3 ms·

This is a real problem that I believe will become increasingly commonly used by attackers to break into companies. Unfortunately, it's not an easy problem to a

This is a real problem that I believe will become increasingly commonly used by attackers to break into companies. Unfortunately, it's not an easy problem to automate the detection. There are some heuristics, but you're basically writing something like Norton Antivirus for Python packages lol. A sufficiently skilled attacker can make their code look totally innocent[0]. :) Source: Former security engineer at Uber/Snap that's now working on tooling in this space[1]. 0: "Underhanded C Competition" http://www.underhanded-c.org/ http://www.underhanded-c.org/ 1: Open Source "Supply Chain Security" platform https://github.com/lunasec-io/lunasec https://github.com/lunasec-io/lunasec

jollofricepeas 4y ago
It’s already extremely common in the Python, Ruby and Node ecosystem (see sources below). The only company that has a real chance at making a dent in the issue is GitHub and to a degree they already have. SOURCES: - https://www.mandiant.com/resources/blog/supply-chain-node-js https://www.mandiant.com/resources/blog/supply-chain-node-js - https://www.zdnet.com/article/backdoor-found-in-ruby-library-for-checking-for-strong-passwords/ https://www.zdnet.com/article/backdoor-found-in-ruby-library... - https://www.reversinglabs.com/blog/mining-for-malicious-ruby-gems https://www.reversinglabs.com/blog/mining-for-malicious-ruby... - https://news.sophos.com/en-us/2021/10/24/node-poisoning-hijacked-package-delivers-coin-miner-and-credential-stealing-backdoor/amp/ https://news.sophos.com/en-us/2021/10/24/node-poisoning-hija... - https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/amp/ https://www.bleepingcomputer.com/news/security/dev-corrupts-... - https://portswigger.net/daily-swig/amp/malicious-python-library-ctx-removed-from-pypi-repo https://portswigger.net/daily-swig/amp/malicious-python-libr...

jollofricepeas 4y ago

It’s already extremely common in the Python, Ruby and Node ecosystem (see sources below). The only company that has a real chance at making a dent in the issue is GitHub and to a degree they already have. SOURCES: - https://www.mandiant.com/resources/blog/supply-chain-node-js https://www.mandiant.com/resources/blog/supply-chain-node-js - https://www.zdnet.com/article/backdoor-found-in-ruby-library-for-checking-for-strong-passwords/ https://www.zdnet.com/article/backdoor-found-in-ruby-library... - https://www.reversinglabs.com/blog/mining-for-malicious-ruby-gems https://www.reversinglabs.com/blog/mining-for-malicious-ruby... - https://news.sophos.com/en-us/2021/10/24/node-poisoning-hijacked-package-delivers-coin-miner-and-credential-stealing-backdoor/amp/ https://news.sophos.com/en-us/2021/10/24/node-poisoning-hija... - https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/amp/ https://www.bleepingcomputer.com/news/security/dev-corrupts-... - https://portswigger.net/daily-swig/amp/malicious-python-library-ctx-removed-from-pypi-repo https://portswigger.net/daily-swig/amp/malicious-python-libr...