Beefy Boxes and Bandwidth Generously Provided by pair Networks
"be consistent"
 
PerlMonks  

(OT) Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies

by parv (Vicar)
on Feb 11, 2021 at 21:24 UTC ( #11128272=perlnews: print w/replies, xml ) Need Help??

In Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies, Alex B details installation of potential malware via (semi)official channels of installing software in Python (PyPI), Ruby (RubyGems), & Node/Javascript (NPM). Their efforts were part of bug-bounty programs at various companies.

  • Comment on (OT) Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies

Replies are listed 'Best First'.
Re: (OT) Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies
by parv (Vicar) on Mar 07, 2021 at 07:33 UTC

    Actual attack this time: A new type of supply-chain attack with serious consequences is flourishing: New dependency confusion attacks take aim at Microsoft, Amazon, Slack, Lyft, and Zillow by Dan G (Mar 6, 2021) ...

    The goal of these attacks is to execute unauthorized code inside a targetís internal software build system. The technique works by uploading malicious packages to public code repositories and giving them a name thatís identical to a package stored in the target developerís internal repository.

    Developersí software management apps often favor external code libraries over internal ones, so they download and use the malicious package rather than the trusted one. Alex Birsan [...] dubbed the new type of supply chain attack dependency confusion or namespace confusion because it relies of software dependencies with misleading names.

Re: (OT) Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies
by LanX (Cardinal) on Mar 07, 2021 at 11:26 UTC
    Thanks interesting read!

    Some thoughts from a Perl perspective (which wasn't mentioned)

    • companies could restrict their proprietary modules to the same top-namespace like Apple::
    • build systems could refuse to install from such private namespaces
    • examples like My:: or Our:: come into mind as private by default
    • CPAN could deny releases into "private namespaces" or similar
    • another option for privacy could be leading underscores package _CompanyModule;

    Disclaimer: I didn't thoroughly check if any of this is already done. But I found at least one module released under My::Object

    Cheers Rolf
    (addicted to the Perl Programming Language :)
    Wikisyntax for the Monastery

      The simple approach is to run your own CPAN mirror and only import modules there that you have previously vetted.

      Randomly pulling down packages from the internet is not a good strategy, no matter what assurances CPAN provides.

        Managing this reliably in a mid-sized team is already hard, even more in a company.

        Using a naming convention/namespace for internal stuff can't be wrong.

        Cheers Rolf
        (addicted to the Perl Programming Language :)
        Wikisyntax for the Monastery

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: perlnews [id://11128272]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others exploiting the Monastery: (4)
As of 2021-05-13 01:16 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    Perl 7 will be out ...





    Results (134 votes). Check out past polls.

    Notices?