Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Analysis of an OSS supply chain attack - How did 8 millions developers download an exploit with no one noticing?

137 views

Published on

Talk given at BSidesPDX on the node/npm event-stream exploit, how it worked, and what it did.

Published in: Technology
  • Be the first to comment

  • Be the first to like this

Analysis of an OSS supply chain attack - How did 8 millions developers download an exploit with no one noticing?

  1. 1. Jarrod Overson - BSidesPDX Why are imitation attacks such a problem? Analysis of an OSS supply chain attack How did millions of developers download malicious code with no one noticing? Jarrod Overson - BSidesPDX
  2. 2. Jarrod Overson - BSidesPDX
  3. 3. Jarrod Overson - BSidesPDX
  4. 4. Jarrod Overson - BSidesPDX
  5. 5. Jarrod Overson - BSidesPDX npm install [anything]
  6. 6. Jarrod Overson - BSidesPDX The threat is real And it's coming from inside the house.
  7. 7. Jarrod Overson - BSidesPDX How it happened What it did Where it leaves us 1 2 3 Agenda
  8. 8. Jarrod Overson - BSidesPDX Who am I? • Director at Shape Security & Google Dev Expert. • Write/talk/record about JS reverse engineering & breaking web apps. • Old-school video game hacker. • @jsoverson most everywhere This guy
  9. 9. Jarrod Overson - BSidesPDX ?
  10. 10. Jarrod Overson - BSidesPDX Ever heard of YKK?
  11. 11. Jarrod Overson - BSidesPDX
  12. 12. Jarrod Overson - BSidesPDX You used Shape this week. We're the reason you log in a lot less and see fewer CAPTCHAs.
  13. 13. Jarrod Overson - BSidesPDX How it happened What it did Where it leaves us 1 2 3 Agenda
  14. 14. Jarrod Overson - BSidesPDX JS It started with a package, event-stream
  15. 15. Jarrod Overson - BSidesPDX
  16. 16. Jarrod Overson - BSidesPDX
  17. 17. Jarrod Overson - BSidesPDX
  18. 18. Jarrod Overson - BSidesPDX
  19. 19. Jarrod Overson - BSidesPDX JS event-stream was maintained by prolific developer Dominic Tarr
  20. 20. Jarrod Overson - BSidesPDX
  21. 21. Jarrod Overson - BSidesPDX
  22. 22. Jarrod Overson - BSidesPDX
  23. 23. Jarrod Overson - BSidesPDX JS Domenic gave ownership to right9ctrl in September of 2018 *
  24. 24. Jarrod Overson - BSidesPDX Q: Why?
  25. 25. Jarrod Overson - BSidesPDX
  26. 26. Jarrod Overson - BSidesPDX
  27. 27. Jarrod Overson - BSidesPDX JS right9ctrl gained trust by committing several innocent changes. ...b550f5: upgrade dependencies ...37c105: add map and split examples ...477832: remove trailing in split example ...2c2095: better pretty.js example ...a644c5: update readme event-stream
  28. 28. Jarrod Overson - BSidesPDX JS On Sept 9 2018 right9ctrl added a new dependency and released version 3.3.6 JS v3.3.6 JS v0.1.0 flatmap-stream event-stream
  29. 29. Jarrod Overson - BSidesPDX About that caret...
  30. 30. Jarrod Overson - BSidesPDX Semantic Versioning (semver) Major.Minor.Patch e.g. 3.4.9 Breaking changes New features Bug fixes Increasing risk
  31. 31. Jarrod Overson - BSidesPDX Semver pattern matching Symbol Example Matches ^ ^0.1.0 0.*.* ~ ~0.1.0 0.1.*
  32. 32. Jarrod Overson - BSidesPDX JS right9ctrl then removed flatmap-stream and updated event-stream to v4.0.0. v4.0.0 event-stream
  33. 33. Jarrod Overson - BSidesPDX Note: Nothing malicious has emerged thus far.
  34. 34. Jarrod Overson - BSidesPDX Total time between first commit and v4.0.0? 12 days
  35. 35. Jarrod Overson - BSidesPDX JS On October 5th 2018 (T+31) flatmap-stream@0.1.1 was published. JS v3.3.6 v0.1.1 flatmap-stream event-stream JS v0.1.0
  36. 36. Jarrod Overson - BSidesPDX JS event-stream@3.3.6 installed fresh now pulls in flatmap-stream@0.1.1 because of the ^ JS v3.3.6 v0.1.1 flatmap-stream event-stream
  37. 37. Jarrod Overson - BSidesPDX event-stream@3.3.5 was stable for 2+ years. JSJS v3.3.6 event-stream
  38. 38. Jarrod Overson - BSidesPDX A LOT depended on event-stream^3.3.5 and would get updated to 3.3.6 automatically. JS JS JS JS JS JS JS JS JS
  39. 39. Jarrod Overson - BSidesPDX Time between flatmap-stream@0.1.1 and exposure: 48 days Time between malicious control and discovery: 77 days
  40. 40. Jarrod Overson - BSidesPDX How it happened What it did Where it leaves us 1 2 3 Agenda
  41. 41. Jarrod Overson - BSidesPDX First, how was it discovered?
  42. 42. Payload A used a method deprecated in node v11.0.0
  43. 43. Node v11.0.0 was released 18 days into the exploit.
  44. 44. Unrelated projects started getting deprecation warnings.
  45. 45. Finally someone started putting it together.
  46. 46. Jarrod Overson - BSidesPDX So how was it discovered? Luck.
  47. 47. flatmap-stream v0.1.0
  48. 48. flatmap-stream v0.1.1
  49. 49. Jarrod Overson - BSidesPDX Payload A The bootstrap.
  50. 50. Jarrod Overson - BSidesPDX Recap • The script decrypts and compiles a new module. • The key comes from a package description somewhere. • The encrypted JS comes from testData[0]. • The compiled module exports testData[1].
  51. 51. Jarrod Overson - BSidesPDX What does this mean? The script only serves its purpose if the code runs from an npm script in a directory that has a package.json with a "description" field containing a specific string that can act as the key.
  52. 52. Jarrod Overson - BSidesPDX What this means for us We need to start trolling through package.json files.
  53. 53. 😂
  54. 54. Jarrod Overson - BSidesPDX Strategy • Iterate through every package. • Decrypt testData[0]. • Run the decrypted data through a JS Parser. • If successful then we have a winner.
  55. 55. Jarrod Overson - BSidesPDX
  56. 56. Jarrod Overson - BSidesPDX
  57. 57. Copay, the Secure Bitcoin Wallet.
  58. 58. Jarrod Overson - BSidesPDX Payload B The injector.
  59. 59. Payload B
  60. 60. Payload B
  61. 61. Jarrod Overson - BSidesPDX npm scripts redux npm run-script script-name [0] [1] [2]argv:
  62. 62. Payload B
  63. 63. copay's package.json scripts
  64. 64. Payload B
  65. 65. Jarrod Overson - BSidesPDX Recap • Payload B noops unless run in copay's build stage. • Decrypts payload C just like payload B. • Injects payload C into a file used in copay's mobile app. • Payload C is then executed in the mobile app while on a user's mobile device.
  66. 66. Jarrod Overson - BSidesPDX Payload C The final payload.
  67. 67. Payload C
  68. 68. Jarrod Overson - BSidesPDX Payload C in a nutshell • Harvested private keys • Targeted wallets with over 100 BTC or 1000 BCH • Communicated with third party server copayapi.host
  69. 69. Jarrod Overson - BSidesPDX How it happened What it did Where it leaves us 1 2 3 Agenda
  70. 70. Jarrod Overson - BSidesPDX This is NOT node/npm specific Any public repository of code is susceptible.
  71. 71. Jarrod Overson - BSidesPDX The Good News. Once the issue was brought to light the community • responded rapidly • investigated quickly • mitigated the issue immediately • and produced tools to help others right away.
  72. 72. Jarrod Overson - BSidesPDX The Bad News. It has happened multiple times since.
  73. 73. The dependency problem is not ideal.
  74. 74. Jarrod Overson - BSidesPDX This could have been much worse. event-stream was depended on things like the - azure-cli - dozens of build tools and plugins - Microsoft's monaco editor (the editor for VSCode)
  75. 75. Jarrod Overson - BSidesPDX This will likely get much worse. Properly addressing this problem requires rethinking node, dependencies, and package management. Hard things with lots of compatibility implications.
  76. 76. Jarrod Overson - BSidesPDX
  77. 77. Jarrod Overson - BSidesPDX What can you do? • Audit your dependencies. • Lock your dependencies. • Check in your dependencies. • Think twice before adding dependencies.
  78. 78. Jarrod Overson - BSidesPDX When in doubt, don't add it. • Dependencies are risks. • Risks are gambles. • You gamble when cost is low and value is high.
  79. 79. Jarrod Overson - BSidesPDX Why are imitation attacks such a problem?Thank You! @jsoverson on bit.ly/jsoverson-youtube

×