Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages
Ruian Duan, Omar F. Alrawi, Ranjita Pai Kasturi, Ryan Elder, Brendan Saltaformaggio, Wenke Lee · 2021
organizations that rely on open-source interpreted programming languages for different internal and external applications.Attackers can infiltrate well-defended organization by simply subverting the software supply chain of registries.For example, eslint-scope [4], a package with millions of weekly downloads in Npm, was compromised to steal credentials from developers.Similarly, rest-client [5], which has over one hundred million downloads in RubyGems, was compromised to leave a Remote-Code-Execution (RCE) backdoor on web servers.These attacks demonstrate how miscreants can covertly gain access to a wide-range of organizations by carrying out a software supply chain attack.Security researchers [7] are aware of these attacks and have proposed several solutions to address the rise of malicious software in registries.Zimmermann et al. [8] systematically studied 609 known security issues and revealed a large attack surface in the Npm ecosystem.BreakApp [9], on the other hand, isolates untrusted packages, which addresses credential theft and prevents access to sensitive data, but does not stop cryptocurrency mining or backdoors.Additionally, many solutions [10]-[12] assume inherent trust and focus on finding bugs in packages rather than malicious packages.To make matters worse, some attacks are very sinister and use social engineering techniques [13], [14] to disguise themselves by first publishing a "useful" package, then waiting until it is used by their target to update it and include malicious payloads.Although, many security researchers are actively investigating attacks on registries and proposing solutions, these approaches seem to be ad-hoc and one-off solutions.A better approach is to understand the extent of the software supply chain abuse and how miscreants are taking advantage of them.The approach must be grounded to allow an objective comparison between the different registry ecosystem.To this end, we propose a framework that highlights key functionality, security mechanisms, stakeholders, and remediation techniques to comparatively analyze different registry ecosystems.We use our framework to look at what features registries provide, what security principles are enforced, how is trust delegated between different parties, and what remediation and contingency plans registries have in place for post-attack.We leverage our findings to provide practical action items that registry maintainers can enforce using pre-existing tools and security principles that will improve the security of the overall package management ecosystem.Using well-known program analysis techniques, we build MALOSS, a custom pipeline tailored for interpreted languages that we use to empirically study the security of package managers.We make this pipeline Abstract-Package managers have become a vital part of the modern software development process.They allow developers to reuse third-party code, share their own code, minimize their codebase, and simplify the build process.However, recent reports showed that package managers have been abused by attackers to distribute malware, posing significant security risks to developers and end-users.For example, eslint-scope, a package with millions of weekly downloads in Npm, was compromised to steal credentials from developers.To understand the security gaps and the misplaced trust that make recent supply chain attacks possible, we propose a comparative framework to qualitatively assess the functional and security features of package managers for interpreted languages.Based on qualitative assessment, we apply well-known program analysis techniques such as metadata, static, and dynamic analysis to study registry abuse.Our initial efforts found 339 new malicious packages that we reported to the registries for removal.The package manager maintainers confirmed 278 (82%) from the 339 reported packages where three of them had more than 100,000 downloads.For these packages we were issued official CVE numbers to help expedite the removal of these packages from infected victims.We outline the challenges of tailoring program analysis tools to interpreted languages and release our pipeline as a reference point for the community to build on and help in securing the software supply chain.The impact of this problem is not isolated to small one-off web apps, but large websites, enterprises, and even government Network and Distributed Systems Security (NDSS)