Hijacked S3 buckets used in attacks on npm packages
(2023/06/19)
- Reference: 1687174154
- News link: https://www.theregister.co.uk/2023/06/19/npm_s3_buckets_malware/
- Source link:
Miscreants are using expired Amazon Web Services (AWS) S3 buckets to place malicious code into a legitimate package in the npm repository without having to tinker with any code.
Software security firm Checkmarx said it began investigating after GitHub late last month posted an [1]advisory about several releases of an npm package called bignum that was taken over by cybercrooks and serving malicious binaries that would steal information like user IDs, passwords, and local host names from victims' systems.
The infosec engineers wrote a [2]report describing the issue, noting that while the threat of the bignum package was mitigated with a new version, they found that dozens of other open source packages in the npm code repository were vulnerable to the same attack.
[3]
"Since it was the first time such an attack was observed, we conducted a quick search across the open source ecosystem," wrote Guy Nachshon, a software engineer with Checkmarx. "The results were startling. We found numerous packages and repositories using abandoned S3 buckets that are susceptible to this exploitation."
Code repositories under attack
This latest threat is part of a growing trend of groups looking at the [4]software supply chain as an easy way to deploy their malware and quickly have it reach a broad base of potential victims. Through attacks on npm and other repositories like [5]GitHub , [6]Python Package Index (PyPI), and [7]RubyGems , miscreants look to place their malicious code in packages that are then downloaded by developers and used in their applications.
In this case, they found their way in via the abandoned S3 buckets, part of AWS object storage services that enable organizations to store and retrieve huge amounts of data – files, documents, and images, among other digital content – in the cloud. They're accessed via unique URLs and used for such jobs as hosting websites and backing up data.
[8]
[9]
The bignum package used node-gyp , a command-line tool written in Node.js, for downloading a binary file that initially was hosted on a S3 bucket. If the bucket couldn't be accessed, the package was prompted to look for the binary locally.
"However, an unidentified attacker noticed the sudden abandonment of a once-active AWS bucket," Nachshon wrote. "Recognizing an opportunity, the attacker seized the abandoned bucket. Consequently, whenever bignum was downloaded or re-installed, the users unknowingly downloaded the malicious binary file, placed by the attacker."
Stealing and exfiltrating credentials
The malicious binary functioned like the original one but also stole credentials and sent them to the same hijacked bucket, with the data exfiltrated via a GET request, he wrote. It was a C/C++ compiled binary called for in JavaScript applications, with a foot in both JavaScript and C/C++ libraries, which allowed Node.js modules to reach lower-level code and expanding the attack surface.
[10]This malicious PyPI package mixed source and compiled code to dodge detection
[11]Python Package Index had one person on-call to hold back weekend malware rush
[12]GitHub debuts pedigree check for npm packages via Actions
[13]Worried about the security of your code's dependencies? Try Google's Deps.dev
Nachshon reverse-engineered the compiled file, though it wasn't easy. One problem? Scanning the file using VirusTotal didn't detect it as malware. However, he looked at the strings in the file and found "some weird behavior," convincing him to dive deeper.
The larger problem was the other packages and repositories that also were using expired S3 buckets, which this kind of attack a problem well beyond bignum.
[14]
"The danger it poses can be huge if an attacker manages to exploit it as soon as this kind of change occurs," he wrote. "Another risk is posed to organizations or developers using frozen versions or 'artifactories' as they will continue to access the same, now hijacked, bucket."
A new, safer version of bignum
Versions 0.12.2 to 0.13.0 of bignum used node-pre-gyp for downloading pre-built binaries. The latest version, 0.13.1, doesn't use that. It also doesn't allow downloading of pre-built binaries to avoid malicious downloads.
Zane Bond, head of product at zero trust security software maker Keeper Security, told The Register that while the method used by miscreants in this attack is novel, SQL injection attacks themselves are not unusual.
"Finding the exact string that allows you to compromise a system is quite difficult, but this attack type is one of the most simple and common ones out there," Bond said. "This is a case of an adversary getting lucky while doing typical adversary activity."
The problem is that a similar scenario could play out whenever a trusted distribution location – in this case, the S3 buckets – is no longer used and is abandoned, according to his colleague, Patrick Tiquet, vice president of security and architecture with Keeper Security. ®
Get our [15]Tech Resources
[1] https://github.com/advisories/GHSA-7cgc-fjv4-52x6
[2] https://checkmarx.com/blog/hijacking-s3-buckets-new-attack-technique-exploited-in-the-wild-by-supply-chain-attackers/?
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/storage&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZJB7msTMAzfzJFi2xVDN7AAAAEk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2023/02/22/open_software_supply_chain_risks/
[5] https://www.theregister.com/2023/05/09/blackbird_github_search/
[6] https://www.theregister.com/2023/06/02/novel_pypi_attack_reversinglabs/
[7] https://www.theregister.com/2022/08/16/rubygems_package_registry_mfa/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/storage&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZJB7msTMAzfzJFi2xVDN7AAAAEk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/storage&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZJB7msTMAzfzJFi2xVDN7AAAAEk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/06/02/novel_pypi_attack_reversinglabs/
[11] https://www.theregister.com/2023/05/22/python_package_index_on_call/
[12] https://www.theregister.com/2023/04/19/github_actions_npm_origins/
[13] https://www.theregister.com/2023/04/13/google_api_security/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/storage&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZJB7msTMAzfzJFi2xVDN7AAAAEk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
Software security firm Checkmarx said it began investigating after GitHub late last month posted an [1]advisory about several releases of an npm package called bignum that was taken over by cybercrooks and serving malicious binaries that would steal information like user IDs, passwords, and local host names from victims' systems.
The infosec engineers wrote a [2]report describing the issue, noting that while the threat of the bignum package was mitigated with a new version, they found that dozens of other open source packages in the npm code repository were vulnerable to the same attack.
[3]
"Since it was the first time such an attack was observed, we conducted a quick search across the open source ecosystem," wrote Guy Nachshon, a software engineer with Checkmarx. "The results were startling. We found numerous packages and repositories using abandoned S3 buckets that are susceptible to this exploitation."
Code repositories under attack
This latest threat is part of a growing trend of groups looking at the [4]software supply chain as an easy way to deploy their malware and quickly have it reach a broad base of potential victims. Through attacks on npm and other repositories like [5]GitHub , [6]Python Package Index (PyPI), and [7]RubyGems , miscreants look to place their malicious code in packages that are then downloaded by developers and used in their applications.
In this case, they found their way in via the abandoned S3 buckets, part of AWS object storage services that enable organizations to store and retrieve huge amounts of data – files, documents, and images, among other digital content – in the cloud. They're accessed via unique URLs and used for such jobs as hosting websites and backing up data.
[8]
[9]
The bignum package used node-gyp , a command-line tool written in Node.js, for downloading a binary file that initially was hosted on a S3 bucket. If the bucket couldn't be accessed, the package was prompted to look for the binary locally.
"However, an unidentified attacker noticed the sudden abandonment of a once-active AWS bucket," Nachshon wrote. "Recognizing an opportunity, the attacker seized the abandoned bucket. Consequently, whenever bignum was downloaded or re-installed, the users unknowingly downloaded the malicious binary file, placed by the attacker."
Stealing and exfiltrating credentials
The malicious binary functioned like the original one but also stole credentials and sent them to the same hijacked bucket, with the data exfiltrated via a GET request, he wrote. It was a C/C++ compiled binary called for in JavaScript applications, with a foot in both JavaScript and C/C++ libraries, which allowed Node.js modules to reach lower-level code and expanding the attack surface.
[10]This malicious PyPI package mixed source and compiled code to dodge detection
[11]Python Package Index had one person on-call to hold back weekend malware rush
[12]GitHub debuts pedigree check for npm packages via Actions
[13]Worried about the security of your code's dependencies? Try Google's Deps.dev
Nachshon reverse-engineered the compiled file, though it wasn't easy. One problem? Scanning the file using VirusTotal didn't detect it as malware. However, he looked at the strings in the file and found "some weird behavior," convincing him to dive deeper.
The larger problem was the other packages and repositories that also were using expired S3 buckets, which this kind of attack a problem well beyond bignum.
[14]
"The danger it poses can be huge if an attacker manages to exploit it as soon as this kind of change occurs," he wrote. "Another risk is posed to organizations or developers using frozen versions or 'artifactories' as they will continue to access the same, now hijacked, bucket."
A new, safer version of bignum
Versions 0.12.2 to 0.13.0 of bignum used node-pre-gyp for downloading pre-built binaries. The latest version, 0.13.1, doesn't use that. It also doesn't allow downloading of pre-built binaries to avoid malicious downloads.
Zane Bond, head of product at zero trust security software maker Keeper Security, told The Register that while the method used by miscreants in this attack is novel, SQL injection attacks themselves are not unusual.
"Finding the exact string that allows you to compromise a system is quite difficult, but this attack type is one of the most simple and common ones out there," Bond said. "This is a case of an adversary getting lucky while doing typical adversary activity."
The problem is that a similar scenario could play out whenever a trusted distribution location – in this case, the S3 buckets – is no longer used and is abandoned, according to his colleague, Patrick Tiquet, vice president of security and architecture with Keeper Security. ®
Get our [15]Tech Resources
[1] https://github.com/advisories/GHSA-7cgc-fjv4-52x6
[2] https://checkmarx.com/blog/hijacking-s3-buckets-new-attack-technique-exploited-in-the-wild-by-supply-chain-attackers/?
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/storage&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZJB7msTMAzfzJFi2xVDN7AAAAEk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2023/02/22/open_software_supply_chain_risks/
[5] https://www.theregister.com/2023/05/09/blackbird_github_search/
[6] https://www.theregister.com/2023/06/02/novel_pypi_attack_reversinglabs/
[7] https://www.theregister.com/2022/08/16/rubygems_package_registry_mfa/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/storage&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZJB7msTMAzfzJFi2xVDN7AAAAEk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/storage&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZJB7msTMAzfzJFi2xVDN7AAAAEk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/06/02/novel_pypi_attack_reversinglabs/
[11] https://www.theregister.com/2023/05/22/python_package_index_on_call/
[12] https://www.theregister.com/2023/04/19/github_actions_npm_origins/
[13] https://www.theregister.com/2023/04/13/google_api_security/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/storage&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZJB7msTMAzfzJFi2xVDN7AAAAEk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
b0llchit
And yet again it is proven that "cloudly stored de-central non-accountable development" is a risky business.
But then, the "need" for npm in this form is just asking for problems. Why do we need so many disjoint "libraries"? I've seen dependency-trees pulling in 100+ packages from all over the place. That is just obscene. Sure, the base language library is lacking, but fewer packages that supply a proper and universal library platform would surely be appreciated. That would also make your attack surface a lot smaller.
Attack of the “open source” FUD MONSTER
t245t
“a quick glance through the open-source ecosystem reveals that dozens of packages are vulnerable to this same attack.”
Do tell, don't spare the details!
“Attackers poisoned the NPM package “bignum” by hijacking the S3 bucket”
“About 6 months ago, this bucket was deleted .. This opened the bucket to a takeover”
“When the bucket is deleted, the name becomes available again.”
A bit of a defect in the S3 non-open-source infrastructure.
“This counterfeit. node ..also added a malicious payload that waws”
‘Was’ shurly ?
For those of you, like me, left scratching their heads about what the actual attack was after reading the article: The attack was that an older version of the npm package pulled binaries from an S3 bucket during installation. The bucket was deleted and the attackers created a bucket of their own with the same name (S3 bucket names are globally unique) and served poisoned binaries from that bucket. Presumably this worked because there are codebases still using the older versions of bignum and CI/CD and new devs working on the codebase are installing the older package and getting the poisened binaries in the process.