Dependency Confusion Supply-Chain Attack Hit Over 35 High-Profile Companies

In what’s a novel supply chain attack, a security researcher
managed to breach over 35 major companies’ internal systems,
including that of Microsoft, Apple, PayPal, Shopify, Netflix, Yelp,
Tesla, and Uber, and achieve remote code execution.

The technique, called dependency confusion^[1]
or a substitution attack, takes advantage of the fact that a piece
of software may include components from a mix of private and public
sources.

These external package dependencies, which are fetched from
public repositories during a build process, can pose an attack
opportunity when an adversary uploads a higher version of a private
module to the public feed, causing a client to automatically
download the bogus “latest” version without requiring any action
from the developer.

“From one-off mistakes made by developers on their own machines,
to misconfigured internal or cloud-based build servers, to
systemically vulnerable development pipelines, one thing was clear:
squatting valid internal package names was a nearly sure-fire
method to get into the networks of some of the biggest tech
companies out there, gaining remote code execution, and possibly
allowing attackers to add backdoors during builds,” security
researcher Alex Birsan detailed in a write-up.

Birsan has been collectively awarded over $130,000 in bug
bounties for his efforts.

To carry out the attack, Birsan began by collecting names of
private internal packages used by major companies off GitHub, posts
on various internet forums, and JavaScript files that list a
project’s dependencies, and then uploaded rogue libraries using
those same names to open-source package hosting services such as
npm, PyPI, and RubyGems.

“[Shopify’s] build system automatically installed a Ruby gem
named ‘shopify-cloud’ only a few hours after I had uploaded it, and
then tried to run the code inside it,” Birsan noted, adding a Node
package that he uploaded to npm in August 2020 was executed on
multiple machines inside Apple’s network, affecting projects
related to the company’s Apple ID authentication system.

Birsan ultimately used the counterfeit packages to obtain a
record of every machine where the packages were installed and
exfiltrated the details over DNS for the reason that the “traffic
would be less likely to be blocked or detected on the way out.”

The concern that a package with the higher version would be
pulled by the app-building process regardless of wherever it’s
located hasn’t escaped Microsoft’s notice, which released a
new white paper^[2]
on Tuesday outlining three ways to mitigating risks when using
private package feeds.

Chief among its recommendations are as follows —

• Reference one private feed, not multiple
• Protect private packages using controlled scopes, namespaces,
  or prefixes, and
• Utilize client-side verification features such as version
  pinning and integrity verification