WEBVTT 1 00:00:05.440 --> 00:00:08.919 Hello everybody, Welcome to another thrilling episode of JavaScript Jabber. 2 00:00:08.919 --> 00:00:10.960 I am Steve Edwards, the host with the face for 3 00:00:11.039 --> 00:00:13.039 radio and the voice for being a mine. But I'm 4 00:00:13.039 --> 00:00:16.160 still your host, and sirih thinks I'm talking to her 5 00:00:16.160 --> 00:00:19.440 for some reason. With me today we have a special 6 00:00:20.000 --> 00:00:22.760 returning Yes, mister Farross, a book a DJ. 7 00:00:22.839 --> 00:00:23.960 How you doing, Fross? 8 00:00:24.239 --> 00:00:26.199 I'm doing good. Thanks for having me here. 9 00:00:26.960 --> 00:00:30.559 Yes, for those of you that wonder how to say 10 00:00:30.559 --> 00:00:32.840 his name, it's think about like booking a DJ for 11 00:00:32.960 --> 00:00:34.840 a show or something like that. 12 00:00:34.840 --> 00:00:36.560 That's what he told me, and it still works for me. 13 00:00:36.840 --> 00:00:40.439 I'm impressed you remember that, Steve, because yes, it is 14 00:00:40.439 --> 00:00:41.560 pretty memorable ized pose. 15 00:00:42.039 --> 00:00:45.679 Yes, yes, so Fross. 16 00:00:45.960 --> 00:00:49.359 Before we get into our lovely dark world of internet 17 00:00:49.399 --> 00:00:51.960 hacks and people trying to steal cryptocurrency, why don't you 18 00:00:51.960 --> 00:00:54.200 give us a little background on who you are and 19 00:00:54.240 --> 00:00:57.159 why you're famous, and your company and what it does 20 00:00:57.200 --> 00:00:58.240 and all that good stuff. 21 00:00:58.679 --> 00:00:58.880 Cool. 22 00:00:58.920 --> 00:01:00.880 Yeah, I wouldn't say I'm famous, but I'm happy to 23 00:01:00.920 --> 00:01:02.280 give you a background on. 24 00:01:02.399 --> 00:01:03.000 What I would. 25 00:01:03.240 --> 00:01:06.040 But that what I've done today. Yeah. 26 00:01:06.079 --> 00:01:10.079 So I started off kind of writing open source software. 27 00:01:10.079 --> 00:01:11.239 That was kind of what I did for most of 28 00:01:11.280 --> 00:01:14.599 my career. I found the early no JS community to 29 00:01:14.680 --> 00:01:17.879 be like a really welcoming and awesome place. Kind of 30 00:01:19.239 --> 00:01:22.519 found my way to the early node con conferences in 31 00:01:22.640 --> 00:01:25.959 the one in in San Francisco that Michael Rodgers organized, 32 00:01:26.439 --> 00:01:31.079 as well as the note Confee you and kind of 33 00:01:32.000 --> 00:01:35.480 just got really addicted to publishing NPM packages. Published a 34 00:01:35.480 --> 00:01:38.640 bunch of those over the years, some projects like webparrent. 35 00:01:38.280 --> 00:01:39.480 And standard js. 36 00:01:40.120 --> 00:01:43.239 Uh and uh, yeah, I just learned a lot about 37 00:01:43.280 --> 00:01:46.200 the you know, the supply chain, the way that open 38 00:01:46.200 --> 00:01:51.120 source software is used by companies, the way that you know, 39 00:01:51.159 --> 00:01:54.239 open source development happens, and and I got really addicted 40 00:01:54.239 --> 00:01:55.120 to it and it was really fun. 41 00:01:55.159 --> 00:01:56.159 It's an amazing community. 42 00:01:56.799 --> 00:02:01.840 Uh And ultimately that kind of to me starting Socket 43 00:02:01.879 --> 00:02:04.879 in twenty twenty, after seeing a ton of attacks happening 44 00:02:05.200 --> 00:02:09.520 against JavaScript packages, I got kind of obsessed with like 45 00:02:09.560 --> 00:02:10.520 trying to fix the problem. 46 00:02:10.759 --> 00:02:13.960 I was like, why why do we accept that. 47 00:02:14.080 --> 00:02:16.879 Packages are just going to keep getting compromised and every 48 00:02:16.919 --> 00:02:18.560 time that happens, we're just going to have to hope 49 00:02:18.560 --> 00:02:21.000 that we were lucky and not affected by that in 50 00:02:21.039 --> 00:02:23.840 some way or another, Like, can't we actually be proactive 51 00:02:23.840 --> 00:02:24.199 about this? 52 00:02:24.439 --> 00:02:28.240 Scan for this prevent this, and so I. 53 00:02:28.159 --> 00:02:30.000 Started a company Socket to do that, and now we're like, 54 00:02:30.840 --> 00:02:33.039 it's a big company now, I mean we're like seventy 55 00:02:33.120 --> 00:02:36.560 five people. We have a ton of big customers, a 56 00:02:36.560 --> 00:02:39.159 lot of companies you probably recognize, and just trying to 57 00:02:39.159 --> 00:02:40.639 help people use open source safely. 58 00:02:42.199 --> 00:02:44.360 So just to clarify for us and I were talking 59 00:02:44.400 --> 00:02:47.080 about this ahead of time, his website is socket dot dev, 60 00:02:47.199 --> 00:02:51.080 not socket dot io, if you make that mistake. Socket 61 00:02:51.120 --> 00:02:54.639 io is Girmo Rouscher's old library for doing web sockets. 62 00:02:55.280 --> 00:02:59.919 Socket dot dev is Frost's entity that helps keep supply 63 00:03:00.280 --> 00:03:07.000 chain stuff safe. So for us, that's quite the list 64 00:03:07.039 --> 00:03:11.879 of recent compromises and attempts to compromise the NPM supply chain. 65 00:03:12.960 --> 00:03:13.840 I know that. 66 00:03:15.240 --> 00:03:16.919 The most recent one that comes to my mind that 67 00:03:16.960 --> 00:03:18.960 we got hit with was the one, and we'll get 68 00:03:18.960 --> 00:03:23.120 to this, the Chalk Library and all those libraries by 69 00:03:23.120 --> 00:03:26.400 that same author that got compromised with a crypto trying 70 00:03:26.439 --> 00:03:29.759 to steal cryptocurrency stuff. And fortunately for us, we weren't 71 00:03:29.840 --> 00:03:35.000 using those libraries, so we were okay. But apparently that's just 72 00:03:35.080 --> 00:03:38.960 one in a string of recent compromise attempts. 73 00:03:39.000 --> 00:03:40.319 So with further Ado. 74 00:03:40.439 --> 00:03:43.000 I'll let Frost take over and talk about what's been 75 00:03:43.039 --> 00:03:43.800 going on lately. 76 00:03:44.719 --> 00:03:45.000 Yeah. 77 00:03:45.039 --> 00:03:47.120 Sure, So we've seen a bunch of attacks over the 78 00:03:47.199 --> 00:03:49.400 last couple of months. I'll try to give you like 79 00:03:49.439 --> 00:03:51.560 a high level summary and then we can dig into 80 00:03:51.599 --> 00:03:54.639 the the different details if that's interesting to you. 81 00:03:56.319 --> 00:03:56.520 Yeah. 82 00:03:56.520 --> 00:03:59.719 So we saw a phishing campaign that started about two 83 00:03:59.759 --> 00:04:03.280 months to go back in July where a lot of 84 00:04:04.240 --> 00:04:06.960 kind of popular MPM maintainers got this phishing email that 85 00:04:07.159 --> 00:04:10.680 was impersonating npm and asking them to like add to 86 00:04:10.840 --> 00:04:13.879 FA to their account. And it turns out that that 87 00:04:13.960 --> 00:04:16.759 email was actually sent from well, it appeared to be 88 00:04:16.800 --> 00:04:19.639 sent from support at npmjs dot org, which is like 89 00:04:19.920 --> 00:04:23.879 a real email that npm uses, but actually it wasn't 90 00:04:23.879 --> 00:04:24.439 sent from there. 91 00:04:24.480 --> 00:04:25.360 It was just spoofed. 92 00:04:26.240 --> 00:04:32.399 And unfortunately the npm js dot org domain didn't have 93 00:04:32.439 --> 00:04:34.720 the proper like email headers set up d mark and 94 00:04:34.839 --> 00:04:38.600 SPF headers that would would have helped different email clients 95 00:04:38.639 --> 00:04:42.199 to know that that that email, you know, wasn't legit 96 00:04:42.439 --> 00:04:45.680 from from npmjs dot org. Turns out like they send 97 00:04:45.680 --> 00:04:49.160 email from npmjs dot com, uh, and that had the 98 00:04:49.199 --> 00:04:52.399 headers set up, but npmjs dot org is a real 99 00:04:52.439 --> 00:04:56.399 domain that NPM uses, so it was still quite convincing 100 00:04:56.439 --> 00:04:59.720 to get an email from that for people. So Lesson 101 00:04:59.800 --> 00:05:01.160 learned there is like you need to set up these 102 00:05:01.160 --> 00:05:04.680 email headers in these email these DNS records that help 103 00:05:05.199 --> 00:05:09.480 you know, block spoofed emails even on domains that you're 104 00:05:09.480 --> 00:05:11.399 not sending email from. As long as they're like a 105 00:05:11.399 --> 00:05:14.199 domain that your users recognize that you use, you know, 106 00:05:14.199 --> 00:05:14.639 you got. 107 00:05:14.519 --> 00:05:17.519 To protect them with those same with those same GNS records. 108 00:05:18.600 --> 00:05:20.720 So what happened is if people clicked on the link 109 00:05:20.800 --> 00:05:23.519 in the email, it would take you to a website 110 00:05:23.560 --> 00:05:26.959 that looked exactly like NPM, but it was a proxy, 111 00:05:27.120 --> 00:05:29.319 so it sort of anything you clicked on would work, 112 00:05:29.360 --> 00:05:31.199 and it would let you navigate through the whole site 113 00:05:31.560 --> 00:05:34.399 just like you were on the real site, but the 114 00:05:34.480 --> 00:05:36.879 domain was off by a letter, so it wasn't the 115 00:05:36.879 --> 00:05:39.199 real site. And then of course if you logged in 116 00:05:39.199 --> 00:05:41.720 it would it would steal your credentials. So that that 117 00:05:41.800 --> 00:05:44.879 was something that was going around back in July, and 118 00:05:46.399 --> 00:05:49.439 we kind of noticed it over at Socket because some 119 00:05:49.600 --> 00:05:51.040 of the folks on our team got this got this 120 00:05:51.079 --> 00:05:53.240 fishing email, and we were like, oh, this is interesting, 121 00:05:53.360 --> 00:05:55.839 So we wrote about it, tried to warn people about it, 122 00:05:56.600 --> 00:05:59.319 but nonetheless, a couple of days later there was kind 123 00:05:59.319 --> 00:06:02.240 of the first prolific maintainers that were starting to get 124 00:06:02.240 --> 00:06:06.120 affected by this, and that started with a Prettier project. 125 00:06:06.160 --> 00:06:08.720 So the Prettier package, a. 126 00:06:08.680 --> 00:06:11.879 Couple of Prettier packages were compromised, including yes lint can 127 00:06:11.879 --> 00:06:16.360 fike Prettier, which is the reusable yes link configuration that 128 00:06:16.480 --> 00:06:20.040 kind of has the the rules for es lint in 129 00:06:20.120 --> 00:06:24.319 it that you can kind of apply to to to 130 00:06:24.480 --> 00:06:27.360 yes lint, and so that was compromised with a with 131 00:06:27.000 --> 00:06:31.600 a like a Windows specific DLL file. So for those 132 00:06:31.639 --> 00:06:33.560 who don't know, that's basically just like a kind of 133 00:06:33.560 --> 00:06:36.800 a compiled code file that that you know, you can 134 00:06:36.879 --> 00:06:40.519 run on Windows machines, and that when that ran, it 135 00:06:40.519 --> 00:06:44.079 would it would steal a bunch of system system information 136 00:06:44.279 --> 00:06:48.360 like your environment variables. Uh, and then it would open 137 00:06:48.360 --> 00:06:51.360 a web socket, speaking of web sockets, uh, It would 138 00:06:51.360 --> 00:06:55.240 open a web socket to the attacker and it would 139 00:06:55.319 --> 00:06:59.519 leave that connection open. And so then the attacker could 140 00:06:59.560 --> 00:07:02.160 have base to be like an interactive shell, so they 141 00:07:02.199 --> 00:07:05.120 would any text that they sent over that web socket 142 00:07:05.360 --> 00:07:08.480 would be received on your your computer, your machine, or 143 00:07:08.519 --> 00:07:11.279 your server and it would get run like in a shell, 144 00:07:11.639 --> 00:07:13.680 and then the output would get sent back to the attacker. 145 00:07:13.959 --> 00:07:16.199 So it's like they were almost acessation into your system, 146 00:07:16.319 --> 00:07:19.160 but using a web socket to kind of run commands 147 00:07:19.160 --> 00:07:24.000 on your computer or on your server. That's bad, right, Yeah, 148 00:07:23.279 --> 00:07:28.480 it goes out saying that's bad. Yeah, yeah, they so, 149 00:07:28.480 --> 00:07:32.000 so I think, you know it was it was cross 150 00:07:32.040 --> 00:07:33.800 platform in that way, so there was the Windows piece 151 00:07:33.879 --> 00:07:35.399 that the doll file, but then it was also like 152 00:07:35.639 --> 00:07:38.199 it would also affect you on Mac and Linux because of. 153 00:07:38.160 --> 00:07:40.639 The web socket, and yeah, not good. 154 00:07:42.000 --> 00:07:44.240 They also kind of tried to hide their tracks through 155 00:07:44.360 --> 00:07:47.879 through different like anti analysis techniques, so they would encrypt 156 00:07:47.920 --> 00:07:51.240 the data going across the web socket, so if you 157 00:07:51.240 --> 00:07:54.240 were like looking at the text, you wouldn't see, like, 158 00:07:54.560 --> 00:07:55.519 you know, what was going. 159 00:07:55.360 --> 00:07:57.480 Across that that socket. 160 00:07:59.079 --> 00:08:00.879 So that was kind of the first first sort of 161 00:08:00.920 --> 00:08:03.279 effect of this fishing campaign was it actually hit you know, 162 00:08:03.560 --> 00:08:08.279 this popular library. Then it was kind of all quiet 163 00:08:08.360 --> 00:08:10.839 for a little while for about a month there until 164 00:08:10.879 --> 00:08:17.680 August when the popular NX build system was had one 165 00:08:17.680 --> 00:08:22.800 of their packages compromised. And this this attack was interesting 166 00:08:22.800 --> 00:08:25.800 for a couple of reasons. I'd say the first reason. Well, 167 00:08:25.839 --> 00:08:27.519 for first of all, it just it was similar and 168 00:08:27.519 --> 00:08:29.560 that it still just tried to steal credentials. So it 169 00:08:29.600 --> 00:08:32.080 would like search your system for you know, s s 170 00:08:32.240 --> 00:08:35.960 H keys, NPM tokens, basically any file that you might 171 00:08:35.960 --> 00:08:37.960 have on your system that contains like a key or 172 00:08:37.960 --> 00:08:39.559 a token in it. It was it would just hunt 173 00:08:39.559 --> 00:08:41.600 through the file system looking for that and send it 174 00:08:41.639 --> 00:08:43.840 off to the attacker. But what was interesting about how 175 00:08:43.879 --> 00:08:46.080 they did it was it didn't just use like it 176 00:08:46.480 --> 00:08:50.240 you know, just code to do that. It instead abused 177 00:08:50.279 --> 00:08:53.440 AI tools like Claude and Gemini to scan your file 178 00:08:53.480 --> 00:08:56.240 system for sensitive data, which is a technique that we 179 00:08:56.279 --> 00:08:59.600 had never seen before. So this means that it would 180 00:08:59.639 --> 00:09:03.519 look for or uh Claude or Gemini installed on your 181 00:09:03.519 --> 00:09:05.919 system like this the cli tool that lets you interface 182 00:09:05.960 --> 00:09:08.720 with these AI agents and these AI tools, and it 183 00:09:08.720 --> 00:09:13.120 would use them to with a prompt asking the agent 184 00:09:13.200 --> 00:09:16.519 to go and like search your file system for interesting files, 185 00:09:16.759 --> 00:09:18.440 and then it listed out a whole bunch of file 186 00:09:18.480 --> 00:09:21.600 extensions in the prompt like dot t x T, dot log, 187 00:09:21.720 --> 00:09:25.519 dot n you know, uh, dot back, you know, just 188 00:09:25.519 --> 00:09:28.799 different different kind of interesting extensions that could have keys 189 00:09:28.879 --> 00:09:31.519 or data in it. That might be interesting to the attacker, 190 00:09:32.000 --> 00:09:33.759 and then the agent would go and find all those 191 00:09:33.759 --> 00:09:36.679 files and then collect them in one in one place 192 00:09:37.000 --> 00:09:39.519 that could then be sent off to the attacker. So 193 00:09:39.639 --> 00:09:41.480 I'd never seen like an LM being used in this 194 00:09:41.559 --> 00:09:44.440 way kind of kind of you know, as a like 195 00:09:44.600 --> 00:09:46.840 like effectively that the payload of the attack is not 196 00:09:47.279 --> 00:09:49.600 like some malicious code, it's actually just a couple of 197 00:09:49.639 --> 00:09:53.279 sentences in English. So that was that really blew my 198 00:09:53.320 --> 00:09:54.399 mind when when I saw that. 199 00:09:57.200 --> 00:09:59.919 So why is that effective? Then you find it wor 200 00:10:00.080 --> 00:10:01.720 inner or just that that was the attempt. 201 00:10:02.279 --> 00:10:03.399 Oh no, it was effective. Yeah. 202 00:10:03.399 --> 00:10:04.480 I mean if you had if you had to have 203 00:10:04.559 --> 00:10:06.279 claud or Gemini on your system for it to work, 204 00:10:06.320 --> 00:10:08.279 if you didn't, it wouldn't do anything. So that was 205 00:10:08.639 --> 00:10:10.320 that was kind of the funny part was that it 206 00:10:10.399 --> 00:10:12.559 wasn't you know, it wouldn't affect you if you didn't 207 00:10:12.600 --> 00:10:13.960 have those CLI tools installed. 208 00:10:14.279 --> 00:10:16.120 So they kind of limited their reach a little bit. 209 00:10:16.200 --> 00:10:19.720 But I suspect they did it because it it was 210 00:10:19.720 --> 00:10:22.159 an attempt to get past code scanning tools that look 211 00:10:22.240 --> 00:10:25.679 for you know, suspicious code and if you know, if 212 00:10:25.679 --> 00:10:27.240 it's just a string, then a lot of those scanners 213 00:10:27.200 --> 00:10:28.480 will skip it, skip it. 214 00:10:29.519 --> 00:10:29.759 That's it. 215 00:10:29.919 --> 00:10:33.960 Socket socket wasn't wasn't tricked by this because we use ourselves. 216 00:10:34.039 --> 00:10:35.799 We use l ll ms to look at the code, 217 00:10:36.000 --> 00:10:37.960 which is a newer technique. 218 00:10:38.039 --> 00:10:38.159 Right. 219 00:10:38.159 --> 00:10:40.240 A lot of the sort of other security tools do 220 00:10:40.360 --> 00:10:43.080 static analysis on the code alone. But if you actually 221 00:10:43.159 --> 00:10:46.039 use an l M to look at the code, an 222 00:10:46.120 --> 00:10:48.440 l N isn't going to be tricked by a sentence. 223 00:10:48.639 --> 00:10:50.440 You know, you can ask the l M like what 224 00:10:50.559 --> 00:10:52.200 is this code doing, and it'll look at the prompt 225 00:10:52.200 --> 00:10:53.679 and it will tell you. So this, you know, with 226 00:10:53.679 --> 00:10:57.639 with the right prompting that actually it's possible for like defenders, 227 00:10:57.720 --> 00:10:59.679 for the good guys to also you know, use these 228 00:10:59.679 --> 00:11:02.879 AI tools to catch the bad guys. 229 00:11:02.720 --> 00:11:03.480 Using a tools. 230 00:11:03.519 --> 00:11:05.360 So it's it's it is a cat and mouse game 231 00:11:05.600 --> 00:11:09.159 some extent. But but I think you know, it didn't 232 00:11:09.200 --> 00:11:11.039 get past us. But but I would say it was. 233 00:11:11.080 --> 00:11:13.159 It was effective in that that if you actually ran 234 00:11:13.200 --> 00:11:19.840 the code, it worked as it was intended to. Okay, yeah, 235 00:11:19.879 --> 00:11:21.759 so that's uh, that's we're still not to the chalk 236 00:11:21.799 --> 00:11:23.720 attack yet. But but I wanted to say one other 237 00:11:23.720 --> 00:11:26.080 thing about this one. So NX, I don't know if 238 00:11:26.080 --> 00:11:28.240 you're familiar with. It's this build system, so it's it's 239 00:11:28.320 --> 00:11:30.279 kind of an open source it's an open source project. 240 00:11:30.360 --> 00:11:32.759 They have a GitHub repo that folks can contribute to. 241 00:11:33.759 --> 00:11:35.759 It's just a kind of a standard you know, NPM 242 00:11:35.840 --> 00:11:38.720 open source project like people are familiar with, and so 243 00:11:38.759 --> 00:11:40.559 they accept pull requests from the community. 244 00:11:41.039 --> 00:11:45.200 And one thing that was interesting about the uh. 245 00:11:44.320 --> 00:11:46.200 The way that this attack happened was it didn't use 246 00:11:46.240 --> 00:11:48.279 the phishing email, so that's not how they got the 247 00:11:48.320 --> 00:11:51.559 attack or got access. They used a different method, and 248 00:11:51.600 --> 00:11:53.039 so I wanted to talk through that because I think 249 00:11:53.120 --> 00:11:57.519 that the method was quite quite impressive. So they they 250 00:11:57.600 --> 00:12:01.159 used a get of action workflow that the an X 251 00:12:01.240 --> 00:12:04.600 project had, you know, added to their EPO, and it 252 00:12:04.679 --> 00:12:07.039 had some vulnerabilities in it that the attacker was able 253 00:12:07.080 --> 00:12:07.480 to use. 254 00:12:07.960 --> 00:12:09.720 And so I want to walk through that because I 255 00:12:09.720 --> 00:12:10.000 want to. 256 00:12:09.960 --> 00:12:12.639 Make sure people are aware that get up actions are, 257 00:12:13.360 --> 00:12:15.440 like they're very powerful, they're very useful. I use them 258 00:12:15.440 --> 00:12:18.440 all the time, but they're also very dangerous if you 259 00:12:18.440 --> 00:12:21.679 don't use them correctly. And there's a lot of foot guns, 260 00:12:21.720 --> 00:12:23.960 like just ways that you can just think you're doing 261 00:12:23.960 --> 00:12:27.120 something very innocent, very very very you know that looks 262 00:12:27.159 --> 00:12:30.679 doesn't look dangerous, but it's actually like a like a trick, 263 00:12:30.720 --> 00:12:32.840 like you're you're you're actually doing something very dangerous and 264 00:12:33.240 --> 00:12:35.960 it's just it doesn't seem that way. So the thing 265 00:12:35.960 --> 00:12:37.320 that they did, so they did a couple of things. 266 00:12:37.360 --> 00:12:39.960 But the first one was they they were trying to 267 00:12:40.000 --> 00:12:43.039 print out the PR title in the action. So they 268 00:12:43.080 --> 00:12:45.960 had this echo command that just said like echo PR 269 00:12:46.039 --> 00:12:49.240 title and then it put the variable you know, into 270 00:12:49.279 --> 00:12:51.399 the command that that was that would print out the 271 00:12:51.399 --> 00:12:55.679 PR title. The way they did that with echo, right, 272 00:12:56.000 --> 00:12:58.600 and by putting the variable in there created a shell injection, 273 00:12:59.120 --> 00:13:02.000 which is it's very similar to a SQL injection if 274 00:13:02.000 --> 00:13:04.759 people are familiar with probably more familiar with SQL sql 275 00:13:04.759 --> 00:13:09.000 injection attacks, and that just means that an attacker can 276 00:13:09.480 --> 00:13:15.240 effectively insert their code into the command, so it's your 277 00:13:15.639 --> 00:13:19.000 instead of the instead of something being treated as data, 278 00:13:19.240 --> 00:13:22.399 it is inadvertently treated as code and executed. And so 279 00:13:22.480 --> 00:13:24.240 the way you do that here is you as an attacker, 280 00:13:24.279 --> 00:13:27.759 you'd just open a PR to this an x open 281 00:13:27.799 --> 00:13:30.480 source project, and you'd put your attack code in the 282 00:13:30.480 --> 00:13:33.039 title of the PR, but you'd start it with like 283 00:13:33.080 --> 00:13:36.720 a double quote to sort of close off the quote 284 00:13:36.720 --> 00:13:38.519 that they had in their command and then and then 285 00:13:38.559 --> 00:13:41.879 the rest would be kind of run as runs as 286 00:13:41.919 --> 00:13:44.080 a command, So you could get code effectively running in 287 00:13:44.159 --> 00:13:47.480 the in the environment of the you know, of the project. 288 00:13:47.639 --> 00:13:51.480 Now that is in and of itself not that like interesting, 289 00:13:51.559 --> 00:13:54.559 because like there has to be some something in that 290 00:13:54.679 --> 00:13:56.240 environment that you want to take or you want to 291 00:13:56.279 --> 00:14:00.440 steal as an attacker. And uh so that this is 292 00:14:00.480 --> 00:14:02.000 the kind of where you get to the second part 293 00:14:02.159 --> 00:14:06.720 where get of actions support two ways of responding to 294 00:14:06.759 --> 00:14:10.960 pull requests. So they have these triggers where you say, effectively, 295 00:14:11.000 --> 00:14:13.399 when this thing happens, run my git of action right. 296 00:14:13.840 --> 00:14:15.879 And so the thing that happens is the pull request 297 00:14:15.879 --> 00:14:19.000 has been opened, right, And they have two ways to 298 00:14:19.080 --> 00:14:21.240 react to pull requests that are being opened. One of 299 00:14:21.279 --> 00:14:23.320 them is called pull requests and one of them is 300 00:14:23.320 --> 00:14:26.919 called pull request target. And for many years, pull request 301 00:14:26.919 --> 00:14:29.159 target was the one that was recommended in the getub 302 00:14:29.159 --> 00:14:32.120 docs and was what a lot of tutorials and code 303 00:14:32.159 --> 00:14:34.000 samples were using. So it's probably the one that a 304 00:14:34.039 --> 00:14:36.720 lot of people chose to use. The problem with that 305 00:14:36.759 --> 00:14:40.679 one is that, unlike the standard pull request trigger, the 306 00:14:40.720 --> 00:14:44.519 poll request target one will will run the workflow with 307 00:14:44.559 --> 00:14:49.320 elevated permissions, and it includes this get up token environment 308 00:14:49.399 --> 00:14:52.720 variable that gives you full read and write access to 309 00:14:52.759 --> 00:14:53.559 their pository. 310 00:14:54.240 --> 00:14:56.519 So that token is just sitting there in the environment. 311 00:14:57.320 --> 00:14:58.240 And so if. 312 00:14:58.080 --> 00:15:01.000 You use pull request target in your project, it means 313 00:15:01.000 --> 00:15:03.919 now anyone can open a PR on your project, and 314 00:15:04.840 --> 00:15:06.799 if they can run code in that environment, you know 315 00:15:06.840 --> 00:15:09.240 that can look at the environment vables. There's going to 316 00:15:09.279 --> 00:15:11.840 be a really juicy environment vable there that lets them 317 00:15:12.039 --> 00:15:15.679 effectively commit to your repository. So the combination of those 318 00:15:15.720 --> 00:15:18.639 two things meant that an attacker could put code into 319 00:15:18.679 --> 00:15:21.240 the title of a PR, send it to just just 320 00:15:21.279 --> 00:15:22.960 open it on, you know, send a PR to the project, 321 00:15:23.000 --> 00:15:24.919 and then that code would run. And they made that 322 00:15:24.960 --> 00:15:28.399 code basically look for that environment variable and steal it 323 00:15:28.440 --> 00:15:31.240 and send it off to them via an HTTP request. 324 00:15:31.519 --> 00:15:33.600 So now they have the get up token, they can 325 00:15:33.679 --> 00:15:37.240 commit to this, you know, important open source project, even 326 00:15:37.240 --> 00:15:38.360 though they're not supposed. 327 00:15:38.000 --> 00:15:39.840 To be able to do that. So what do they 328 00:15:39.840 --> 00:15:42.960 do with that, Well, they were trying to get onto NPM, 329 00:15:43.000 --> 00:15:44.679 They're trying to compromise the NPM. 330 00:15:44.480 --> 00:15:48.519 Package, but they only have the get up token. So 331 00:15:49.720 --> 00:15:53.799 this project like a lot of projects have a published workflow, 332 00:15:53.960 --> 00:15:56.320 which is just another get of action that they've set 333 00:15:56.399 --> 00:15:59.960 up that will published NPM, and they made sure that 334 00:16:00.080 --> 00:16:03.039 the NPM published token was only available to. 335 00:16:03.000 --> 00:16:08.799 That publish workflow, so it was isolated over there, which 336 00:16:08.840 --> 00:16:10.600 is great. They did a good job of that. But 337 00:16:11.840 --> 00:16:14.879 now the attacker can write to the entire repository. 338 00:16:14.919 --> 00:16:16.320 So all they had to do was going and they 339 00:16:16.360 --> 00:16:19.279 just they just edited the publish workflow file and just 340 00:16:19.320 --> 00:16:22.159 added an extra step that would I think print out 341 00:16:22.480 --> 00:16:24.960 or send the NPM token to them, because once you 342 00:16:25.000 --> 00:16:26.919 can write to the repo, you know, then you can 343 00:16:27.000 --> 00:16:29.440 just edit any of the workflows and just it doesn't 344 00:16:29.480 --> 00:16:31.679 matter that the NPM token was only available to some 345 00:16:31.720 --> 00:16:33.679 of the workflows. They can just edit the workflow and 346 00:16:33.919 --> 00:16:36.320 print out the tokens and stuff. So that's how they 347 00:16:36.639 --> 00:16:39.799 they basically stole the NPM token and then published the 348 00:16:39.840 --> 00:16:42.440 malicious packages. So that was a lot of information, but 349 00:16:42.559 --> 00:16:44.000 I just wanted to walk through it because I think 350 00:16:44.279 --> 00:16:46.600 I don't know if you were following all of it 351 00:16:46.679 --> 00:16:48.480 or it was interesting to you, but I think it's 352 00:16:48.519 --> 00:16:52.000 fascinating because it's just like you're just using gid of actions, 353 00:16:52.000 --> 00:16:53.720 you like don't think about like I'm going to like 354 00:16:54.159 --> 00:16:55.879 my entire repo was going to get hacked and my 355 00:16:55.960 --> 00:16:58.399 NPM package is going to get a compromise because I 356 00:16:58.639 --> 00:17:03.279 just like you know, printed out a PR title like 357 00:17:03.519 --> 00:17:05.519 in my in my get of action, Like that doesn't 358 00:17:05.559 --> 00:17:08.960 seem like it should lead to that. So it's, uh, 359 00:17:09.079 --> 00:17:09.839 it's pretty wild. 360 00:17:10.799 --> 00:17:11.799 So a couple of things. 361 00:17:11.839 --> 00:17:16.160 One, for those who want a good example of sequel 362 00:17:16.200 --> 00:17:20.359 injection attacks, look up xk CD number three twenty seven, 363 00:17:20.480 --> 00:17:26.000 otherwise titled Exploits of a mom and you're recognized Bobby Tables. 364 00:17:26.599 --> 00:17:28.240 Yeah, just leave that to you to look up. 365 00:17:28.480 --> 00:17:30.960 That's one of the few xkcds that I have memorized, 366 00:17:32.240 --> 00:17:37.039 the number that and nerd sniping. But so a question 367 00:17:37.119 --> 00:17:42.440 for you then regarding how you know, like you just said, 368 00:17:42.440 --> 00:17:47.440 you wouldn't think that a GitHub action could expose you know, 369 00:17:47.519 --> 00:17:48.839 you just somebody stealing your token? 370 00:17:48.960 --> 00:17:51.839 Is that on the is that on GitHub? 371 00:17:52.000 --> 00:17:54.000 Is that on the creator of the action they have 372 00:17:54.039 --> 00:17:56.720 to know the finding security details of creating a GitHub 373 00:17:56.759 --> 00:18:02.279 action or is it just the nature of you know 374 00:18:02.680 --> 00:18:06.400 what it is that you can everybody's looking for vulnerability 375 00:18:06.519 --> 00:18:10.119 somewhere and somebody happened to be created creative or how 376 00:18:10.119 --> 00:18:10.759 do you look at that? 377 00:18:12.079 --> 00:18:14.880 I mean, as with security, all things in security, it's 378 00:18:14.920 --> 00:18:18.440 it's a complicated answer. I think there's blame to be 379 00:18:18.519 --> 00:18:21.279 shared on all sides. But I put probably more of 380 00:18:21.279 --> 00:18:24.960 the blame on the design of get of actions because it, 381 00:18:26.279 --> 00:18:28.240 you know, it's not fair. I don't think it's fair 382 00:18:28.359 --> 00:18:33.079 to you know, have kind of a bad design or 383 00:18:33.119 --> 00:18:36.440 bad defaults and then just say, oh, well I documented it. 384 00:18:36.519 --> 00:18:38.200 You know, go read the docks. The docks tell you 385 00:18:38.279 --> 00:18:40.599 how how you know how not to use this. 386 00:18:40.880 --> 00:18:42.519 If it's if it's too if it's if you have 387 00:18:42.599 --> 00:18:45.599 too many like booby traps or you know what sometimes 388 00:18:45.599 --> 00:18:48.559 called foot guns in the design of of something, then 389 00:18:48.799 --> 00:18:50.400 you know, you you definitely have some of the blame 390 00:18:50.440 --> 00:18:52.400 on the creator of that design. So there were a 391 00:18:52.440 --> 00:18:54.079 few things in the design here that we're just that 392 00:18:54.119 --> 00:18:57.400 we're not obvious to people. I think, you know, the 393 00:18:57.440 --> 00:18:59.759 fact that they were recommending pull request target for a 394 00:18:59.839 --> 00:19:03.599 year instead of the safer pull request trigger is definitely 395 00:19:03.599 --> 00:19:07.000 on GitHub. They've now documented that very well. So it 396 00:19:07.039 --> 00:19:09.559 is all documented. But you know, there's a lot of 397 00:19:09.559 --> 00:19:12.279 tutorials and guides and things that are going to still 398 00:19:12.319 --> 00:19:15.839 have the old information, so, you know, and then I 399 00:19:15.880 --> 00:19:19.759 think the other part of the design that is probably 400 00:19:20.640 --> 00:19:23.319 not that obvious is so that the I mean the 401 00:19:23.400 --> 00:19:25.839 NX the credit of the NX project. I was very 402 00:19:25.880 --> 00:19:28.640 impressed they actually figured out that they had this shell 403 00:19:28.680 --> 00:19:31.960 injection vulnerability and they fixed their get of action two 404 00:19:32.039 --> 00:19:37.039 years before this attack happened. So from their perspective, they 405 00:19:37.079 --> 00:19:40.079 fixed the problem, like they fixed the echo issue, you know, 406 00:19:40.200 --> 00:19:42.160 and so how are they still affected? 407 00:19:42.240 --> 00:19:44.680 Right? That's kind of another interesting part of the story. 408 00:19:45.680 --> 00:19:47.759 It turns out that if you have an old branch 409 00:19:48.039 --> 00:19:51.240 that still has the you know, still has an action 410 00:19:51.759 --> 00:19:54.799 on that branch, then anyone can open a PR against 411 00:19:54.839 --> 00:19:57.480 an old branch, right like when you open prs, you 412 00:19:57.519 --> 00:19:59.480 can target any branch. You don't have to open the 413 00:19:59.480 --> 00:20:02.000 PR on or on Maine. You can open the PR 414 00:20:02.319 --> 00:20:04.200 on something from two years ago if if the branch 415 00:20:04.240 --> 00:20:07.079 is still there. And so they had fixed this issue 416 00:20:07.359 --> 00:20:09.920 two years before, but it was still lying around on 417 00:20:09.920 --> 00:20:12.200 a whole branch, and so again to me, that's like, 418 00:20:12.359 --> 00:20:16.319 I guess technically that's probably explained somewhere in the get 419 00:20:16.319 --> 00:20:20.720 of Actions documentation, but I you know, I as security 420 00:20:20.799 --> 00:20:23.039 person probably wouldn't have made that connection. 421 00:20:23.160 --> 00:20:25.400 Like I you know, I don't. I like to be kind. 422 00:20:25.480 --> 00:20:28.400 I like to sort of be try to have some 423 00:20:28.440 --> 00:20:29.960 grace for people that are just trying to do their 424 00:20:29.960 --> 00:20:31.559 best to like do things right. And I think there 425 00:20:31.640 --> 00:20:33.079 was a lot of things that the NX team did 426 00:20:33.119 --> 00:20:35.160 really well here and yet despite all that, like they 427 00:20:35.200 --> 00:20:35.920 were still affected. 428 00:20:35.920 --> 00:20:37.400 So I definitely put some of the blame on the 429 00:20:37.400 --> 00:20:38.680 design to get of actions here. 430 00:20:38.799 --> 00:20:41.000 Well. You know that's interesting because I can remember, I 431 00:20:41.000 --> 00:20:42.759 don't remember when it was, I want to say, within 432 00:20:42.799 --> 00:20:48.200 the past year somebody raising a question with GitHub regarding 433 00:20:48.480 --> 00:20:51.599 the deletion of branches and whether or not they're truly deleted, 434 00:20:52.599 --> 00:20:56.720 and you know, because they're thinking, Okay, I'm deleting a branch, 435 00:20:56.759 --> 00:20:59.480 it's gone, and getthub saying no, that's a beat or 436 00:20:59.480 --> 00:21:02.200 not a bove ug, you know, as they purposely keep 437 00:21:02.240 --> 00:21:04.680 old branches around if you say you've deleted them. And 438 00:21:04.720 --> 00:21:09.039 I was like, okay, and I can think of I 439 00:21:09.079 --> 00:21:14.720 can think of a time where that has been useful, 440 00:21:15.599 --> 00:21:17.559 you know, where I wanted to recuperate an old branch 441 00:21:17.640 --> 00:21:19.359 for some reason and it's still and I know they 442 00:21:19.400 --> 00:21:22.319 get up and deleted, but you know, at the same time, 443 00:21:22.319 --> 00:21:25.240 that looks like a two edged sword in the case 444 00:21:25.240 --> 00:21:27.440 that you're describing that someone thinks they deleted it, but 445 00:21:27.519 --> 00:21:30.039 it's really not. And so now you got to worry 446 00:21:30.079 --> 00:21:32.400 about old branch you supposedly deleted, which is still around. 447 00:21:32.400 --> 00:21:35.799 It can be used as an attack vector. Yeah, my 448 00:21:35.839 --> 00:21:38.599 head spins just thinking about it. So anyway, this. 449 00:21:38.640 --> 00:21:40.759 Also matters a lot when you're trying to clean up 450 00:21:40.799 --> 00:21:44.279 like an accidental commit that contains a secret or token 451 00:21:44.480 --> 00:21:47.359 and you go intro you forced push to try to 452 00:21:47.359 --> 00:21:50.680 get rid of it from the history, and but then 453 00:21:50.680 --> 00:21:53.759 it's actually like still lying around on GitHub. 454 00:21:54.200 --> 00:21:58.319 So for those folks that don't know, if you know, to. 455 00:21:58.240 --> 00:22:03.960 Commit hash of the the commit that contains the the 456 00:22:04.000 --> 00:22:05.400 secret or the you know, the one that you thought 457 00:22:05.400 --> 00:22:06.839 you did, the commit that you thought you deleted, if 458 00:22:06.880 --> 00:22:09.240 you put that commit hash into GitHub, it'll actually still 459 00:22:09.279 --> 00:22:12.200 be there forever. It's just immutable, like it's just the 460 00:22:12.440 --> 00:22:15.799 URL that just will exist forever with whatever you whatever 461 00:22:15.880 --> 00:22:18.119 data you thought you deleted. So if you want to 462 00:22:18.119 --> 00:22:20.039 actually fully delete it, you have to contact get up 463 00:22:20.079 --> 00:22:24.599 support and basically ask them to going manually. Yeah yeah, 464 00:22:24.640 --> 00:22:27.799 so yeah, even if you force pushed, the only only truly. Truly, 465 00:22:27.960 --> 00:22:29.359 I think the clean way to fix it is to 466 00:22:29.440 --> 00:22:33.599 completely delete their entire repo. But even then you might 467 00:22:33.680 --> 00:22:36.119 have forks. If it's been a public repo and someone's 468 00:22:36.160 --> 00:22:39.640 forked it, then my understanding is that that the fork 469 00:22:40.200 --> 00:22:43.599 actually then kind of keeps a reference to all those 470 00:22:43.640 --> 00:22:47.240 commits and then still won't get deleted. So yeah, you 471 00:22:47.240 --> 00:22:49.039 should just assume if it's been ever in a commit 472 00:22:49.119 --> 00:22:51.079 and it's been pushed to get hub like, it's public forever. 473 00:22:51.119 --> 00:22:53.599 Even if you've force pushed over it like, it's basically 474 00:22:53.880 --> 00:22:57.039 you can't bring you can't put the toothpaste back in 475 00:22:57.039 --> 00:23:00.880 the tube. 476 00:23:02.839 --> 00:23:05.680 Interesting, Yeah, well it makes you nervous. So the only 477 00:23:05.759 --> 00:23:06.680 so if you delete it. 478 00:23:06.759 --> 00:23:08.599 So what you're saying, and if I understand at least 479 00:23:08.640 --> 00:23:11.400 forget up, I use getting lab in my day to 480 00:23:11.480 --> 00:23:13.200 day work, we're using get labs, so I'm not sure 481 00:23:13.240 --> 00:23:14.799 if all of this carries. 482 00:23:14.480 --> 00:23:15.359 Over there as well. 483 00:23:16.079 --> 00:23:19.880 But the so, if you delete the entire repo, then 484 00:23:20.119 --> 00:23:23.279 you know, say it was private and nobody's forked, then 485 00:23:23.319 --> 00:23:28.119 it should be gone. But individual branches are not truly 486 00:23:28.200 --> 00:23:32.119 deleted within a repo that's still up. 487 00:23:32.680 --> 00:23:36.079 Yeah, the repo's up then then the commits, the then 488 00:23:36.160 --> 00:23:40.680 specific commit hashes if you know, those hashes will allow 489 00:23:40.720 --> 00:23:45.519 you to recover the data. So, uh, the question is 490 00:23:45.519 --> 00:23:47.240 how do you find that hash. I'm not an expert 491 00:23:47.279 --> 00:23:52.759 in this stuff, so I'm kind of uh talking mostly 492 00:23:52.839 --> 00:23:54.599 based off of some research I read that was put 493 00:23:54.599 --> 00:23:57.279 out by the truffle Hog team. You know, a truffle 494 00:23:57.279 --> 00:24:00.480 hog is like a security tool that lets use for 495 00:24:01.400 --> 00:24:05.519 tokens and secrets in things like get ub repos and 496 00:24:05.519 --> 00:24:07.359 they've done a lot of research on this area. So 497 00:24:07.359 --> 00:24:09.240 if if you search for their blog, you can kind 498 00:24:09.240 --> 00:24:10.680 of find out find out some of this stuff that 499 00:24:10.960 --> 00:24:12.000 Dylan Iri. 500 00:24:12.000 --> 00:24:14.000 Is the the. 501 00:24:13.799 --> 00:24:16.480 Founder and creator of that project over there, and it's 502 00:24:16.480 --> 00:24:17.960 where I kind of learned most of the stuff from. 503 00:24:18.000 --> 00:24:20.119 But yeah, I think so the short version is just 504 00:24:20.200 --> 00:24:22.079 if it's if if you've ever pushed it up to 505 00:24:22.079 --> 00:24:25.319 get hub, assume it's gone and you know, assume it's 506 00:24:25.319 --> 00:24:27.240 out there, and then there is a there is a 507 00:24:27.240 --> 00:24:29.880 way to kind of contact support and get those those 508 00:24:29.880 --> 00:24:31.039 commit hashes removed. 509 00:24:31.119 --> 00:24:37.480 But you you know, you you should just you should 510 00:24:37.480 --> 00:24:40.240 still obviously rotate the tokens and you know, revoke them 511 00:24:40.240 --> 00:24:42.359 if you can, and try to try to assume all 512 00:24:42.400 --> 00:24:44.400 that data is just gone even even if you do that. 513 00:24:45.720 --> 00:24:48.240 Right, Yeah, I don't know how it works get lab. 514 00:24:48.279 --> 00:24:50.720 That's that's another that's another interesting question though. 515 00:24:52.759 --> 00:24:54.519 Yeah, so, uh, do you want to talk about the 516 00:24:54.640 --> 00:24:56.559 uh the chalk one now? 517 00:24:56.640 --> 00:25:00.759 The ones that go to yeah, okay in regards to 518 00:25:00.799 --> 00:25:05.000 another two f a email reset and being compromised. 519 00:25:04.839 --> 00:25:07.359 Yeah, that's right. That one was was a similar email. 520 00:25:07.559 --> 00:25:10.759 This time the email originated from support at npm JS 521 00:25:10.880 --> 00:25:11.519 dot help. 522 00:25:13.079 --> 00:25:15.599 So, uh, I don't know. I I kind of feel 523 00:25:15.599 --> 00:25:15.759 like that. 524 00:25:15.799 --> 00:25:20.079 Email is obviously not not not legit, but that then 525 00:25:20.200 --> 00:25:23.160 that said, you know, there are a lot of companies 526 00:25:23.160 --> 00:25:23.839 these days. 527 00:25:23.680 --> 00:25:26.319 Using these these interesting new TLDs. 528 00:25:26.920 --> 00:25:28.240 And is help legit? 529 00:25:28.359 --> 00:25:28.720 Is that a? 530 00:25:29.039 --> 00:25:29.680 Is that a tl D? 531 00:25:30.880 --> 00:25:32.799 I suppose it is? Yeah, let me see uh Google 532 00:25:32.920 --> 00:25:33.680 really quickly. 533 00:25:33.440 --> 00:25:36.720 Here, Yeah, Google looked. There's so many it's hard to 534 00:25:36.759 --> 00:25:37.680 keep track from all. 535 00:25:37.880 --> 00:25:39.519 Yeah, it's like any word, you know. The one that 536 00:25:39.559 --> 00:25:40.599 really the world only really. 537 00:25:40.519 --> 00:25:42.039 Still bothers me that they made it to a TLD 538 00:25:42.160 --> 00:25:46.000 is dot zip because now you can Yeah, you can 539 00:25:46.039 --> 00:25:48.079 have a file name that's like dot zip and you're 540 00:25:48.119 --> 00:25:49.559 just typing it out the name of it and then 541 00:25:49.559 --> 00:25:52.079 it'll get it'll automatically turn into a link in a 542 00:25:52.079 --> 00:25:55.440 lot of programs now and it's like, yeah. 543 00:25:54.599 --> 00:25:55.519 I'm trying to do here. 544 00:25:56.000 --> 00:26:00.119 Yeah, but anyway, uh yeah, so so so it. But 545 00:26:00.160 --> 00:26:01.759 I think, you know, again, like the phishing email stuff, 546 00:26:01.759 --> 00:26:04.960 it's really effective, surprisingly effective. Even people that are security 547 00:26:05.000 --> 00:26:07.000 experts fall for this stuff sometimes. So I don't want 548 00:26:07.039 --> 00:26:08.759 to put any blame on the on the maintainer. The 549 00:26:08.759 --> 00:26:12.240 only thing I'll say is, like, you know, phishing resistant 550 00:26:12.240 --> 00:26:15.759 to FA would have would have solved these problems. And 551 00:26:15.799 --> 00:26:17.880 so for those who don't know what is fishing resistant 552 00:26:17.920 --> 00:26:19.519 t FA, I'm just going. 553 00:26:19.440 --> 00:26:21.279 To ask that. Yeah. 554 00:26:21.319 --> 00:26:23.519 So two FA is just you know, a second factor right, 555 00:26:23.599 --> 00:26:26.079 second factor to two factor authentication. It's just the idea 556 00:26:26.119 --> 00:26:29.640 that you provide, you know, some other evidence that you 557 00:26:29.680 --> 00:26:33.039 are who you are besides your password. Typically you'll see 558 00:26:33.039 --> 00:26:35.240 things like a time based code, or you'll see like 559 00:26:35.480 --> 00:26:37.880 a text, like a two factor a text or by 560 00:26:37.960 --> 00:26:41.680 another app or something like that. That's all great, it's 561 00:26:41.680 --> 00:26:45.119 better than than just having a password alone. But the 562 00:26:45.160 --> 00:26:47.039 gold standard what you really want to have is phishing 563 00:26:47.119 --> 00:26:50.119 resistant TUFA. And what that is is it's basically a 564 00:26:50.119 --> 00:26:54.160 two FA method that is resistant to phishing attacks. 565 00:26:55.079 --> 00:26:55.720 What does that mean? 566 00:26:55.759 --> 00:26:59.240 That means that there's no way to trick a person, 567 00:26:59.319 --> 00:27:02.640 a human ofulnerable, you know, human to take that to 568 00:27:02.759 --> 00:27:05.599 a fake token and to put it into the wrong website, 569 00:27:05.759 --> 00:27:08.240 to put it onto a fake website. So how is 570 00:27:08.240 --> 00:27:11.880 that enforced. Well, let's let's take a simple example of 571 00:27:12.039 --> 00:27:12.680 one of those methods. 572 00:27:12.680 --> 00:27:13.559 It would be a UBI key. 573 00:27:13.720 --> 00:27:15.720 So for those who haven't seen them, they're the diesel 574 00:27:15.880 --> 00:27:17.799 you know, hardware tokens that you can. 575 00:27:17.839 --> 00:27:18.440 You can buy it. 576 00:27:18.920 --> 00:27:21.640 I've used those, yeah, yeah, So what's what's one of 577 00:27:21.720 --> 00:27:24.680 the best things about those is that they will refuse 578 00:27:24.839 --> 00:27:28.039 to give up the you know, the key material to 579 00:27:28.119 --> 00:27:31.480 the wrong domain. So if you're on a fake website, 580 00:27:31.480 --> 00:27:34.359 you're on a fake NPM website and you you ask 581 00:27:34.480 --> 00:27:36.079 that you know, you touch the key and you ask 582 00:27:36.160 --> 00:27:38.559 it to provide key material, it won't provide the key 583 00:27:38.599 --> 00:27:41.359 material to the wrong domain. It's going to provide different 584 00:27:41.400 --> 00:27:43.960 key material to the to the attacker. So what that 585 00:27:44.039 --> 00:27:47.519 means is that it can't be tricked. Right, it works 586 00:27:47.559 --> 00:27:50.319 directly with the browser to enforce that it's you know, 587 00:27:50.799 --> 00:27:53.279 providing material to the correct domain. 588 00:27:53.440 --> 00:27:56.039 And and so that's that's why it's awesome. The other 589 00:27:56.079 --> 00:27:57.200 one you bought one of these. 590 00:27:57.279 --> 00:27:58.160 I've used these before. 591 00:27:58.200 --> 00:28:01.039 We had a fob, yeah, and they're there's another one 592 00:28:01.079 --> 00:28:02.960 that I had and I can't find where it was. 593 00:28:03.119 --> 00:28:05.599 I would plug it into a port on the laptop 594 00:28:05.680 --> 00:28:09.759 and you had to touch it yep, like USBC type port. 595 00:28:10.079 --> 00:28:12.599 Yeah, So that the only kind it's it's all like 596 00:28:12.640 --> 00:28:15.960 the real benefit of it is just that it it's 597 00:28:16.000 --> 00:28:18.799 sort of the site get The site knows that, Okay, 598 00:28:18.799 --> 00:28:21.400 I'm talking to the person who's in physical possession of 599 00:28:21.400 --> 00:28:24.559 this device, so they know that, you know, someone some 600 00:28:24.680 --> 00:28:27.200 attacker isn't unless they stole the device from you, right, Like, 601 00:28:27.759 --> 00:28:29.599 what they're validating is that you have this physically in 602 00:28:29.599 --> 00:28:31.440 your possession. But the other piece of it is the 603 00:28:31.440 --> 00:28:33.759 fishing resistance. So the device is smart enough to not 604 00:28:33.799 --> 00:28:36.440 give up the material to the wrong domain because it's 605 00:28:36.480 --> 00:28:38.640 it's literally working with the browser to check the domain 606 00:28:38.720 --> 00:28:41.200 and only provide it to the correct domain. 607 00:28:41.440 --> 00:28:42.640 So that's the kind of power of it. 608 00:28:42.839 --> 00:28:44.440 The other thing you've probably seen a lot more of 609 00:28:44.480 --> 00:28:47.160 these days is past keys, and there's a lot of 610 00:28:47.200 --> 00:28:49.319 sites that are prompting you now for past keys. And 611 00:28:51.200 --> 00:28:53.200 for a while I was like another thing I have 612 00:28:53.240 --> 00:28:55.680 to learn. But but past keys are also really cool. 613 00:28:56.039 --> 00:29:01.799 Passkeys have the same property in that they uh, it's 614 00:29:01.880 --> 00:29:04.039 it's working with either your you know, your your pastor 615 00:29:04.079 --> 00:29:07.480 manager or your operating system to store this pass key. 616 00:29:07.720 --> 00:29:09.640 And this pass key will only ever be given up 617 00:29:09.680 --> 00:29:12.319 to the correct domain. So again it's fishing resistant. It 618 00:29:12.319 --> 00:29:15.759 can't be tricked to you know, it won't get entered 619 00:29:15.799 --> 00:29:18.720 into a into a fake site. 620 00:29:18.920 --> 00:29:21.799 So appractically if I'm wrong, But a pass key is 621 00:29:21.799 --> 00:29:24.680 is specific to the device, right, So you can't have 622 00:29:24.759 --> 00:29:27.480 one key passkey that you use in multiple places or 623 00:29:27.559 --> 00:29:28.079 is that wrong? 624 00:29:28.559 --> 00:29:31.279 It does lock you to a device in theory, although 625 00:29:31.279 --> 00:29:32.960 I can, like I have one password and I put 626 00:29:33.000 --> 00:29:35.400 my pass key into my one password, and you. 627 00:29:35.400 --> 00:29:35.759 Can do that. 628 00:29:35.839 --> 00:29:37.720 Yeah, you can do that. Yeah, And in that way, 629 00:29:37.960 --> 00:29:40.519 if you get a new device or you get a you. 630 00:29:40.480 --> 00:29:42.920 Know, like I can set up my pass key once 631 00:29:42.960 --> 00:29:45.160 on my computer and then when I'm on my phone, 632 00:29:45.279 --> 00:29:46.960 I have my one password there as well, and I 633 00:29:47.000 --> 00:29:48.720 can just log into the same site. I don't have 634 00:29:48.759 --> 00:29:52.079 to keep binding numerous pass keys on every device and 635 00:29:52.079 --> 00:29:53.640 do it all over again when I get a new device. 636 00:29:54.319 --> 00:29:56.039 Yeah, because I have that same setup because we use 637 00:29:56.079 --> 00:29:57.960 one password at work and I use it like for 638 00:29:58.079 --> 00:30:01.240 a DP which is our you know, personal HR management stuff, 639 00:30:01.680 --> 00:30:03.680 and I use it there all the time with you know, 640 00:30:03.799 --> 00:30:07.160 with the fingerprint you know on my MacBook, which is 641 00:30:07.200 --> 00:30:09.200 tied to one password which then gets me in. 642 00:30:09.200 --> 00:30:11.599 But I didn't realize I could use that across devices. 643 00:30:11.880 --> 00:30:13.680 That's cool, Okay, yeah. 644 00:30:13.519 --> 00:30:15.200 I think you can. So I'm not sure that the 645 00:30:15.200 --> 00:30:16.319 standard is very complicated. 646 00:30:16.400 --> 00:30:18.400 There might be a way that some sites can like 647 00:30:18.519 --> 00:30:22.480 prevent you from putting your pass key into something that 648 00:30:22.759 --> 00:30:26.440 has cloud sync, but don't quote me on that. 649 00:30:26.480 --> 00:30:28.039 I'm not I'm not, like, I just know there's. 650 00:30:27.839 --> 00:30:30.480 A lot of complicated options, and sites can demand certain 651 00:30:30.720 --> 00:30:33.960 properties of the of the device, of the. 652 00:30:33.839 --> 00:30:35.119 Of where the pass key is being stored. 653 00:30:35.359 --> 00:30:38.200 But generally Mike had I already put it on Twitter 654 00:30:38.359 --> 00:30:40.279 Frost said that pass key I'm kidding. 655 00:30:41.200 --> 00:30:43.799 No, it's a bit but but but in my experience, 656 00:30:43.799 --> 00:30:45.519 I can basically put a pass key into one password 657 00:30:45.559 --> 00:30:47.799 any any any any. 658 00:30:47.720 --> 00:30:50.039 Any time I've been prompted, So it's pretty cool. 659 00:30:50.279 --> 00:30:51.759 So anyway, the reason I bring all that up is 660 00:30:51.759 --> 00:30:55.599 just to say that like like basically, like the the 661 00:30:55.640 --> 00:30:57.680 maintainers wouldn't have been able to be tricked if if 662 00:30:57.799 --> 00:31:01.559 NPM had mandated to f A with this fishing resistant property. 663 00:31:02.519 --> 00:31:05.799 So it's somewhat disappointing that, you know, this was, you know, 664 00:31:06.400 --> 00:31:09.240 somewhat preventable, you know, if NPM would have been willing 665 00:31:09.279 --> 00:31:12.799 to kind of force this on maintainers, which is, you know, 666 00:31:12.920 --> 00:31:14.119 I'm not saying it's costless. 667 00:31:14.160 --> 00:31:16.880 Obviously, there's there's some cost of kind of making everybody. 668 00:31:16.839 --> 00:31:20.759 Go through this, but but for prolific maintainers with access 669 00:31:20.839 --> 00:31:25.920 to you know, billions and billions of downloads per week, 670 00:31:26.359 --> 00:31:29.599 you know, I think it's it's probably a it's obviously, 671 00:31:29.640 --> 00:31:31.319 in my opinion, a good trade off to make those 672 00:31:31.400 --> 00:31:35.079 maintainers take this extra step. So what happened here was 673 00:31:35.119 --> 00:31:38.000 this Kicks maintainer was compromised, he fell for the fishing attack, 674 00:31:38.440 --> 00:31:40.559 and then he had access to a lot of Cinder 675 00:31:40.599 --> 00:31:45.799 sources packages and cinder sources. An awesome, amazing prolific maintainer 676 00:31:45.880 --> 00:31:47.720 who has some of the most useful and. 677 00:31:47.680 --> 00:31:48.960 Popular packages on NPM. 678 00:31:50.039 --> 00:31:53.079 Power is a huge, huge portion of the job script ecosystem, 679 00:31:53.640 --> 00:31:58.359 and so that compromise was was able to get able 680 00:31:58.359 --> 00:32:02.440 to allow the attacker to insert some code into those packages. 681 00:32:02.799 --> 00:32:05.039 In this case, the code was a scrypto stealing code. 682 00:32:05.960 --> 00:32:10.240 So it worked by hooking into the fetch API and 683 00:32:10.279 --> 00:32:16.440 the xml httpeer quest API and various like wallet provider APIs. 684 00:32:16.519 --> 00:32:18.440 And so what it did was it was if you 685 00:32:18.480 --> 00:32:20.720 called those functions in your in your front end of 686 00:32:20.720 --> 00:32:22.880 your site, it would be able to be able to 687 00:32:22.920 --> 00:32:26.519 rewrite the transaction data and replace the legitimate addresses with 688 00:32:26.920 --> 00:32:29.880 tackle control addresses. So they were just actively trying to 689 00:32:30.480 --> 00:32:32.680 you know, insert themselves in the flow and like make 690 00:32:32.720 --> 00:32:34.359 sure that you sent the money to them instead of 691 00:32:34.359 --> 00:32:35.799 to your intended recipient. 692 00:32:38.440 --> 00:32:40.000 Yeah. I remember when that came out, there was a 693 00:32:40.039 --> 00:32:44.160 bunch of them, and by the time we got notification 694 00:32:44.200 --> 00:32:45.079 and looked, I know that. 695 00:32:46.599 --> 00:32:48.000 Uh was I talk. 696 00:32:48.160 --> 00:32:49.640 That's the one that comes to mind. I know there's 697 00:32:49.640 --> 00:32:52.319 some other libraries that already had an updated version. I 698 00:32:52.319 --> 00:32:54.480 think they'd rolled back to a previous commit or something 699 00:32:54.559 --> 00:32:56.599 like that. I don't remember how they did it. And 700 00:32:56.680 --> 00:32:58.400 so if you installed that then you were pretty good. 701 00:32:59.279 --> 00:33:01.039 Yeah, but this was a lot of popular packages. 702 00:33:01.079 --> 00:33:07.720 There was like chalk color packages, debug it's a big 703 00:33:07.720 --> 00:33:08.720 one that people use. 704 00:33:08.519 --> 00:33:09.480 I use dbug. 705 00:33:10.960 --> 00:33:12.359 Yeah, so there's just a lot of these, a lot 706 00:33:12.359 --> 00:33:15.559 of like low level, widely widely used packages. 707 00:33:16.119 --> 00:33:17.960 Sort of a left pad type thing again. 708 00:33:18.720 --> 00:33:22.079 Yeah, yeah, exactly. Yeah, So that was that was a 709 00:33:22.200 --> 00:33:24.279 very big one. Fortunately it was only live for like 710 00:33:24.319 --> 00:33:26.200 four hours, but if you were unlucky enough to install 711 00:33:26.279 --> 00:33:28.640 during those four hours, you know, you were you were affected. 712 00:33:28.680 --> 00:33:31.279 So this is kind of what why like we started 713 00:33:31.279 --> 00:33:33.119 stock it to be totally honest with you, because it 714 00:33:33.160 --> 00:33:37.319 seems like everybody is like reactive to these things. You know, 715 00:33:37.400 --> 00:33:39.319 Oh I read about oh chalk was compromised. Oh let 716 00:33:39.319 --> 00:33:41.279 me check my system. Did I install the vulnerable version 717 00:33:41.359 --> 00:33:43.319 or the malicious version? And then you just kind of 718 00:33:43.319 --> 00:33:46.200 hope that you were lucky enough to not have run 719 00:33:46.240 --> 00:33:49.880 an NPM update during that window of time. And it 720 00:33:49.880 --> 00:33:51.640 feels like, you know, we got we ought to be 721 00:33:51.640 --> 00:33:53.640 able to do better than this as a community, you know, 722 00:33:53.720 --> 00:33:56.920 as a as an industry, like we can you know, 723 00:33:58.079 --> 00:34:00.279 I mean fundamentally, the problem is we're installing code that 724 00:34:00.319 --> 00:34:02.400 we haven't evaluated. We haven't looked at the code that 725 00:34:02.400 --> 00:34:04.119 we're running. That's really what it comes down to is 726 00:34:04.119 --> 00:34:06.240 we're hitting install, we're pulling code. 727 00:34:06.000 --> 00:34:08.400 In on the internet. We're not looking at it and 728 00:34:08.440 --> 00:34:10.239 then it's we're executing it. 729 00:34:11.039 --> 00:34:16.039 So that's where I think, you know, treat treating this 730 00:34:16.079 --> 00:34:20.159 code differently, treating it as something that's part of your application, 731 00:34:20.920 --> 00:34:23.880 that is your responsibility, is something that isn't just a 732 00:34:23.880 --> 00:34:26.360 black box. It can can change, can help you know, 733 00:34:26.440 --> 00:34:29.320 change change this sort of risk profile. 734 00:34:28.960 --> 00:34:30.880 Here, or you know, you can use a tool to 735 00:34:30.920 --> 00:34:31.199 help you. 736 00:34:31.280 --> 00:34:34.199 And that's what we try to help is looking at 737 00:34:34.239 --> 00:34:38.039 the at the code for you, using a bunch of automation, 738 00:34:38.199 --> 00:34:40.559 a bunch of static analysis, and a bunch of l 739 00:34:40.639 --> 00:34:42.880 ll M kind of like AI analysis to find these 740 00:34:42.880 --> 00:34:47.440 attacks even before uh, you know, anyone else, anyone has 741 00:34:47.519 --> 00:34:49.360 kind of discovered these, Like we're we're scanning of the 742 00:34:49.400 --> 00:34:52.599 automated in an automated manner, all of NPM as well 743 00:34:52.639 --> 00:34:55.920 as all of a bunch of the top ecosystems like 744 00:34:56.000 --> 00:35:02.039 the Python, dot Net, Rust, Ruby, Goo, Scalah, et cetera. 745 00:35:03.559 --> 00:35:05.880 So yeah, so then hopefully you know, we can we 746 00:35:05.920 --> 00:35:08.519 can sort of be in the middle of that and 747 00:35:08.519 --> 00:35:12.159 and and and and prevent those those packages from getting 748 00:35:12.199 --> 00:35:18.440 on your system. Yeah, So that's that's that one, and 749 00:35:18.440 --> 00:35:19.960 then there's there's a few more that came after that. 750 00:35:20.000 --> 00:35:22.079 If you're if you're interested to kind Oh, let's. 751 00:35:21.960 --> 00:35:23.000 Keep going, keep going. 752 00:35:23.039 --> 00:35:26.440 Okay, it sounds like I knew about that last one, 753 00:35:26.920 --> 00:35:31.199 the one Chalk, that's all. But you were telling me 754 00:35:31.239 --> 00:35:33.400 about the newer ones that I apparently haven't heard, so 755 00:35:34.440 --> 00:35:35.599 I want to hear about them. 756 00:35:35.719 --> 00:35:37.800 So after the after the Chalk one, there was another 757 00:35:37.800 --> 00:35:40.840 one that followed the following day, uh, compromised this project 758 00:35:40.840 --> 00:35:43.880 called duck dB, which has three hundred thousand weekly downloads. 759 00:35:43.760 --> 00:35:48.840 And that one duck dB. Yeah, and you did hear 760 00:35:48.840 --> 00:35:49.119 about it. 761 00:35:49.119 --> 00:35:51.079 Okay, well, no, not that, I mean just duck dB. 762 00:35:51.199 --> 00:35:55.599 It's a it's a the tool itself, right right, Okay, Yeah, 763 00:35:55.639 --> 00:35:57.239 And this one was was the same attacker as the 764 00:35:57.280 --> 00:35:59.639 day before, so this was exactly the same malware that 765 00:35:59.679 --> 00:36:03.400 effect Chalk. So this one was clearly the same person. 766 00:36:04.639 --> 00:36:08.559 And then the following week there was another set of attacks. 767 00:36:08.599 --> 00:36:10.360 And this kind of brings us towards the end of 768 00:36:10.360 --> 00:36:14.239 the story. So this one was interesting because it affected 769 00:36:14.320 --> 00:36:16.199 another color library. I don't know why it's always a 770 00:36:16.239 --> 00:36:20.119 color library, but it was a color library called tiny Color. 771 00:36:22.159 --> 00:36:24.960 And on the Monday of September fifteenth, that hit about 772 00:36:24.960 --> 00:36:33.280 forty packages and basically the thing that made this attack 773 00:36:33.360 --> 00:36:40.199 interesting was that it searched your system for so the 774 00:36:40.320 --> 00:36:44.880 malar searched your system for NPM tokens, and if it 775 00:36:44.880 --> 00:36:47.719 found an NPM token, it wouldn't just steal it. It 776 00:36:47.719 --> 00:36:50.599 would actually figure out what are the packages that that 777 00:36:50.679 --> 00:36:54.639 token gives access to. It would download those packages the 778 00:36:54.679 --> 00:36:56.760 tar ball, you know, the actual code of the package, 779 00:36:56.840 --> 00:36:59.960 and it would insert like itself, it would replicate itself 780 00:37:00.039 --> 00:37:03.039 the malware into that package and then publish it back 781 00:37:03.039 --> 00:37:06.840 to NPM. So if your package as a as a 782 00:37:06.840 --> 00:37:08.760 new version of the existing. 783 00:37:08.360 --> 00:37:11.360 Package, oh wow, okay, so. 784 00:37:11.239 --> 00:37:13.519 If you like, like if if you were affected, you 785 00:37:13.559 --> 00:37:14.480 would you would. 786 00:37:14.199 --> 00:37:16.800 Not just have your NPM token stolen, but all your 787 00:37:16.880 --> 00:37:19.320 NPM packages that you maintained that you have access to 788 00:37:19.400 --> 00:37:22.440 would be infected with the same malware, so that it 789 00:37:22.599 --> 00:37:24.960 sort of spreads like a virus, like a worm, through 790 00:37:25.280 --> 00:37:27.719 through all of NPM. And so within like a day, 791 00:37:27.960 --> 00:37:30.400 so by by Tuesday, September sixteenth, By the following day, 792 00:37:30.599 --> 00:37:32.960 five hundred packages had been affected by this. It just 793 00:37:33.000 --> 00:37:36.519 spread like a like a worm, completely through NPM, infecting, 794 00:37:36.559 --> 00:37:40.960 infecting like even some some pretty uh like surprising packages 795 00:37:41.119 --> 00:37:45.960 like crowdstrikes packages, which is a security company that like 796 00:37:46.079 --> 00:37:47.199 a lot of people use, one of the. 797 00:37:47.239 --> 00:37:49.239 Largest security companies. 798 00:37:49.400 --> 00:37:52.159 So it's just interesting to see how wide, uh this 799 00:37:52.559 --> 00:37:54.639 kind of spread before it was before it was. 800 00:37:54.760 --> 00:37:55.360 You know killed. 801 00:37:56.840 --> 00:37:58.760 So I'm looking at the blog post on your side 802 00:37:58.760 --> 00:38:00.920 about this when I believe it is a shi hulud 803 00:38:01.119 --> 00:38:02.519 or is that. 804 00:38:03.000 --> 00:38:04.000 The one you're talking about? 805 00:38:04.079 --> 00:38:04.480 That's right? 806 00:38:04.559 --> 00:38:08.679 Yeah, okay, yeah, so the malware they called it that 807 00:38:08.719 --> 00:38:12.880 because of I think as a reference to the Dune. 808 00:38:14.960 --> 00:38:17.280 Oh that's right, Okay, I did hear that. I remember that. 809 00:38:18.159 --> 00:38:19.719 Yeah. 810 00:38:20.239 --> 00:38:21.880 Yeah, this was like the first line with that out 811 00:38:21.880 --> 00:38:25.480 there before it got probably like two days or so. 812 00:38:25.800 --> 00:38:27.639 It was probably like a couple of days it was 813 00:38:27.679 --> 00:38:30.079 out before it was caught. Report was fully shut. 814 00:38:29.920 --> 00:38:31.000 Down because it's a long time. 815 00:38:31.760 --> 00:38:32.800 Yeah, they kept. 816 00:38:33.039 --> 00:38:36.360 Changing the malware, like the actual payload, so that there 817 00:38:36.400 --> 00:38:38.400 was like six or seven different versions that we were 818 00:38:38.400 --> 00:38:42.599 able to identify across the different packages. So you know, 819 00:38:42.719 --> 00:38:44.360 they kept evolving it to make it a little bit 820 00:38:45.440 --> 00:38:50.360 better and fix different bugs in the worm. But the ultimately, 821 00:38:50.360 --> 00:38:53.320 you know, was kind of petered out I think due 822 00:38:53.320 --> 00:38:56.719 to kind of once NPM realized once you know, we 823 00:38:56.760 --> 00:38:58.599 had we and others had reported at ten PM. I 824 00:38:58.599 --> 00:39:05.079 think they have helped helped shred it down. So yeah, 825 00:39:05.079 --> 00:39:07.280 I mean, it's it's it's it's funny because like this 826 00:39:07.400 --> 00:39:10.599 concept of an NPM worm had been known about and 827 00:39:10.639 --> 00:39:13.480 talked about for several years before this happened. Like there'd 828 00:39:13.519 --> 00:39:16.840 been some some folks that had written posts about like, oh, 829 00:39:16.840 --> 00:39:18.239 I could make a worm and it would take over 830 00:39:18.280 --> 00:39:20.280 all of NPM and in a day. And you know, 831 00:39:20.280 --> 00:39:22.199 they just just blog posts on this that you can 832 00:39:22.199 --> 00:39:24.639 find find where people are you know, good, good, good 833 00:39:24.679 --> 00:39:27.360 folks like good maintainers were sort of speculating about this 834 00:39:27.400 --> 00:39:29.960 and writing about this, but we'd never actually seen it happen. 835 00:39:30.360 --> 00:39:32.920 So it seems like the attackers finally like realized that 836 00:39:33.000 --> 00:39:37.400 they should try to do that and and and you know, 837 00:39:37.400 --> 00:39:39.760 and it worked to some extent. I think that the 838 00:39:39.800 --> 00:39:41.440 issue with all these things though, is that they're so 839 00:39:41.559 --> 00:39:44.559 noisy that they end up being caught by the community 840 00:39:44.719 --> 00:39:47.840 or by security companies like Socket pretty quickly. 841 00:39:48.440 --> 00:39:48.800 Uh. 842 00:39:48.840 --> 00:39:51.880 And once once people are aware, then you know, we 843 00:39:51.920 --> 00:39:54.280 can put blocks in place for all of our customers 844 00:39:54.320 --> 00:39:57.079 to prevent them from bringing those in. And and then 845 00:39:57.880 --> 00:40:00.239 you know, once the registries alerted in there and if 846 00:40:00.400 --> 00:40:01.960 they're on top of things that can help shut these 847 00:40:01.960 --> 00:40:05.320 things down. So the real kind of reason we've been 848 00:40:05.440 --> 00:40:07.559 so lucky as a community that these things haven't been 849 00:40:07.599 --> 00:40:10.960 more deadly or more dangerous is that the attackers have 850 00:40:11.039 --> 00:40:14.800 been kind of noisy, i'd say, like loud and noisy, 851 00:40:14.840 --> 00:40:16.320 maybe a little clumsy. 852 00:40:15.920 --> 00:40:17.559 In the way that they've done these attacks. 853 00:40:17.840 --> 00:40:20.159 If you were smarter, you would actually be sneakier, and 854 00:40:20.199 --> 00:40:23.239 you would you know, try to last for several weeks 855 00:40:23.280 --> 00:40:26.440 or months without detection and then you know, and during 856 00:40:26.480 --> 00:40:29.840 that time kind of spread far and wide, whereas these 857 00:40:29.840 --> 00:40:31.920 things keep getting shut and shut down in a few hours. 858 00:40:32.360 --> 00:40:34.199 And so, yes, it still affects a lot of people. 859 00:40:34.239 --> 00:40:36.159 I mean, if you have a package with billions of 860 00:40:36.159 --> 00:40:38.320 downloads and it's live for four hours, that that's still. 861 00:40:38.159 --> 00:40:39.119 Going to hit a lot of people. 862 00:40:40.079 --> 00:40:42.639 But I think it would be much worse if it 863 00:40:42.679 --> 00:40:44.280 had been live for weeks, right, And that's kind of 864 00:40:44.280 --> 00:40:46.320 why I think they're failing to do right now today. 865 00:40:47.880 --> 00:40:50.599 Yeah, I can think of, you know, not necessarily the 866 00:40:50.679 --> 00:40:53.159 same thing, but in terms of data hacks or intrusions, 867 00:40:53.199 --> 00:40:55.519 you know that they find that have been around for 868 00:40:55.679 --> 00:40:58.280 months or you know, Microsoft, I thinks had a couple, 869 00:40:58.440 --> 00:41:00.719 and there's other ones that could to mine where they've 870 00:41:00.760 --> 00:41:02.719 been in there for months, you know, like, oh, good lord, 871 00:41:02.760 --> 00:41:04.239 they've had time to find everything. 872 00:41:04.760 --> 00:41:07.039 M yeah, totally. 873 00:41:08.079 --> 00:41:12.079 So I'm just thinking that sort of a you know, 874 00:41:12.119 --> 00:41:14.719 back to your two edged sword. It's like, Okay, you 875 00:41:14.760 --> 00:41:16.119 create a product of the great product. 876 00:41:16.199 --> 00:41:17.079 Everybody's using it. 877 00:41:17.159 --> 00:41:21.639 Now your responsibility increases with that too, to to you know, 878 00:41:21.760 --> 00:41:25.159 to protect your users, because I think I think of 879 00:41:25.159 --> 00:41:28.280 a lot of us assume oh MPM. Everybody's pushing packages 880 00:41:28.239 --> 00:41:31.599 the MPM. It must be safe. They're not any problems, right. 881 00:41:32.840 --> 00:41:37.960 But you were talking about the uh, the blog posts 882 00:41:37.960 --> 00:41:40.039 that you know, people had written, say hey, I wonder 883 00:41:40.159 --> 00:41:42.280 you know, I wanted to write a worm, I could 884 00:41:42.360 --> 00:41:45.239 do this and this. So were those in retrospect that 885 00:41:45.480 --> 00:41:47.719 you know, people noticed those blog posts that people had 886 00:41:47.760 --> 00:41:50.039 been writing, or was that you know, people had been 887 00:41:52.400 --> 00:41:54.679 somehow bad guy just read it, you know, saw those 888 00:41:54.719 --> 00:41:56.599 and said hey, let's try it. But was it in 889 00:41:56.599 --> 00:41:58.800 retrospect that people said, oh, yeah, somebody had been writing 890 00:41:58.840 --> 00:42:00.559 about this for a while, we should have done something 891 00:42:00.559 --> 00:42:01.000 about it. 892 00:42:03.519 --> 00:42:07.519 I think that likely the attackers probably just independently thought 893 00:42:07.559 --> 00:42:10.599 of it. I mean, so many I don't know, I mean. 894 00:42:10.519 --> 00:42:12.880 Who knows, but I feel like I feel like this 895 00:42:13.000 --> 00:42:15.920 is the kind of thing that if you have the 896 00:42:16.000 --> 00:42:19.039 attacker mindset or the security mindset that you know, you 897 00:42:19.079 --> 00:42:21.199 think of these things just for fun all the time, 898 00:42:21.320 --> 00:42:21.960 like you. 899 00:42:21.920 --> 00:42:24.599 Know, I mean, like hackers are. 900 00:42:25.840 --> 00:42:29.119 You know, it's it's obviously that all the things we've 901 00:42:29.119 --> 00:42:31.880 been talking about in this podcast are all bad in 902 00:42:31.920 --> 00:42:34.840 the sense that they're all you know, stealing data and 903 00:42:34.880 --> 00:42:38.440 it's all it's all crimes. But there's another angle by which, 904 00:42:38.719 --> 00:42:41.880 you know, hacking more generally is is kind of this 905 00:42:42.320 --> 00:42:45.920 creative endeavor, you know, where you're trying to find a 906 00:42:46.000 --> 00:42:48.800 gap between the written rules of a system and the 907 00:42:48.840 --> 00:42:52.320 actual rules of a system. So the written rules of 908 00:42:52.360 --> 00:42:54.559 the system say, you know, like yeah, n PM's a 909 00:42:54.559 --> 00:42:57.519 place you publish code, and you know it's you know, 910 00:42:59.119 --> 00:43:02.239 you know, legitimate, only legitimate people can publish code there, 911 00:43:02.280 --> 00:43:03.880 and you know therefore you can. 912 00:43:03.840 --> 00:43:04.639 Kind of rely on it. 913 00:43:04.679 --> 00:43:06.679 But the actual rules of the system are you know, 914 00:43:06.880 --> 00:43:09.000 there's any ways to get access to packages that you 915 00:43:09.039 --> 00:43:11.760 shouldn't have access to, and and kind of the attackers 916 00:43:11.800 --> 00:43:14.639 and these hackers are good at seeing those gaps, and 917 00:43:14.679 --> 00:43:18.199 that's that's really what hacking is is seeing these these 918 00:43:18.239 --> 00:43:21.000 gaps or these differences between the way the way the 919 00:43:21.000 --> 00:43:21.960 system is supposed to. 920 00:43:21.880 --> 00:43:23.800 Work, the way that works on paper, and the way 921 00:43:23.800 --> 00:43:24.679 that it actually works. 922 00:43:25.320 --> 00:43:27.559 And so I think any kind of creative mind or 923 00:43:27.719 --> 00:43:30.039 you know, good hacker mind could could have thought of 924 00:43:30.079 --> 00:43:33.079 something like this, this worm, and it's just a matter 925 00:43:33.119 --> 00:43:34.960 of you know, who's going to think of it and 926 00:43:34.960 --> 00:43:35.440 who's going. 927 00:43:35.360 --> 00:43:37.599 To do it. So that's why there's als be more attacks. 928 00:43:37.639 --> 00:43:40.639 I mean, that's why security is interesting really, to be 929 00:43:40.679 --> 00:43:44.760 honest with you, Like, I love it because it's always changing. 930 00:43:44.760 --> 00:43:47.639 You have you have an adversary that's evolving and changing. 931 00:43:47.800 --> 00:43:50.800 You know, if you learn like architecture or you learn 932 00:43:51.320 --> 00:43:53.599 you know, pick your peak, your whatever field that you pick. 933 00:43:53.960 --> 00:43:57.000 Like, you know, the laws of gravity don't change. 934 00:43:57.000 --> 00:43:58.840 So if you know how to build a bridge today, 935 00:43:58.920 --> 00:44:00.760 you know you know how to build a one hundred 936 00:44:00.840 --> 00:44:03.880 years from now. Like, it's the same constraints, gravity is 937 00:44:03.920 --> 00:44:07.519 the same physics, it's basically the same, right, Whereas in 938 00:44:07.519 --> 00:44:10.800 security that's not true. You have this sort of intelligent 939 00:44:10.920 --> 00:44:14.119 opponent who is adapting to what you do. And so 940 00:44:14.199 --> 00:44:16.760 it's a dynamic system. So it's kind of exciting in 941 00:44:16.800 --> 00:44:17.079 that way. 942 00:44:17.800 --> 00:44:20.119 Yeah, the term I've always used as a cat and 943 00:44:20.159 --> 00:44:24.880 mouse game, right, yep, Yeah, you know you mentioned that 944 00:44:24.920 --> 00:44:28.320 the old blog posted it brought to mind about I 945 00:44:28.360 --> 00:44:30.880 think it was twelve years ago. I was working on 946 00:44:30.960 --> 00:44:36.320 Drouple and maintaining some Drouple sites for a for an organization, 947 00:44:36.800 --> 00:44:39.719 and there was a bug that came out that got 948 00:44:39.760 --> 00:44:41.679 put in there and it was referred to as Drupal 949 00:44:41.719 --> 00:44:46.280 gedding because it was so bad that if your site 950 00:44:46.280 --> 00:44:48.800 got infected, you basically needed to start over with your 951 00:44:48.840 --> 00:44:51.599 database and somehow, you know, import it from somewhere else. 952 00:44:52.480 --> 00:44:58.840 And somebody went back in the in the issues history 953 00:44:58.840 --> 00:45:02.119 for the particular module or a piece of code that 954 00:45:02.199 --> 00:45:04.119 got it and found where somebody had filed the bug 955 00:45:04.159 --> 00:45:06.159 report that said hey, and it all had to do 956 00:45:06.280 --> 00:45:08.039 with an array that was passed in and how I 957 00:45:08.039 --> 00:45:09.920 had handled reading values out of an array. It was 958 00:45:09.960 --> 00:45:12.880 something super simple, just a couple of characters, and they 959 00:45:12.880 --> 00:45:16.480 had said, Okay, this issue is here. If somebody figures 960 00:45:16.519 --> 00:45:18.960 this out, we could be in some serious trouble. And 961 00:45:19.079 --> 00:45:21.719 somebody figured it out and nobody fixed it and ended 962 00:45:21.800 --> 00:45:25.599 up being just a huge, huge thudge thing. But you know, 963 00:45:25.639 --> 00:45:27.719 I was just thinking in terms of bug happens, somebody 964 00:45:27.760 --> 00:45:32.000 goes back, Oh yeah, somebody raised US flag a while ago. Right, yeah, 965 00:45:32.079 --> 00:45:35.360 I mean that hindsight is twenty twenty right in anything in. 966 00:45:35.239 --> 00:45:37.119 That in that sense, I mean, I guess yeah, I 967 00:45:37.119 --> 00:45:39.280 mean NPM has known about this risk for a while, 968 00:45:39.280 --> 00:45:40.960 but it's it's difficult. I mean, I don't want to 969 00:45:41.199 --> 00:45:43.320 keep all the blame on the on them. 970 00:45:44.119 --> 00:45:46.000 I do. I do think that there's definitely some blame. 971 00:45:46.239 --> 00:45:47.679 But like like with all things, there's blame to go 972 00:45:47.679 --> 00:45:50.400 around in kind of every every points of different places, right, 973 00:45:50.480 --> 00:45:53.239 you know, different people were at fault. But like, but 974 00:45:53.280 --> 00:45:56.320 it's a hard problem because you know they're balancing like 975 00:45:56.480 --> 00:46:00.480 usability of the package manager and you know, wanting to 976 00:46:00.519 --> 00:46:06.159 make publish workflows flexible for people like I mean, you know, 977 00:46:06.480 --> 00:46:08.119 it's useful to have to be able to have a 978 00:46:08.159 --> 00:46:10.000 get a action that can publish new versions of your 979 00:46:10.000 --> 00:46:13.760 package to ten PM, you know when without having to. 980 00:46:14.320 --> 00:46:15.440 Run that locally on your system. 981 00:46:15.440 --> 00:46:17.480 And if you try to do like a two FA there, 982 00:46:17.639 --> 00:46:20.400 you know, now you can't have automation. You can't have 983 00:46:20.519 --> 00:46:24.320 you know, uh, you know, you can't automatically do releases 984 00:46:24.360 --> 00:46:27.199 when you know when certain you know, you know, when 985 00:46:27.199 --> 00:46:29.199 when commits land and stuff like that. So a lot 986 00:46:29.199 --> 00:46:31.760 of like the maintainer workflows would be affected by by 987 00:46:31.960 --> 00:46:34.159 like a sort of a night you've change like that. 988 00:46:34.199 --> 00:46:36.599 So that and then there actually already has been pushed 989 00:46:36.599 --> 00:46:38.400 back to some So the NTEAM has actually done some 990 00:46:38.480 --> 00:46:39.960 things in the in the last couple of weeks to 991 00:46:40.000 --> 00:46:43.199 address these attacks. They made some security changes, but even 992 00:46:43.239 --> 00:46:47.199 those modest changes that they're making have gotten like a 993 00:46:47.239 --> 00:46:49.199 lot of pushback from maintainers who don't want to deal 994 00:46:49.199 --> 00:46:51.360 with you know, deal with the extra steps. 995 00:46:51.360 --> 00:46:53.239 And I don't blame them, I mean, it's it's annoying. 996 00:46:53.599 --> 00:46:57.559 It's just this direct trade off of security and usability, 997 00:46:57.719 --> 00:47:00.400 which we always see. 998 00:47:00.760 --> 00:47:03.000 All right, So we're getting close on times how we 999 00:47:03.079 --> 00:47:05.639 got a couple more recent incidents. 1000 00:47:05.760 --> 00:47:06.960 We made it through all of them, the ones that 1001 00:47:07.000 --> 00:47:09.039 we want it through all of them. Well, there's always more. 1002 00:47:09.079 --> 00:47:11.000 I mean, I can tell you there's probably like there's 1003 00:47:11.039 --> 00:47:12.480 we find stuff every day, Like I could tell you 1004 00:47:12.519 --> 00:47:14.360 about something we found probably an hour ago, like we 1005 00:47:14.360 --> 00:47:17.039 were always blogging about this stuff on Soccer contpt on 1006 00:47:17.039 --> 00:47:20.960 our blog. So but just in terms of like the 1007 00:47:20.960 --> 00:47:24.119 the sort of really big ones. Over the last little while, 1008 00:47:24.440 --> 00:47:26.360 I think I think we covered all the main ones. 1009 00:47:26.480 --> 00:47:29.039 I don't want to get into like every little piece 1010 00:47:29.039 --> 00:47:31.000 of malware. But maybe that is itself interesting to you. 1011 00:47:31.039 --> 00:47:33.840 I don't know, cause, like you know, just the idea 1012 00:47:33.880 --> 00:47:36.280 that this stuff is actually not it's not just when 1013 00:47:36.280 --> 00:47:37.639 you see it in the news that it's happening. 1014 00:47:37.639 --> 00:47:40.679 Like there is this constant. 1015 00:47:39.800 --> 00:47:45.360 Low level burn of daily malware, like dozens and sometimes 1016 00:47:45.480 --> 00:47:49.679 hundreds of malware packages being pushed every day to these registries, 1017 00:47:50.000 --> 00:47:52.119 and we're always out there looking for this stuff, trying 1018 00:47:52.159 --> 00:47:57.199 to get it taken down, trying to protect people. So yeah, 1019 00:47:57.239 --> 00:47:59.360 shout out to the to the socket Threat team for 1020 00:47:59.400 --> 00:48:01.360 doing such a great job like looking for these hunting 1021 00:48:01.400 --> 00:48:01.920 for these things. 1022 00:48:01.920 --> 00:48:04.760 And well, yeah, let's segue into that, since you've given 1023 00:48:04.800 --> 00:48:07.599 us all this information, we'll do some shameless plugging here. 1024 00:48:08.239 --> 00:48:12.920 So why don't to talk about socket dot dev not 1025 00:48:13.039 --> 00:48:18.119 io and look at tell us just about what you 1026 00:48:18.159 --> 00:48:20.920 do big picture, and then some of the products that 1027 00:48:20.960 --> 00:48:24.199 you offer to help with help. 1028 00:48:24.000 --> 00:48:26.159 You avoid these issues that we just talked about. 1029 00:48:26.639 --> 00:48:29.719 Yeah, so our whole mission is to help developers protect 1030 00:48:29.719 --> 00:48:31.679 themselves from exactly the kind of stuff that we've been 1031 00:48:31.679 --> 00:48:35.599 talking about. So we started in twenty twenty. We've been 1032 00:48:35.719 --> 00:48:38.800 working at this for a while. Today we find around 1033 00:48:38.920 --> 00:48:43.840 a thousand malicious open source packages every single week across NPM, 1034 00:48:44.199 --> 00:48:48.719 Python and about eight other ecosystems that we track. So 1035 00:48:49.760 --> 00:48:53.679 we're just trying to help developers stay safe. And there's 1036 00:48:53.679 --> 00:48:55.960 a couple of ways that developers can use socket to 1037 00:48:56.000 --> 00:48:59.559 stay safe. I'll mention actually the newest one, which is 1038 00:48:59.599 --> 00:49:02.079 I want to actually very excited about, called Socket Firewall, 1039 00:49:02.639 --> 00:49:04.880 and this is a free product that anyone can use. 1040 00:49:05.559 --> 00:49:07.960 It's really easy to get started with it. You just 1041 00:49:08.199 --> 00:49:13.440 NPM install SFW, which stands for Socket Firewall or stands 1042 00:49:13.440 --> 00:49:15.800 for Safer Work I guess depending on your. 1043 00:49:18.159 --> 00:49:20.039 You're the way you look at it. But once you 1044 00:49:20.119 --> 00:49:22.079 install SFW, all you have to do is. 1045 00:49:22.280 --> 00:49:26.480 Run your normal package manager commands, but you just prefix 1046 00:49:26.519 --> 00:49:29.599 it with SFW, So for instance, you'd run s FW 1047 00:49:29.840 --> 00:49:37.360 NPM install, FOU or SFW NPM update or SFW PNPM install. 1048 00:49:37.159 --> 00:49:38.039 Or yarn ad. 1049 00:49:38.239 --> 00:49:42.239 It works with everything, works with Rust and Python and 1050 00:49:42.280 --> 00:49:45.360 on all the jobscript package managers. And what will happen 1051 00:49:45.599 --> 00:49:48.880 is everything will install like normal, except for if you're 1052 00:49:48.880 --> 00:49:51.880 about to install something that's been compromised. So it's really 1053 00:49:51.960 --> 00:49:54.480 like a filter on the packages that come in. And 1054 00:49:54.519 --> 00:49:57.079 if we've identified that there's malware in any of those 1055 00:49:57.079 --> 00:50:00.280 packages or threats that you know could affect you, just 1056 00:50:00.920 --> 00:50:02.920 basically prevent them from coming in and we'll print a 1057 00:50:02.920 --> 00:50:05.519 message telling you this package was blocked for blah blah 1058 00:50:05.519 --> 00:50:06.199 blah reason. 1059 00:50:06.599 --> 00:50:08.599 So it's very simple to use. It's totally free. 1060 00:50:09.400 --> 00:50:11.159 People can just install it and start using it, and 1061 00:50:11.159 --> 00:50:13.199 we're just giving it away to the community to help 1062 00:50:13.239 --> 00:50:14.159 people stay protected. 1063 00:50:14.719 --> 00:50:17.599 Oh okay, yeah, here, it's not listed on your products, 1064 00:50:17.599 --> 00:50:18.719 but I see the blurb at. 1065 00:50:18.639 --> 00:50:19.760 The top of the page there. 1066 00:50:20.079 --> 00:50:22.639 Yeah. We just announced it literally last week, so it's 1067 00:50:23.199 --> 00:50:23.760 it's exciting. 1068 00:50:23.760 --> 00:50:25.000 I mean, we we are gonna we do have a 1069 00:50:25.000 --> 00:50:26.760 paid version of it for people that want to roll 1070 00:50:26.800 --> 00:50:28.679 it out at their companies. Like you can deploy it 1071 00:50:28.679 --> 00:50:31.760 in a in a server fashion, so instead of it 1072 00:50:32.119 --> 00:50:35.320 being a wrapper around the package manager command, you can 1073 00:50:35.320 --> 00:50:37.760 actually deploy it as like a server and then you 1074 00:50:37.800 --> 00:50:44.039 can point your your your different like package managers to 1075 00:50:44.199 --> 00:50:47.719 that server as a as your registry, so you can 1076 00:50:47.800 --> 00:50:50.559 kind of set the registry to be the socket. 1077 00:50:50.280 --> 00:50:53.599 Firewall, and then it'll like work in that fashion. 1078 00:50:53.239 --> 00:50:56.599 So so folks can look into that if they're interested 1079 00:50:56.599 --> 00:50:58.360 in like using another company. But the free version is 1080 00:50:58.360 --> 00:51:01.519 really powerful and like does everything that folks need to 1081 00:51:01.559 --> 00:51:04.960 do to protect themselves today. And I recommend that people 1082 00:51:04.960 --> 00:51:07.440 actually alias it so you can alias it in your 1083 00:51:07.480 --> 00:51:10.519 shell so that when you type NPM, it just runs 1084 00:51:10.559 --> 00:51:12.719 a s FWNPM behind the scenes and so you don't 1085 00:51:12.719 --> 00:51:14.559 have to remember anymore. You just put that in place 1086 00:51:14.639 --> 00:51:16.360 once and then you just protected forever. 1087 00:51:18.679 --> 00:51:22.800 Awesome. Yeah, you can see the details on Socca dot dev. 1088 00:51:24.039 --> 00:51:26.280 Yeah, and it's really it's really cool. Yeah, people should 1089 00:51:26.320 --> 00:51:27.719 definitely check it out. Sure feedback. 1090 00:51:27.800 --> 00:51:29.679 We tried to make it work really really well, and 1091 00:51:30.039 --> 00:51:38.119 it works with NPM, YARN, PNPM, PIP, cargo. 1092 00:51:39.079 --> 00:51:40.079 And UV. 1093 00:51:40.920 --> 00:51:42.840 There's a bunch of different package managers that works with 1094 00:51:43.079 --> 00:51:46.800 so cool. Yeah, and then the other thing people can 1095 00:51:46.840 --> 00:51:48.960 do is our main product, Like this is the main 1096 00:51:49.000 --> 00:51:51.559 thing we've been doing for like you know, years now. 1097 00:51:51.559 --> 00:51:52.719 This is our bread and butter is we have a 1098 00:51:52.760 --> 00:51:55.639 GitHub app or a CLI tool that you can use 1099 00:51:56.000 --> 00:51:58.400 to scan your projects and protect your projects. 1100 00:51:58.639 --> 00:52:00.000 So if you're on GitHub, it's really easy. 1101 00:52:00.039 --> 00:52:02.559 You just go to socker dot dev, you hit install 1102 00:52:02.719 --> 00:52:05.960 socket and it'll give you like two clicks. You'll just 1103 00:52:06.000 --> 00:52:07.239 ask you if you want to install this on your 1104 00:52:07.280 --> 00:52:10.599 gi hub organization. And once you do that, then all 1105 00:52:10.639 --> 00:52:14.360 your pull requests will automatically be protected. So if we 1106 00:52:14.440 --> 00:52:18.280 see you about to upgrade to a bad package, we'll 1107 00:52:18.360 --> 00:52:18.880 be able. 1108 00:52:18.679 --> 00:52:21.280 To put a comment on that poll request and. 1109 00:52:21.280 --> 00:52:24.079 Tell you why this package is risky or why you 1110 00:52:24.079 --> 00:52:26.320 shouldn't use it, or what would be a better alternative 1111 00:52:26.320 --> 00:52:29.320 and all that kind of information. So, and it's all configurable, 1112 00:52:29.320 --> 00:52:31.199 so you can go in and sort of tell it 1113 00:52:31.480 --> 00:52:34.559 I really care about, you know, preventing deprecated packages from 1114 00:52:34.559 --> 00:52:37.639 getting into our project, and then it'll warn you if 1115 00:52:37.679 --> 00:52:41.719 you're bringing in a new package that's deprecated, or you 1116 00:52:41.719 --> 00:52:44.320 could say, I really want to prevent unmaintained packages from 1117 00:52:44.320 --> 00:52:46.679 being brought into our project. And then we'll be able 1118 00:52:46.679 --> 00:52:48.840 to tell you when someone on your team is bringing 1119 00:52:48.880 --> 00:52:50.719 in a package that hasn't had an update in five years. 1120 00:52:50.719 --> 00:52:52.079 You know, we'll be able to print a little comment 1121 00:52:52.119 --> 00:52:54.159 and say, hey, this package hasn't an update in five years. 1122 00:52:54.280 --> 00:52:56.360 Are you sure you want to use it? And it's 1123 00:52:56.519 --> 00:52:58.199 up to you. You can block in that case, or 1124 00:52:58.239 --> 00:53:01.159 you can just warn and let them, let them decide 1125 00:53:01.199 --> 00:53:02.199 how they want to handle it. 1126 00:53:02.199 --> 00:53:04.320 It's really all up to you. So it's pretty. 1127 00:53:04.039 --> 00:53:09.119 Powerful awesome all right. 1128 00:53:09.639 --> 00:53:13.440 So before we get into picks, obviously we know about 1129 00:53:13.480 --> 00:53:14.280 soccer dot. 1130 00:53:14.159 --> 00:53:16.960 Dev and your blog on there. 1131 00:53:17.880 --> 00:53:21.039 Where else can people hear what you have to say 1132 00:53:21.119 --> 00:53:22.719 or give you money or anything like that? 1133 00:53:24.559 --> 00:53:26.920 Uh yeah, just check out check out soccer dot dev. 1134 00:53:27.440 --> 00:53:33.239 I'm personally on x and the different social media platforms 1135 00:53:33.639 --> 00:53:37.800 masted on, loose Sky all that stuff. My name is 1136 00:53:37.840 --> 00:53:40.400 just Faross F E R O S. S. And then 1137 00:53:40.480 --> 00:53:45.800 socket socket is is on there too under socket security. Yeah, 1138 00:53:45.840 --> 00:53:48.519 and I mean also just shout out to or let 1139 00:53:48.519 --> 00:53:51.039 people know like that. If anyone is interested in this 1140 00:53:51.039 --> 00:53:54.400 stuff and wants to talk about security or you know, 1141 00:53:55.159 --> 00:53:58.159 uh how to how to stay safe while using open source, 1142 00:53:58.320 --> 00:54:00.199 just hit me up. I'm happy to like to talk 1143 00:54:00.199 --> 00:54:02.719 about this with people, even separate from like becoming a 1144 00:54:02.719 --> 00:54:06.840 soccer customer. I'm I also have been a lecturer and 1145 00:54:06.880 --> 00:54:08.840 like a teacher in the past, so I love talking 1146 00:54:08.880 --> 00:54:13.840 about this stuff. So if if anyone listening wants to 1147 00:54:15.280 --> 00:54:19.480 kind of learn more about like what they can do 1148 00:54:19.559 --> 00:54:22.039 to protect themselves from these types of attacks, or just 1149 00:54:22.079 --> 00:54:24.320 wants to like hear more about the latest stuff that 1150 00:54:24.360 --> 00:54:27.280 we're seeing that I'm seeing. Let me know, I'm happy 1151 00:54:27.280 --> 00:54:30.320 to kind of consider doing a talk at your company 1152 00:54:30.800 --> 00:54:33.239 to your developer team and just talk about these issues, 1153 00:54:34.079 --> 00:54:35.920 not like a product pitch or anything, but just talking 1154 00:54:35.920 --> 00:54:38.400 about supply chain security. I like to do that from 1155 00:54:38.440 --> 00:54:40.880 time to time. So if you think your your company 1156 00:54:40.880 --> 00:54:43.199 would be interested, let me know, I'm happy to help. 1157 00:54:45.360 --> 00:54:49.599 All right, Well, I don't I wouldn't have any problem 1158 00:54:49.679 --> 00:54:52.800 with shamelessly plugging your company considering all the information you're 1159 00:54:52.800 --> 00:54:53.400 putting out there. 1160 00:54:53.440 --> 00:54:57.639 So so thanks. Yeah, we're trying advertising, we're. 1161 00:54:57.480 --> 00:54:58.320 Trying to do the right thing. 1162 00:54:58.320 --> 00:54:59.800 And like you know, all of our data is public 1163 00:54:59.800 --> 00:55:01.719 to you know, you can you can go to a 1164 00:55:01.760 --> 00:55:04.280 socket and search for any package and just we'll give 1165 00:55:04.320 --> 00:55:06.119 all the data back to you, so you'll see all 1166 00:55:06.119 --> 00:55:08.880 of our scores and all the findings and whether it's 1167 00:55:08.920 --> 00:55:11.960 safe and different risks and quality issues and it's all open. 1168 00:55:12.079 --> 00:55:15.159 So yeah, we're just trying to trying to be useful. 1169 00:55:16.639 --> 00:55:19.800 All righty, So with that we will move into picks. 1170 00:55:19.840 --> 00:55:21.480 Picks are part of the show where we get to 1171 00:55:21.519 --> 00:55:24.119 talk about whatever we want to within reason of course, 1172 00:55:24.199 --> 00:55:28.199 you know, books, movies, games, Chuck likes board games. Uh, 1173 00:55:28.639 --> 00:55:30.960 you know, tech could be non tech, could be whatever. 1174 00:55:32.039 --> 00:55:33.760 I always like to say. I'm the high point of 1175 00:55:33.840 --> 00:55:38.320 these with my dad jokes of the week. So we'll 1176 00:55:38.360 --> 00:55:38.800 start with. 1177 00:55:38.719 --> 00:55:41.800 That and then let for us save the best for last, 1178 00:55:41.840 --> 00:55:45.679 well almost the best for last. So anyway, a Roman 1179 00:55:46.239 --> 00:55:50.239 walks into a bar, holds up two fingers and says, 1180 00:55:50.800 --> 00:55:52.360 I'll have five beers, please. 1181 00:55:56.079 --> 00:55:59.920 The numerals. If you're wondering, yes, actually thanks. 1182 00:56:00.000 --> 00:56:06.840 A few people have said that to me an observation. 1183 00:56:07.000 --> 00:56:09.559 Humans are the only species that will cut down trees, 1184 00:56:10.280 --> 00:56:12.639 make paper out of them, and then write save the 1185 00:56:12.679 --> 00:56:20.960 trees on it. And then the other night my wife said, honey, 1186 00:56:21.000 --> 00:56:23.320 why is there a strange baby in the crib? I said, 1187 00:56:23.719 --> 00:56:26.519 you told me to change the baby. 1188 00:56:28.079 --> 00:56:29.840 Thank you. Those are the dad jokes of the week. 1189 00:56:31.320 --> 00:56:32.920 All right for us? What do you have for us? 1190 00:56:35.800 --> 00:56:39.800 I have a few picks. One is a book. 1191 00:56:39.519 --> 00:56:43.960 I read picked up last weekend called The Power of Now, 1192 00:56:44.360 --> 00:56:45.119 which is interesting. 1193 00:56:45.360 --> 00:56:46.719 It's about kind. 1194 00:56:46.519 --> 00:56:51.280 Of the idea of like living in the moment, being present, 1195 00:56:51.920 --> 00:56:55.559 and it's kind of like a spiritual kind of a book. 1196 00:56:55.599 --> 00:56:58.280 But I thought it was it was very interesting it's 1197 00:56:58.280 --> 00:57:00.920 it's it's really a simple idea that, like, you know, 1198 00:57:01.400 --> 00:57:06.159 your entire life is experienced in the moment, but yet 1199 00:57:06.199 --> 00:57:07.960 we spend so much time thinking of the past or 1200 00:57:08.000 --> 00:57:10.639 thinking of the future. And I'm someone who spends a 1201 00:57:10.679 --> 00:57:12.480 lot of time thinking more about the future than the past. 1202 00:57:12.519 --> 00:57:14.559 I don't tend to dwell on things, but I do. 1203 00:57:14.840 --> 00:57:17.800 I do worry a lot about, like, you know, what 1204 00:57:17.840 --> 00:57:19.880 I want to do, what I want to accomplish next, 1205 00:57:19.920 --> 00:57:21.920 Like what am I working on? I like to work 1206 00:57:21.920 --> 00:57:24.360 a lot, and and so I just thought it was 1207 00:57:24.440 --> 00:57:27.599 very eye opening kind of reminder that, you know, it's 1208 00:57:27.639 --> 00:57:29.880 not it's not a good idea to live your entire 1209 00:57:29.880 --> 00:57:33.960 life just thinking about you know what's to come, but 1210 00:57:34.079 --> 00:57:36.760 like actually take a breath and appreciate, you know, how 1211 00:57:36.840 --> 00:57:39.679 how awesome the current moment is. And and so anyway, 1212 00:57:39.840 --> 00:57:42.079 I recommend folks look at that if if they that 1213 00:57:42.159 --> 00:57:44.159 resonated at all. 1214 00:57:44.519 --> 00:57:46.519 And my other pick will be just a. 1215 00:57:46.440 --> 00:57:50.599 Classic book I always go back to you every few years, 1216 00:57:50.679 --> 00:57:54.639 which is the Enders game series. The Enders game series 1217 00:57:54.679 --> 00:57:58.519 is excellent, and even the prequels are are just amazing. 1218 00:57:59.719 --> 00:58:05.119 So uh, I've heard about those, Yeah, and what kind 1219 00:58:05.119 --> 00:58:05.920 of book is that is that? 1220 00:58:06.039 --> 00:58:06.760 Is it like sci fi? 1221 00:58:06.920 --> 00:58:09.159 Is it? Yeah? 1222 00:58:09.239 --> 00:58:10.159 What is it? 1223 00:58:10.159 --> 00:58:11.239 It's sci fi? It's sci fi. 1224 00:58:11.320 --> 00:58:14.599 Yeah, so it's it's uh, you know, it's about a 1225 00:58:14.599 --> 00:58:16.039 lot of people at bread enders game, I think, but 1226 00:58:16.079 --> 00:58:18.960 if they haven't. It's basically about a kid who has 1227 00:58:19.000 --> 00:58:21.760 to go into space and learn how to become like 1228 00:58:21.800 --> 00:58:28.679 an insanely competent commander of fleets so he can defend 1229 00:58:28.760 --> 00:58:33.000 Earth from an alien invasion that's coming. Uh. And the 1230 00:58:33.039 --> 00:58:36.119 series is like kind of it goes in the future, 1231 00:58:36.119 --> 00:58:38.519 it goes into like a really different direction, and it 1232 00:58:38.519 --> 00:58:40.840 goes like two thousand years into the future and follows 1233 00:58:40.960 --> 00:58:42.920 this this this is the kid as he kind of 1234 00:58:42.920 --> 00:58:47.559 travels through the Solar System and encounters like different new 1235 00:58:47.599 --> 00:58:48.440 alien species. 1236 00:58:48.639 --> 00:58:51.119 Uh. And then the prequels are about kind of the. 1237 00:58:51.119 --> 00:58:54.760 Earlier attacks that the aliens did on Earth and the 1238 00:58:54.840 --> 00:58:56.760 kind of the people, the humans that kind of fought them. 1239 00:58:56.800 --> 00:58:59.079 And it's just I just like the writing style a lot. 1240 00:58:59.079 --> 00:59:03.719 I think it's really media and really simple, clear, crisp, 1241 00:59:03.880 --> 00:59:06.159 like fast moving language. It's just a really a joy 1242 00:59:06.199 --> 00:59:08.519 to read it. It's like a really fun, fun read. 1243 00:59:10.920 --> 00:59:12.559 Awesome is that it? 1244 00:59:13.840 --> 00:59:16.639 Yeah? I'm supposed to more than two picks. No, no, nope. 1245 00:59:16.679 --> 00:59:18.880 Some people just have one. Some people are like, I 1246 00:59:18.880 --> 00:59:21.159 don't have any, so I'll shut it out. 1247 00:59:21.760 --> 00:59:23.599 I'll add a final one, which is just a reminder 1248 00:59:23.639 --> 00:59:27.119 for people to to NPM install s FW and check 1249 00:59:27.119 --> 00:59:30.199 out Socket Firewall, which we recently released. And please send 1250 00:59:30.239 --> 00:59:32.320 us your feedback if you run into any problems or 1251 00:59:32.559 --> 00:59:33.920 where you think it's awesome. 1252 00:59:34.079 --> 00:59:35.960 Or you you you know. 1253 00:59:36.000 --> 00:59:38.119 Use it at work or anything like that, let us know. 1254 00:59:38.159 --> 00:59:40.119 It would be awesome to get people's feedback on that. 1255 00:59:41.119 --> 00:59:41.440 Cool. 1256 00:59:42.519 --> 00:59:45.280 All righty well, thank you for coming back for us 1257 00:59:45.360 --> 00:59:48.239 and telling us about what's been going on in the 1258 00:59:48.320 --> 00:59:50.719 web safety world, or in some cases, the lack of 1259 00:59:50.800 --> 00:59:55.960 web safety. And thank you for listening to JavaScript Jabber 1260 00:59:56.559 --> 00:59:58.000 and we will talk to you next time.