great news we fixed the problem here
um reintroducing Matthias oleaka
yeah I hope it works
[Applause]
sorry I have like more I thought I would
have more time so I'll be rushing a bit
but don't worry I'm still I'm staying at
till the end of the conference so if you
have any questions or want to discuss
things I'm happy to do that after my
talk so
um
complexity is one of the biggest
challenges we face as a security
industry or I.T security I.T industry in
general we have like different Cloud
providers different VMS containers skus
apis microservices from time to time we
add a new layer of abstraction
and it's harder to keep it secure and
since software is more embedded in our
lives than ever and nothing is going to
change here anytime soon
it is getting more interesting
as a target for criminals
um my name is
I work in securing I'm the principal
security consultant and head of web
security I did counter a training for
Developers
and before uh
I started my journey in security 10
years ago I was software developer
myself I somehow I developed interest in
attacks on developers I splitted that
into uh free areas oh sorry
uh three areas libraries tools and
infrastructure
um getting to libraries since MIT there
was a drawer in MIT you could find the
best algorithms they had and to borrow
them we do the same now we call it
libraries just not to reinvent the wheel
and that's okay but uh those libraries
are a target for attacks now and it got
more complex sometimes when you want to
install just one Library you might end
up having 30 of them because that one
Library depended on something which
depends on something Etc
and you have to secure all of those
dependencies not just one just the 30.
um
here is the catalog of the attacks some
of them are new some of them are things
you now applied to other areas
um
package managers is the way are the way
we get packages and most of them are
console tools and developers make typos
it's supposed to be electron but use
electron instead if you see this
purple graph it's like from Monday to
the week back it's like 32 errors done
32 times this library was downloaded
even though it's locked for some time to
give you an example just from this
Monday a men's company identified a new
npm account which published
more than 150 libraries impersonating in
this attack using type of squatting just
of
be downloaded instead of the original
libraries
sorry
oh yeah can you move
oh sorry sorry I see we were here yeah
so that was the just Monday that's one
incident
um here is the catalog of uh
techniques used in typo squatting so you
see this not only misspelling sometimes
you have a prefix postfix if there are a
few words in the name you have some
ordering attacks some different
separators all of that used to
make developers install that
instead of a
proper original Library
another thing introduced in 2021 what
you see here is a part of package.json
file with dependencies those blue ones
are in public npm repository those in
red
never mind the names those red are
private libraries developed by PayPal
and they should be available only from
private papers package Repository
researcher Alex Burson asks himself a
very good question what will happen if I
will make library with the same name and
I will publish that publicly in public
npm repository but he found out that his
libraries were downloaded either by
developers or cicd servers from PayPal
but it was not only PayPal it was
different package managers and different
companies vulnerable to that just
confusing conclusion from where I
download Library it should be taken from
private not from public but it appeared
that that was wrong since from that we
have this confusion he earned I think a
100 000 dollars in back bounties using
that vulnerability and it's still around
us today
um this is classic fishing we take a
popular Library you might see you have
like weekly downloads almost 8 million
and we fish the maintainer and we
publish a new version so let's have a
very quick analysis what happened in
this modified version so of course
version bump
and the principle directive at the
bottom will it was added it will run
during the package installation
uh so what does it do it starts with OS
detection Macos users are safe in Linux
it will happen something for Linux in
Windows princel dot but will be executed
in Linux the same but sh and let's dive
into what will Linux script will do
first we have geolocation
if you're in Russia Ukraine Belarus or
Kazakhstan it won't work then you skip
to this part it will check if JS
extension process is running if it's not
running it will try with curl on wget
download this file make it executable
around it and this is a cryptocurrency
miner so pretty simple attack Maybe
and more or less the same will happen on
Windows
another example that this this
attacks are happening is from two weeks
back
again mandaio reported that a popular
cryptocurrency exchange dydx npm account
was hacked and they published I think
four
versions of libraries this
cryptocurrency maintains
so it's still a thing
uh here is the idea of attack I find an
old unused npm package or an other
package takeover the expired domain
and recreate the maintainer's email on
npm but this is just the idea the
package it was connected to was for it
and the maintainer stated that yes of
course in the repository was my email on
the domain that expired but my npm
account is tied to a different
a domain but this is this is still a way
to take over something which was with
which some libraries Which is popular
but not maintained anymore maybe some
domain expired
and protest work that's New Breed around
I think March this year
what you see here is a for Loop which
will run indefinitely this is denial of
service
basically it will lock something to the
console and that's it and now uh
stopping in this case
you might ask what will am do IM
displays this gentleman here
on the outer because those changes those
malicious changes were introduced in
colors and Faker those are popular
libraries the author doesn't like big
corporations using his open source
software so he decided to protest in
this way and we have several examples of
that
so imagine you'll use library and the
outer ghost Rogue
to give you some numbers I took a quick
look on sonotypes block they publish
weekly
number of incidents they detected and it
appeared to me that there's almost 90
incidents per week in last month
so it's huge they stated I think
yesterday that they see in last three
years they see 700 percent increase in
attacks on open source software so
that's an issue we were going to stay in
a few next years is not going
um anywhere
uh that was libraries going back to
tools I remember just using my IDE which
was visual studio and you basically
needed just that to make software now
you have very complex CI CD pipelines
very many tools included into creating
of software and few examples
please notice that three of these
examples are package managers we decided
discussed packages now we go into
package managers
on aprils 4 code cough which is still
responsible for dealing with code
coverage you learned that they have an
incident with their tool which is called
Bachelor powder how they learned because
of one of the customers downloaded the
file this is a file and checked it
checked some and indeed it matched the
checksum published on Cloud golf website
basically this is the way you should use
tool this is from original docs you
basically call it and run it without any
kind of verification so please don't do
that
the file contains around 2000 lines of
code which is pretty big bar script that
was just line or one line added by an
attacker and basically what he does here
he grabs
um
environmental variables and sensing I
send those variables to his or her IP
address
and now you might think what the hell is
kotkov that was my fault back then but
to give an example uh a lot of as you
see from this this is one mem I have a
lot of companies is using are using that
amongst others there is rapid seven
who wrote incident response you might
know the Metasploit Creator and a bigger
cooperation I think is hashcorp which
created Vault terraform and several
other very known tools those two
companies among others were affected by
this similar funny
um incident
to comments from the combinator I think
they are very good
do not download think and execute that
immediately in every CA run just not
once but once like a day for example and
verify your own checksum if you publish
something and you publish checks and
make sure that you verify them yourself
another package manager Homebrew is a
for missing packager package manager for
Mac
they have an automated
pull request review
and researchers discovered that there
was a flaw in library they used to make
sure make the diff of files in a way
that he could uh
create a specific pull request to bypass
that and to be accepted which would
execute running and literary a code on
machines using Homebrew fortunately for
us and for humble users it was a
researcher not a an attacker
another incident in npm itself
uh a vulnerability was reported to them
that you could publish basically any
package existing in npm
probably complexity here as I discussed
it in the beginning I popped in you see
we have microservices and inconsistent
authorization and validation of data so
basically you could publish package
what's funny they state that since they
have Telemetry which is around two years
they didn't see exploit of exploitation
of this vulnerability but before that
they they don't know and the
vulnerability predates
uh the timeline they have logs
uh ruby gems had an interesting
um also issue with package
if you could guess the next
um version number of a package to be
published
you could craft invalid James spec and
publish your malicious code to S3
which will hold your package as the
package you are spoofing
and later of course the proper package
will overwrite
the your packaging S3 unless you make
the CDN cache before that so interesting
uh chain of vulnerabilities
to put a spoofed package via uh ruby
gems
an infrastructure back then I when I was
developer I remember we had just we
switched uh release mode in visual
studio and we set our app to some
Network
disk we copied the binaries basically
now you have a lot of tools in cicd
servers and infrastructure
just one example from PHP
from last year
they learned that they have two
malicious comments done
probably via compromise of their git
service
those are two comments and two just two
quick things I want to point out
here we have a sleep C class because PHP
is in C and the latest compression and
from the heaven from we are now dealing
with HTTP here so that's a first thing
uh you want to pay attention to and then
what's happened here they
check a user agent they created a
variable they check user agent if the
user agent starts with xerodium they
will basically execute any code back
then the string as a PHP so this is like
a very
easy to spot a backdoor
this is the owner of zerogam zero to
miss company who buys and sells zero
days and he says it's trolling of course
and somehow I agree with that but what's
most interesting in this incident is how
it was done
so PHP after analysis the team behind
PHP learned that you could push comments
not only via SSH but also via https and
it used a different library and
different user database
and yes they found logs and yes those
Comics were made via this mechanism so
https
what they analyzed they say that there
were too few guesses because in this log
you might see there's like 401 so
probably bad password or something
but the guesses were too few to be this
uh as a successful uh Brute Force attack
so probably someone compromised a
massive PHP Network the user base and
passwords were stored
and that's uh
of course all of this is quote quotes
from their statement but this is the
best one this uh system was running very
old cold very old OS very old PHP
version so something
had to go wrong in this case so this is
yeah a few Lessons Learned to learn
about
um infrastructure and security from PHP
uh skipping to summary in case of
libraries most important thing is to be
aware of the
attacks are in it I hope I made you
aware of these types of attacks make no
typos yeah that's funny everyone makes
typos but yeah use tools either open
source or commercial to detect malicious
dependencies
of course download it only from official
sources when you're not sure of anything
about the library do not install that
and enable2fa if you maintain any open
source or not project enabled to the
file the one story about UFA both npm
and Pipi decided to enforce 25 for
critical projects npm said 100
might be classified 4000 projects as
critical
and
yeah I don't have any data about the npm
if it worked and in case of pipe those
are stats they published and in case of
adoption
uh I think they are reaching basing on
those
uh
screens they are reaching their
assumption but there is always someone
who disagrees and this is this is a
story of atomic rights that's a library
in pipei which is quite popular if you
see the last month download
got such email and he was saying that hi
your project was made as critical and
you we would want to give you a free key
to make you you more secure account more
secure by an album to effect and he said
no
I better delete the library instead and
he deleted that
because he was like
he disagrees with with 2fa and he broke
a bit of Ip libraries because uh some of
them related to those he deleted and
pipey uh in the end Reign stated those
libraries and he uh archived and stopped
uh
dealing with with this Atomic rights
Library this is the quote from him so I
I'm not going to worry about your supply
engine for free basically
so enable to file explain it that is
important and enable to effect in case
of tools
repeat please repeat after me I will not
download and execute anything from the
internet without checking that yeah I
will verify check some or signature or
whatever it means I have to make sure
that this is the one tool and that's it
that's the one thing I wanted
install again from official sources and
update what you already have installed
that's it in case of tools
and in case of your infrastructure your
developer infrastructure be careful you
have to at each point in time you have
to know what you have especially if it's
publicly available in the cloud you have
to have good asset inventory
learn from PHP and disable what you
don't use
uh secure everything else
remember to update it frequently
to fix issues which are known
and of course monitor at the end monitor
everything and especially your developer
infrastructure to make sure that you
know what's going on inside your
uh infrastructure if it's your
developers or someone else actually
putting out your source code
and that's it apologies for the
technical problems if you have any
questions feel free to reach me out
[Applause]
[Music]