14

You have a computer system, for developing and running your Top Secret™ project on, and you don't allow it direct access to the internet.

However, you want to use Maven, for all the advantages it confers, and so you allow Maven access to your intranet repository, which then has access to the internet repository.

The question is - if someone knew about your Top Secret project, and knew you were using Maven, could they exploit it to try penetrate your system and retrieve information?

9

It certainly was in the past. See http://blog.ontoillogical.com/blog/2014/07/28/how-to-take-over-any-java-developer/

Maven Central supports HTTPS, as of July 2014.

Maven Central requires PGP signatures for artifacts. There's a plugin to verify the signatures: http://www.simplify4u.org/pgpverify-maven-plugin/index.html

Now, badguy can write a malicious program and sign it with PGP, and it would be verified, so you'll want to check that the PGP signature belongs to an organization / developer that you trust.

1
  • This is important info - thanks! So by default (without the plugin) PGP signatures aren't checked? How do you configure who you trust? Using the PGP web of trust is not very easy. Do the PGP signatures actually help in real life? Do most people pay no attention to who signed a package, making it worthless, since anyone can anonymously create a PGP key and sign anything they want? – nealmcb May 26 '17 at 17:05
2
  1. Along with the accepted answer, your intranet Maven repository can be poisoned by someone inside your organisation with access to your intranet Maven repository. I would advise applying strict access control to your intranet Maven repository. Many Maven repositories in my experience have a single admin user that many developers know the password to.

  2. "A Cross-Build Injection (XBI)" attack is also possible by poisoning the maven-compiler-plugin which most Maven projects use.

  3. Dilettante is a proxy for exploiting the fact that older versions of Maven still connect via HTTP and not HTTPS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.