The Hitchhiker's Guide to Malicious Third-Party Dependencies - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2023

The Hitchhiker's Guide to Malicious Third-Party Dependencies

Résumé

The increasing popularity of certain programming languages has spurred the creation of ecosystem-specific package repositories and package managers. Such repositories (e.g., npm, PyPI) serve as public databases that users can query to retrieve packages for various functionalities, whereas package managers automatically handle dependency resolution and package installation on the client side. These mechanisms enhance software modularization and accelerate implementation. However, they have become a target for malicious actors seeking to propagate malware on a large scale. In this work, we show how attackers can leverage capabilities of popular package managers and languages to achieve arbitrary code execution on victim machines, thereby realizing open-source software supply chain attacks. Based on the analysis of 7 ecosystems, we identify 3 install-time and 4 runtime techniques, and we provide recommendations describing how to reduce the risk when consuming third-party dependencies. We provide example implementations that demonstrate the identified techniques. Furthermore, we describe evasion strategies employed by attackers to circumvent detection mechanisms.
Fichier principal
Vignette du fichier
2307.09087.pdf (886.19 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04423802 , version 1 (29-01-2024)

Licence

Paternité

Identifiants

Citer

Piergiorgio Ladisa, Merve Sahin, Serena Elisa Ponta, Marco Rosa, Matias Martinez, et al.. The Hitchhiker's Guide to Malicious Third-Party Dependencies. CCS 2023 - ACM SIGSAC Conference on Computer and Communications Security, Nov 2023, Copenhagen, Denmark. pp.65-74, ⟨10.1145/3605770.3625212⟩. ⟨hal-04423802⟩
20 Consultations
14 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More