Hacker News Reader

Comment by steveklabnik | Hacker News Reader

I think you're being _just a bit_ reactionary.

Besides if you git clone, literally _every commit_ is checksummed. I'm no security expert, but I don't think MITM-ing a 'git clone' sounds 'really easy.'

View on HN

No, you're clearly not a security expert. If you're doing a git clone over HTTP, you can't even be certain you're talking to the right git repository. Sure, each and every commit may be checksummed, but how exactly do you anticipate knowing what the correct checksums are?

Fair enough. Like I said, I don't know enough about this.

> how exactly do you anticipate knowing what the correct checksums are?

Well, because the repo you're cloning knows what they are... I wasn't thinking about the repo itself being owned, but git's whole job is to make sure that chunks of text get from one place to the other in an identical state, so...

The target repo itself isn't owned, but your connection is. The point is that you only think that you are talking to the correct repo, when in fact you are cloning whatever git repository the attacker would like you to.

It's obviously a focused attack as are all MITM attacks, so you can assume the attacker is familiar with the install script. So when the script then continues and performs it's next action on the contents of the repository, you will execute an arbitrary payload.

Edit: It wasn't clear to me that the problem had become apparent in the parent post. Probably just pre-coffee thinking on my part, but hopefully this will help clarify it for anyone else reading along who also missed it.

Yes, when I said 'the remote repo', what I meant was 'the one that I see.

Thanks for the extra explanation, guys! Makes a lot of sense.

If I was trying to MITM you while you called forth a git clone, I'd first make the network connection unstable. Then, while that happens, go look at what package you're getting is and then feeding you a known bad, but signed, package.

But it's signed :/

Reply on news.ycombinator.com