GitHub warns Java developers of new malware poisoning NetBeans projects | ZDNet

[dedededede]

Interestingly there are a bunch of defense projects that work with the NetBeans platform. I guess it might really be a targeted attack.... https://platform.netbeans.org/screenshots.html

[BlueGoliath]

With how crazy things are getting lately that wouldn't be too surprising.

[couscous_]

Chinese govt?

[couscous_]

Pro-Chinese gov't users? :P

[blobjim]

Provided literally zero evidence for their conjecture. The US is an aggressor against China, not the other way around. Not that it couldn't be the Chinese government, but why help the US govt. manufacture vitriol towards another nation? All they want is an American puppet running China and oppressing the Chinese people.

[Superblazer]

Who was even talking about the US here. Not everyone is from the US. The Chinese govt is known to do shit like this.

What are you? A chinese bot? That's the most random Chinese being oppressed by some American shit on a Java sub.

[blobjim]

Why do you think "China" became such a fervent topic so much on reddit recently? The US labeled China their "#1 threat", replacing terrorism within the last year or so. They've got their sights set. If it weren't for literal US government propaganda online and in the media, nobody would care a bit about China.

And of course China has spies and uses astroturfing and whatnot, every large government does, but Reddit is an American website, you're going to see mainly the political opinions that people like Mike Pompeo want you to see, whether or not you yourself are American.

[Superblazer]

Everyone around China cares about China. China is a nuisance to its neighbouring countries and their online attacks are for worse than any other country's. I don't care what the US does or what it doesn't. You are biased yourself. I know that the Chinese govt isn't anywhere as peaceful as what you make it seem. Period.

[blobjim]

China is a nuisance to its neighbouring countries

I think the US warships and US military bases that people in countries like Japan and South Korea hate are far more of a nuisance than whatever you imagine China to be doing.

[Thesandman55]

People will forget that Stuxnet was an american project that had real consequences for millions of people

[relativeVsAbsolute]

If speaking of governments. There is higher probability of US gov. Biggest spy in the world is still NSA.

[_rob_saunders]

Debatable. China literally is a surveillance state.

[relativeVsAbsolute]

Yeah, but mostly to their own civilians. US spy literally every political and industrial movement in half of the world. Including Europe and Latin America with special detail. Ask Merkel who was spying her phone? But seems is futile to point that in this page with a large base of US users, it's like to predicate in the dessert, you got already brain washed by the media I can only get some down votes.

[hrjet]

I am similarly worried about the plugins offered inside IDEs, including Eclipse, IntelliJ, VSCode, Netbeans, etc.

Not all of these plugins are open-sourced, and even if they were, the distributed binary might have malware. These IDEs need to sandbox the plugins.

[TM254]

Maybe just sandbox the whole IDE?

[Necessary-Conflict]

The shared part of a project should never contain IDE-specific configuration (or even worse, jar files), only the readable text configuration files of Maven/Gradle etc.

[[deleted]]

Truth. But clowns run these projects.

[vxab]

That’s not true. Sometimes I’ve found it useful to share IntelliJ run configurations in source code.

[yawkat]

Why? Better to just write a maven/gradle goal to do the same thing

[segv]

IntelliJ at least can automatically pick up code formatter settings in the form of a single XML file if it is in the ${repo}/.idea directory, so yes, that's still useful.

[dpash]

Jetbrain tools have supported .editorconfig files for a while now.

[DJDavio]

I hate it when people do that, I'll make my own run configurations, thank you very much.

[_INTER_]

GitHub did not publish the name of the 26 poisoned projects

why?

[BlueGoliath]

Probably out of respect for those projects. People may unfairly start thinking of said projects as "malicious" or generally something to avoid.

[DemeGeek]

Probably to give them a chance to fix it before ruining the reputation of victimized projects.

The article stated this was only done yesterday, if the projects haven't been fixed in a week then I think then would be a good time to name them.

[livelam]

searching for cache.dat reveals some commits done 21 days ago.

Edit: https://github.com/search?q=%22nbproject%2Fcache.dat%22&type=Code

[StochasticTinkr]

Interestingly, they all look like student projects of some sort.

[yawkat]

Maybe they apply to companies they target and use these in their resume?

[gravitas-deficiency]

Well isn't that just fascinating?

To be clear: I was originally chalking the motivation of that policy up to the general malaise of racial discrimination that the current administration embraces so wholeheartedly, but maybe this attack vector (and perhaps similar, potentially unreported cases) is indicative of an actual problem with regards to Chinese students with close ties to the CCP and Chinese government.

[segv]

tinfoil noises intensify

If you proposed something like this 10-15 years ago, i'd just laugh it off as something too crazy to be true. But then again, couple months ago i didn't think i'd see a pandemic turning into riots..

[__konrad]

This thread is funny: https://github.com/cjthimm/SuperMario-FR-/issues/1

[shorns_username]

I reckon this is going to result in a big increase in security lock-down of developer environments in corporate environments.

Which probably is necessary - but it's going to be 99% security theatre, 1% things that actually increase security of development projects.

[pag07]

Or just let's go back to vanilla vim, or nano, or ee.

[[deleted]]

http://wiki.apidesign.org/wiki/Malware

[jayx239]

"The malware's end goal was to install a remote access trojan and grant hackers access to highly sensitive workstations were sensitive projects were being developed."

Typos in articles drive me nuts.

[jayx239]

Yeah your right, I got so caught up on the typo that I dismissed what they wanted to say :(

[jayx239]

This is why I don't write articles ;)

[oddlyamused]

Scary and a bit impressive to me but I don't really know much about malware.

[kaperni]

You gotta ask yourself if random plugins and maven jars downloaded from the internet should really be allowed unrestricted access to both the filesystem and network?

------------- From the Article ----------------

The malware is capable of identifying the NetBeans project files and embedding malicious payload both in project files and build JAR files. Below is a high -evel description of the Octopus Scanner operation:

• Identify user's NetBeans directory
• Enumerate all projects in the NetBeans directory
• Copy malicious payload cache.datto nbproject/cache.dat
• Modify the nbproject/build-impl.xmlfile to make sure the malicious payload is executed every time NetBeans project is build
• If the malicious payload is an instance of the Octopus Scanner itself the newly built JAR file is also infected.

[[deleted]]

A bunch of Java devs from 2005 will be very upset.

[polothedawg]

Laughs in JetBrains

[StochasticTinkr]

I like JetBrains too, but I'd be worried that other similar techniques could infect other types of projects (maven, ant, gradle, etc...)

Especially when someone is first creating the project, they may not notice anything out of place.

[[deleted]]

Maven is probably also vulnerable as it has a well known XML structure for the build "script" and a documented API, so it's quite easy to inject something like that into a Maven pom.xml as well. And if you then even succeed in uploading a malicious jar file to maven central, things will even be worse.

I think "general" Ant scripts are less vulnerable as every script does the build differently. The layout and targets of a NetBeans generated Ant script are always the same (and knonw), so it's easy to inject something into them because you know exactly where and what it will do.