Protecting Your Software from Malicious Third-party Dependencies

There have been reports of cybercriminals creating malicious counterfeits of legitimate dependencies by attempting to populate package manager and container repositories with malicious codes and images. Below are some of the recent cases involving the introduction of vulnerabilities into the system through malicious third-party dependencies:

• In January 2023, Visual Studio (VS) Code and PyTorch have identified malicious dependencies masquerading as legitimate code. The malicious VS Code extensions could be leveraged as an initial access vector masquerading as their legitimate counterparts with the goal of mounting supply chain attacks, while the malicious PyTorch dependency can lead to basic fingerprinting of system information and compromise sensitive data.

• In June 2021, malicious cryptomining code was detected in multiple Python Package Index (PyPI) packages.

• In March 2021, at least 30 malicious docker images (with a collective 20 million download volume) in Docker Hub were used to spread cryptomining malware accounting for cryptojacking operations worth US$200,000.

• Since August 2020, several JavaScript packages in the Node package manager (npm) were found to be installing remote access trojan (RAT) or opening reverse shells on victim machines.

Inadvertent download and deployment of malicious dependencies in enterprise projects will pose a significant risk to enterprises and may lead to data exfiltration. As such, developers are advised to stay vigilant and adopt good cyber hygiene measures when downloading and deploying third-party dependencies.

Some common techniques conducted by cybercriminals to trick developers into downloading malicious dependencies are outlined below:

Typosquatting

Malicious dependencies may attempt to disguise as legitimate dependencies by using a similar but misspelt name, attempting to trick unsuspecting developers to inadvertently install these malicious packages.

Examples of Typosquatting:

“Jeilyfish” in PyPI is a misspelling of the legitimate dependency “Jellyfish”

“electorn” in npm is a misspelling of the legitimate dependency “electron”

Brandjacking

Cybercriminals may impersonate a trusted organisation by using the same naming convention or other characteristics specific to the organisation, to gain the trust of victims and trick them into downloading the malicious dependencies.

Dependency Confusion

Cybercriminals may publish malicious public dependency packages with the same name but with a higher version number to take advantage of the default behaviour of the package manager to force download the malicious dependency packages.

Precautionary Measures when Using Third-party Dependencies

Developers may wish to adopt the following precautionary measures to protect themselves and their organisations from malicious dependencies:

• Review and update the inventory and dependency tree of all third-party dependencies regularly.

• Implement a security and vulnerability management policy which consists of the selection, evaluation and update process of open-source libraries and images for the developers.
  

• Deploy tools that can help to scan GitHub repositories and raise pull requests (PR) when they find dependency updates.
  

• Incorporate secure software development framework (SSDF) into the software development life cycle (SDLC).
  

• Ensure that third-party dependencies are only downloaded from an official repository and that they comply with security requirements.
  

• Minimise the use of dependencies where possible, and remove unused dependencies to minimise the amount of things you need to monitor.

• Always be cautious when downloading third-party dependencies and ensure that the name is spelt correctly.

• Ensure that the downloaded dependencies undergo checksum verification and signature verification.

• Consider using reputable automated alerts and patching tools for scanning vulnerabilities in third-party dependencies.

For more information, please refer to:

https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/

https://www.hkcert.org/blog/beware-of-malicious-or-vulnerable-third-party-dependencies

https://www.truesec.com/hub/techtalk/managing-threats-and-vulnerabilities-from-third-party-dependencies-in-software-development-projects

https://heimdalsecurity.com/blog/malicious-pypi-packages-used-to-mine-cryptocurrency/

https://www.zdnet.com/article/malicious-npm-packages-caught-installing-remote-access-trojans/

https://unit42.paloaltonetworks.com/malicious-cryptojacking-images/

https://snyk.io/series/open-source-security/software-dependencies/

https://thehackernews.com/2023/01/hackers-distributing-malicious-visual.html