News 'n' Updates | Chris Contolini

Building an npm worm

2016-03-26T00:00:00+00:00

It’s long been known that npm scripts can be used for malicious purposes. Historically, when a developer publishes a package with a nasty lifecycle script npm quickly deletes the package to mitigate harm.

But what if a package had an install script that scanned your computer for other node modules and added the same evil script to those modules? If you’re a maintainer of those modules, and you’re logged into npm, it could then publish the newly-infected module(s). These new versions would be installed by other developers who would unknowingly infect their own modules. To undo the damage, you’d have to determine which specific versions of packages are affected and purge only those versions. This would be difficult, if not impossible to do.

You can’t “undo” a worm

npm, Inc. recently publicized their concern over this issue after Sam Saccone disclosed it to them in January 2016.

It’s a vulnerability I’ve been thinking about ever since I helped out with Bower last year and was given commit access to the project. I had only triaged a couple issues and written a dozen lines of code but because the project was in need of maintainers, I was suddenly in control of a project that’s installed by developers 100k times/day. If I was a jerk or evil corporate saboteur I could add malicious code to the project that would wreak havoc on developers’ systems. In this situation, the harmful code would be removed and I would be banned from the project.

But if the exploit was designed to self-replicate, you can’t just “undo” it.

npm worm proof of concept

To demonstrate how an npm worm would work, I created a quick proof-of-concept: pizza-party. I have not published the module to npm but if you were to npm install pizza-party, the module’s install script would do the following:

Scan its parent node_modules directory for other node modules
Add the same install script to those modules
Version those modules (bumping the patch version)
Attempt to publish them to npm
Opens this video in a browser

99.99% percent of the time the attempt to publish the module will fail because the user probably isn’t an owner of the module. But many npm authors manage hundreds of packages so you’d only have to infect a couple of those people to initiate a snowball of chaos.

The attack in the disclosure is even more nefarious. Rather than brute forcing the publishing of peer modules you can just list all packages owned by the current user, download them, add an install script to them, and re-publish them.

Lazy semver habits allow the virus to spread

The propagation happens because most developers use loose range specifiers (~ and ^) in their projects’ package.json.

For example, gulp requires version ^1.0.0 of archy. When a user installs gulp (npm install gulp) npm will check its registry for the latest version of archy that is greater than version 1.0.0 while still less than 2.0.0.If a malicious script successfully infects archy and bumps it to 1.0.1, anyone who installs gulp will be downloading the exploit. That same script would then try and infect other modules present on the user’s machine, attempting to create new versions (npm version patch) and publish them to npm without the user knowing (npm publish).

Protecting yourself from an npm worm

As mentioned in the formal CERT disclosure, the best way to protect yourself is to only be logged into npm when you’re actively managing your modules.

Locking your dependencies by using npm shrinkwrap will also help, but so long as node modules can run arbitrary scripts, there’s a lot of scary stuff they can do.

Using other people’s code is inherently risky

The use of lifecycle scripts is not unique to npm and this exploit can be emulated in the package managers of other programming languages and frameworks. The reality is that npm, and to a greater extent, GitHub, have allowed the world of open source software to flourish by making it easy to create, distribute and assemble software. This is a good thing. But it doesn’t change the fact that there are inherent risks involved with blindly executing someone else’s code on your machine.

Even if a module doesn’t have any lifecycle scripts, it could still contain malicious code that does something horrible the second you require() it. Admittedly, I often npm install random-module-xxx without first viewing its source code. I should probably start auditing modules before installing them but let’s face it – ain’t nobody got time for that.

Until npm inc. finds ways to make npm users safer, we just have to trust that none of our peers are assholes. So if you’re a node developer and you’re reading this: Please, don’t be an asshole.

Hacking from Bryce Canyon National Park

2015-11-18T00:00:00+00:00

Today I successfully dialed into a conference call and submitted a pull request from Bryce National Canyon’s Rim Trail. Full 4G LTE with a download speed of 17 Mbps from Sunrise Point. Afterward, I hiked Fairyland Loop and Navajo Trail. It was a good day. Due to the snow, I was the only camper in North Campground.

Bryce Canyon is stupid gorgeous.

Here’s the rock I chilled from (literally lolololololol) most of the day:

Bryce is possibly my favorite park in Utah. Check out the full photo album.

Kasha-Katuwe Tent Rocks National Monument

2015-11-16T00:00:00+00:00

Me: Any chance of flash floods in the slot canyon?
Ranger: Only if it rains.
Me: It’s raining right now.
Ranger: This ain’t rain.

November + rain = me being the only person at Kasha-Katuwe Tent Rocks National Monument.

See if you can spot Boxxy in the second photo below.

A quick day hike with a stunning view. Check out the full photo album.

White Sands National Monument

2015-11-15T00:00:00+00:00

Just south of a large missle range in New Mexico is a gorgeous national monument filled with crisp white sand dunes. I had the park to myself and was able to occupy a picnic area the entire day while kids sled down the dunes in the distance. Sleds can be rented at the ranger station for $5.

These photos do the sand dunes little justice. At some point I’ll invest in a decent DSLR instead of using my phone.

Abandoned York County Prison

2015-10-31T00:00:00+00:00

Disclaimer: This building is on private property and should not be accessed without the owner’s permission.

On my way out of Philadelphia, I stopped by downtown York to explore their old prison. From Preserving York:

The Old York County Prison on Chestnut Street in York PA began as part of a complex of custodial buildings, including the York County Poorhouse and Hospital (where the Alexander Goode school now stands). The prison itself was an imposing castle-like structure built in 1853, with spread-out cell blocks in the rear that housed the inmates.

Follow the cowpath on the west side of the building to a chain link gate that’s been pried open. Walk east to the rear of the building and you’ll find a 2x2’ hole chiseled through a concrete wall. This is the only way in and out of the prison so be careful and bring a friend. You’ll need to shimmy through the opening on your hands and knees. Total darkness awaits you inside. Bring a flashlight and gloves.

You’ll enter a dark hallway. To the left is the kitchen with appliances strewn about. There’s a spiral staircase coming off the kitchen which provides access to the basement. Don’t try and access the basement from the stairwell near the front of the build – they’re extremely dilapidated and dangerous.

The cell blocks start on the second level. Find the large staircase and begin your ascension. Watch for broken steps, rusty nails, squatters, and raccoons.

There’s a hatch that takes you up to the top level of the building. Avoid walking across the center of this room to avoid falling through the floor onto the catwalks below. An ancient, shaky wrought iron ladder provides roof access with views of the city.

Definitely worth the stop if you’re in the area. Check out the full photo album.

Robert H. Treman State Park

2015-10-15T00:00:00+00:00

Robert H. Treman State Park, just south of Cayuga Lake, is a classic leaf-peeper state park. An extremely well manicured stone walkway meanders through a steep gorge alongside an impressive waterfall. There are well-kept campgrounds and picnic areas close to the park entrances. It was the off season so I had free rein on the facilities. A very cool place to visit in the Finger Lakes region.

Full album.

Niagara Falls

2015-10-10T00:00:00+00:00

Niagara Falls. Big. Powerful. Beautiful. ‘Nuf said.

United Community Hospital

2015-09-28T00:00:00+00:00

Disclaimer: This building is on private property and should not be accessed without the owner’s permission.

United Community Hospital is one of the creepier haunts in Detroit. Hazardous waste, medical equipment, and confidential patient records remain in the building ten years after being abandoned. It’s a real life Resident Evil.

Entry is easy. A steel gate blocks front door but tempered glass windows on either side have been smashed out. Wear gloves and watch for rusty nails and biohazards.

The basement is flooded and filled with black mold. There are bags of blood and mountains of patient records scattered across hundreds of rooms spanning five floors. Elevator shafts are wide open and easy to mistake for doorways. The inner hallways of the hospital are pitch black. It’s easy to get lost.

Woodward Avenue Presbyterian Church

2015-09-26T00:00:00+00:00

Disclaimer: This building is on private property and should not be accessed without the owner’s permission.

From Detroit UrbEx:

Woodward Avenue Presbyterian building has been in a state of limbo, shifting from one owner to another as plans to renovate have fallen through. According to Historicdetroit.org, a court battle over the estate of Reverend Douglas left the building vacant and deteriorating, as scrappers and natural elements took their toll on the 100-year-old structure. The organ pipes were scrapped in 2009, along with much of the remaining metal. In 2009 the building was purchased by Cathedral of Praise Baptist Church, but the cost of restoring the building proved to be too high, and it has sat vacant since. Most recently a tax foreclosure notice appeared on the door, indicating that the church might end up at auction in the near future.

Your Air Is Killing You: Monitoring VOCs

2012-05-25T00:00:00+00:00

The air in your home is disgusting. Seriously. Open a window.

Inspired by Carnegie Mellon’s air quality balloons and a seminar on Pervasive Interaction in Smart Environments, some buddies and I built a device that monitors the concentration of volatile organic compounds in the air. We used an Arduino and a Figaro 2620 solvent vapor detector to record VOC levels at various locations, public and private.

The result? Your bedroom is giving you cancer. In one day we tested bars, a McDonald’s, public buses, outdoor patios and our homes. The VOC levels in personal living spaces was significantly higher than all other locations, especially outdoor locations. This is something the EPA has known for a while. The simple act of opening a window can dramatically decrease VOC levels in your home and I don’t care how cold it gets outside, my window is staying open.

My job was to build a web interface that parses a huge CSV dump of data and plots VOC levels on various HighCharts graphs. We plan to continue working on the project and eventually release the schematics and source code to the public. For now there’s a lot of calibration and refactoring to be done.

Now go open a window.