EXECUTIVE SUMMARY:

Last week, cyber security researcher and ethical hacker, Alex Birsan, executed a dependency or namespace confusion attack. It involved co-opting the names of submissions in public code repositories. These public code repositories included the likes of NPM, PyPl and RubyGem.

The attack proved that counterfeit code could compromise networks. Thirty five high-profile organizations, including major tech firms, fell for the bogus code experiment. “The success rate [of the attack] was simply astonishing”, stated Birsan.

Birsan would discover when a company executed his code due to a “phone home” element. Of the organizations that logged callbacks, nearly 75% utilized NPM. However, the problem isn’t unique to any singular ecosystem. Python and Ruby could be equally susceptible.

Detangling the dependency attack

In using open source code, developers negate the headache that is creating fresh code themselves. Public code libraries permit developers to add functionalities to their own code after it’s uploaded. When the code later downloads, it inherently includes any new dependencies.

Alex Birsan scoured internet threads, JavaScript code, unintentionally published internal packages and other sources to identify the names of dependencies used by 35 different organizations. Getting the targeted organizations to automatically download the counterfeit code was easy. He simply published higher package version numbers than the ones in existence.

Why was this attack so successful?

The dependency confusion issue perpetuates due to a design flaw in the configuration of DevOps tools. It has to do with how the programs decide on which packages or dependencies to prioritize, especially if several with the same name exist.

Beyond that, says Birsan, “From one-off mistakes made by developers on their own machines, to misconfigured internal or cloud-based build servers, to systemically vulnerable development pipelines, one thing was clear: squatting valid internal package names was a nearly sure-fire method to get into the networks of some of the biggest tech companies out there, gaining remote code execution, and possibly allowing attackers to add backdoors during builds”.

Is this type of supply chain attack new?

Attacks involving a type-o or name changes to programs have been around for quite some time. However, the technicalities of this attack are a bit unusual. Most of these attacks require humans to make errors in order for them to succeed. This attack is 100% automated, comparatively speaking.

Is the researcher under fire?

No. Alex Birsan pursued ethical hacking research. He obtained permission to test the perimeters of all 35 affected organizations. Shopify and Apple have both announced rewards of $30,000 each, and all-in-all, Birsan will receive more than $130,000 for his work.

How can your organization avoid dependency confusion attacks?

  • Require namespace and scope verification
  • Typosquat names of your newly developed packages in public repositories
  • Consider changing the installation tools that your organization uses
  • Consider modifying the development team’s workflow

Further details 

Manually identifying these types of attacks is nearly impossible. Select next-generation software tools can help. If your organization would like to determine whether or not recently developed code may be vulnerable to dependency confusion attacks, online vulnerability scanners can provide you with the insights that you need.

For more on this novel supply chain attack form, visit Ars Technica.