a lot of money to do political manipulation / influencing.

Microsoft bought it a while ago. What you're seeing is referred to as "Extinguish".

Happens more and more if you're running uBlock.

For me these appeared to be indexed by Google, so a search with my GitHub username surfaced them.

I understand this sentiment, but rest assured that they will find your projects anyway.

They're also gaming the heuristic that if an OSS repo hasn't had any pushes in ~6mos many users consider it defunct.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager

Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place.

Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device.

A password manager + built-in TOTP on a dedicated device is fine for most general usage. Important TOTPs can go to Yubikeys.

At the very least, a different account for your password manager at work, hopefully paid by the company, which you don't install outside of company-controlled devices.

On Linux, would something like Snap or Flatpak have protected them? It seems nuts that a random executable should have access to the password service.

You can make it so you need a YubiKey to login to 1Password the first time on a new device

So just waiting for the password won’t be enough

I think this is true in technical terms, but I have not seen a compelling description of what that looks like without it sounding like a real pain to manage.

Does anyone have a description of something manageable?

Wonder if you could run your password manager in an isolated sandbox that couldn’t provide the secret behind the TOTP, only the current value.

> putting your TOTP/MFA in your password manager

I suppose the inverse would be starting with a device that offers TOTP/MFA, and then making your password-manager/vault somehow available on that same device. In either case, bringing them together makes it easier for an attacker to compromise both at the same time.

On reflection, I've never actually put my (personal) password vault on my phone, but that may be less of a conscious security stance than fulfilling a millennial stereotype, where certain tasks (like big purchases) are reserved for "a real computer."

Closest I've gotten is having my USB backup keychain in the same pocket, so I could get to it in an emergency, but it's inconveniently air-gapped.

i would also offer, do not use the same device for everything, make sure any local connectivity has firewalled [dot]finances, and [dot]tech lab from each other and else. you should probably split your network to further isolate.

use intentional spelling mistakes in your password vault, edit the password by hand. you also need to have some way of authenticating login components to be sure your running your version of login, and not a trojan login.

Separate and additional auth service based on physical ownership is always nice!

Or using a hardware authenticator.

Story states he wasn't using 2FA for his 1password account at all.

What makes you think he downloaded a pre-compiled binary? The link article doesn’t explicitly say that’s what happened. It just says he downloaded software from GitHub. Which might well have been the source code that he then compiled.

While you’re not wrong in principle. It’s still the least worst in the vast majority of cases.

I think the bigger problem is using your pw manager for 2FA too.

out of curiosity - what scheme do you suggest? I've always been of the mind that 'one thing to remember and secure, but secure it well' was the best option - 2factor and a 15+character passphrase meaning that nearly everything else gets it's own discretized blast radius.

Always open to better security, though.

True for KeyPass or 1Password, but not for GNU pass.

For it to be complete, they need to start changing binaries and bundling software with a microsoft launcher.

Nice quote of Darth Vader there ;) "The cycle will once again be complete."

Also reminds me to update my fake CV.

That's without considering a lot of banks have non-textual inputs for their passwords. Man they love their scrambled virtual keyboard!

I think the worst I ever had was HSBC that asked me for fragments of my password, like characters 4, 6, 7, 11, and 12. Absolute bonkers of a security theatre.

Unfortunately it's not uncommon to find legitimate websites that break autofill in some ways. And the more such websites a user encounters, the more likely he will just mindlessly paste his password into a phishing site as he has learned to do for real ones.

Passkeys solve this problem but has its own usability issues.

I use keepass (FOSS under GPL, fully offline).

It does not detect domains.

"Dang, this site isn't working right with the password manager's detection. Guess I just gotta paste the password in again..."

Meanwhile U2F/Passkeys can't possibly be abused like this.

Any Google employees here that could share some insights on how this kind of thing works from SE p.o.v.? Or why it works that way?

You can probably catch a big pie of those with simple heuristics to flag suspicious repos for expensive review (human- or AI-based). I did that with public account & repo data, and I believe they can do much more given the amount of private data they have access to.

I'm talking about 10s of repos flagged in a few hours. I don't think the volume would be that big for an expensive review.

It exists, although people complain it is too noisy. You can hook in any if your own tools too.

https://github.blog/security/how-to-scan-for-vulnerabilities...

Well, my trend detection logic rewards recent stars more than older ones [1]. Recency is an important factor for many custom and public tools that track GitHub trends. I think the bad guys intentionally recreate repos - I actually noticed that.

That being said, they do take action if you report the repo. So I'm guessing good users are doing the heavy lifting here with reporting. I don't believe GitHub is taking enough proactive measures, or maybe they do, but it's not working well, obviously.

https://hadid.dev/posts/github-trends/#growth-based-approach

Yea, I'd change it to, they care about the malware and will remove the repos, but above everything else they don't want to slow down the signup flow

Yea, they removed the fork <24 hours after I reported it

No, I've not been "living on" such a principle but it was a big claim for "the bazaar."

> You've been living on such a principle? That sounds insane

Fun fact, I've spent the last few days fretting over whether to add H2 to my FabricMC mod. The problem being that I don't know what class-loading shenanigans could possibly occur if I jar-in-jar include it: what happens if another mod has H2 jar-in-jar included? Will my mod only reference its own version of H2? What implications [if any] would that have? Or will the Fabric Loader pick one? What if another mod has H2 shaded instead? Will the classes clash differently? What if, instead of jar-in-jar including it, I shade and relocate it? Does H2 or JDBC rely on reflection or services that would render it non-functional?

All recommendations point to using/creating a mod specifically for that library and depending on it. As luck would have it, one already exists on Modrinth. Except... I'm then requiring anyone who trusts my mod to also install this other mod that I have no control over. I just looked at the source code and it looks fine, but that's if you trust that the published jars are the exact result of that source code: maybe there's something malicious in the Gradle Wrapper binary. This mod could at any time become malicious and how would I detect that?

Guess what? I asked around and was summarily told to stop worrying, that it's fine. We on this website need to realise that we're a minority: NO ONE is routinely (or even occasionally) scrutinising the source code of the stuff they install from third-party websites. I have never, not once, seen anyone hash a downloaded file to check that it matches what's on the website. At the very most, I've seen people find the Github repo, see that it has a lot of stars, and then assume it's safe.

It does not just sound insane, it is insane...

"He reverse-engineered an actual attack. The project contained scripts that enabled code injection and crypto-wallet theft. His post (highly recommended):"

https://www.linkedin.com/pulse/como-identifiquei-um-golpe-em...

"The execp package (version 0.0.1) is an infamous, malicious dependency frequently used in recent supply-chain attacks and job interview scams. Threat actors embed this 9-year-old package into seemingly innocent "technical assessments" or projects. When you run npm install, it quietly executes arbitrary shell commands in the background to compromise your machine."

> You've been living on such a principle?

I have not, but in case you missed it, this principle has been used by open source proponents for decades. I'm an open source developer myself, but always found it odd.

That's not a distinction that people really benefit from.

Approximately nobody can read other people's code for intent or quality, let alone to surface malware meant to be hidden in it.

For almost everyone, the only hope is that somebody else validated the code you want to use before you choose to use it and successfully interfered with its distribution upon finding an issue. That's why the culture of automatic-updating package managers and bloated dependency graphs are so dangerous and why inserting delays into package managers can make such a difference in exposure to supply chain attacks for those that are intent to use them.

It's true that open source provides the transparency that makes any kind of third-party validation possible, but closed source benefits from commercial vendors staking their brand on what they release. It's a tradeoff, not a straightforward win for one side.

there are numerous OSS maintainers who have turned GitHub into a religion. the maintainers of bevy and brew come to mind. it is a "curated software repository" and so much more, it's practically a way of life for these guys.

And how often do you do it?

"Trust me bro" is what people say about open source everywhere when it's not true.

Step-Security, Wiz ..

I thought about VM but it would be pretty expensive and require lot of RAM (which is not cheap nowadays and not always upgradeable on laptops. How would you upgrade your 8 Gb MacBook?) and CPU overhead to emulate the hardware and run one more kernel. The program in VM would not be able to use OpenGL/Vulkan, access the audio card with low latency (for working with audio), connect to DBus (to interact with other software).

I actually ran Windows games like Cyberpunk in qemu on a Linux host without performance loss, but that required adding a dedicated GPU for guest and to use realtime audio, one needs to pass through an audio card into the guest.

Furthermore, the CPU already provides a "sandbox" (isolated memory) for processes. The problem is that Linux allows the program to ask the kernel to do anything.

> Linux has features like SELinux and AppArmor.

Neither SELinux not AppArmor allows to show a question "would you like to allow program N to access your microphone" or "would you like to let the program connect to github.com? (Yes) (No) (With decrypting SSL traffic)". They look like they are made to comply with some outdated standards from 80s.

The best you can do today is either write your own sandbox around Linux namespaces (very complicated), or try lightweight VMs like Firecracker, or paravirtualization (like VM but with a shared kernel). Those solutions are made for server use, not for desktop, and require lot of work and programming.

> If you want to install a random package, you are free to do and its your responsibility. Equivalent is side loading in android.

I want to install random packages and still be safe. That's the point of installing an OS, to be able to run random programs on the computer.

I did not suggest that; what I suggested was that the programs should run in sandboxes.

In Linux there is no vetting. Does anyone verify proprietary AI agents like Claude Code? Software like VS Code? Games? They are distributed through random sites and cannot even be banned.

You could restrict yourself to the official repositories, but there is a limited selection of software. There are no closed-source software, like audio editing plugins, graphic editors, games, AI agents and so on. Even open-source software is often missing in official repositories.

This story is totally unrelated to open-source. There is no mention of a source let alone a license.