Ekaterina Gainullina, Security Vision
Software Supply Chain is a complex structure that includes various stages, starting from software code development and ending with the delivery of finished products to end users. The importance of the Software Supply Chain is that it is the foundation of the digital economy.
Software plays an important role in modern life, whether in business, government organisations or in the day-to-day activities of individuals. Through software we access information, resources and services and it is a key enabler of technological advancement. The supply chain ensures that software products are reliable and available to end users, which is critical to business processes, innovation and technology development. However, the software supply chain has also been the target of increasing attention from attackers. Attacks on this chain can have serious consequences, including vulnerabilities in software products, component tampering, malware injection, and other types of cyberattacks. Therefore, the safety and security of the software supply chain has become a high-priority cybersecurity issue. Risk management and security in the supply chain are becoming critical, and developers, vendors and users must collaborate to ensure its reliable operation.
OSC&R is an open framework that provides a comprehensive, systematic and actionable way to understand attacker behaviour and techniques. It was created with participation from companies such as Check Point, Fortinet, GitLab, Google, Microsoft, and OWASP.
Like MITRE ATT&CK, OSC&R is organised in a clear and structured way of the tactics, techniques and procedures (TTPs) used by attackers. However, OSC&R is the first and only matrix that focuses specifically on software supply chain attacks. It covers a wide range of attack vectors, including vulnerabilities in third-party libraries and components, attacks on build and deployment systems, and compromised or malicious software updates. As an example of an attack with malicious packages where a killchain of a bouquet of tactics - Initial access, Execution, defence evasion, collection, impact - are lined up is described in one of the reports by Sonatype security researcher Ax Sharma, which reveals the malicious packages discovered in the PyPI registry, including aptx, which can install the Meterpreter trojan disguised as pip, and reveals research on new malicious packages discovered in the PyPI registry, including aptx, which can install the Meterpreter trojan disguised as pip, remove the netstat system utility and spoof the SSH authorised_keys file.
Named after a popular audio codec developed by Qualcomm and used in many Bluetooth devices (Hello various wireless devices for listening to music), aptx ended up not being the only new threat discovered on PyPI.
Other malicious packages include httops and tkint3rs. What they have in common is an interesting feature aimed at misleading people by using specially invented names. As Sharma notes, in reality, httops and tkint3rs are nothing more than deliberate misspellings of the https and, by extension, tkinter Python interfaces.
Upon closer inspection, Sonatype engineers discovered that aptx has a setup.py tab that is capable of creating an ELF binary named ./pip/pip. This binary contains a Meterpreter trojan generated using Metasploit, a penetration testing tool, and allows an attacker to gain shell access to an infected machine. To make it harder for a system administrator to keep track of active connections, setup.py also removes netstat, though it's actually a big trigger for security analysts if it's in the infrastructure.
In their January 2023 Malware Monthly report, namely Sonatype researchers reveal details of dozens of other malicious packages found in PyPI and hundreds of new malicious packages in the npm registry.
Some of these demonstrate new attack strategies, such as determining whether the host running the malware is a virtual machine or a sandbox environment. In such cases, the malware immediately exits the system to prevent detection by security researchers, who are likely to install the package in a virtual machine or sandbox.
Another new tactic used recently is ‘Mutant RATs (remote access trojan),’ which use a multi-stage polymorphic payload that changes each time the binary is run to avoid detection. In some cases, such RAT mutants have combined the capabilities of remote access trojans and information stealers to gain access to clipboard data or wallet information.
In the case of npm, Sonatype identified packages that, while not posing an immediate threat, should have been considered malicious. Specifically, more than 33,000 packages were published under the name ‘infinitebrahmanuniverse’ and using the prefix ‘nolb-’ with the only apparent purpose of creating a dependency on any other npm package. According to Sonatype, this takes the ‘dependency hell’ problem to a whole other level. Indeed, an attacker could create a malicious package that depends on some of these nolb- packages to perform a denial-of-service attack on a company's load channel and consume excess resources.
You also have to consider one of the biggest trends - cryptominers, i.e. Trojans that have no other purpose than to use your computing power to mine cryptocurrency and make money.
SLSA vs OSC&R
SLSA (Supply-chain levels for software artifacts) and OSC&R (Open Source Cybersecurity Readiness) are two different approaches, but they can be interrelated and used together to secure the software supply chain.
SLSA is a framework for classifying different types of software artefacts in the supply chain based on their level of integrity. Integrity in the context of SLSA refers to the assurance that a software artefact has not been altered or modified in an illegal manner and is in its original and intended state. This approach helps to determine how much trust can be placed in software components in the supply chain.
OSC&R is a framework that provides a comprehensive and systematic way to understand attackers' methods and techniques to compromise the software supply chain. OSC&R helps to analyse and understand attacker behaviour, assess attack targets and the current phase of the attack.
While SLSA focuses on assessing the integrity of software artifacts, OSC&R provides tools to analyse attack methods and attacker behaviour. Their combined use can provide a more complete understanding and security of the software supply chain. OSC&R can help identify threats and SLSA can help assess how secure the software components used in the supply chain are.
The main features and benefits of OSC&R are:
1. Coverage of a wide range of attack vectors: OSC&R covers multiple attack vectors, including vulnerabilities in third-party libraries, attacks on build and deployment systems, and compromised or malicious software updates.
2. Vulnerabilities in third-party libraries: OSC&R provides insight and assistance in identifying vulnerabilities in commonly used third-party libraries that are often targeted by attacks.
3. build and deployment supply chain attacks: The framework helps organisations understand and mitigate the risks associated with compromised build and deployment systems, ensuring the integrity of the software supply chain.
4. Compromised or malicious software updates: OSC&R detects and prevents attacks originating from software updates, ensuring supply chain security.
5. Actionable threat insights: OSC&R provides valuable and objective insights into the target of an attack and its current phase. It categorises attacks by severity, impact and likelihood of occurrence. This information simplifies security communication between organisations, provides complete visibility of coverage and enables security teams to effectively prioritise their response.
6. Assessment and prioritisation: The framework enables security teams to assess the effectiveness of existing protection and control measures. It helps identify potential impacts to the organisation, prioritise remediation measures and ensures that security strategies are aligned with the identified threat level. By understanding the tactics, techniques and procedures used by attackers, organisations can take actions that provide the highest level of risk mitigation.
7. Facilitate Incident Response and Forensics: In the event of incidents or breaches, the Pipeline List of Materials (PBOM) serves as a valuable resource for incident response and forensic investigations. By having a comprehensive view of the software supply chain and related components, organisations can quickly identify the source of an attack, trace its impact and take appropriate action.
8. Fostering continuous improvement: PBOM promotes a culture of continuous improvement. By regularly analysing and updating the Pipeline Material List, PBOM sets a new standard for software supply chain security, providing developers with greater visibility into software supply chain attacks.
To summarise: the main benefit of using the SLSA framework is the ability to:automate software builds and validate all components included in the build. Thus, you can be sure that the software you deliver to your customers contains only those components that you selected and used during the development and testing process. You can also be sure that only you control the dependencies that make up the application and that the binaries have not been modified in any way (maliciously or otherwise).
When a vulnerability is discovered in a component, it is much easier to update the dependencies and create a new build of the application because the build process is automated. For example, you can search the documents created during the build and find out where log4j or some other interesting tabs like codecs are applied and what versions of it are used. Then you can update the dependency versions in the affected applications and run the build again. This way, problems can be fixed within a few minutes of the first notification.
If you use the more advanced versions of the SLSA framework, they add additional safeguards and control points to provide more centralised oversight and reproducibility. This means that previous releases can be updated and rebuilt if a client is unable to upgrade/upgrade to the latest release for any reason.
What is PBOM?
PBOM (Pipeline Bill of Materials) is an approach that covers the entire software development cycle from design to production. It goes beyond the list of components provided by the SBOM (Software Bill of Materials) and assesses the stages at which attacks can occur. This comprehensive approach helps organisations identify potential vulnerabilities and proactively prevent attacks throughout the software development process.
While SBOM has made significant strides in understanding the composition of software artefacts, it has limitations in detecting vulnerabilities and mitigating attacks throughout the software supply chain. This is where PBOM comes into play, extending the SBOM concept and providing advanced security tools. PBOM exposes the entire software supply chain process from design to production. It explores the stages at which attacks can occur.
The advantages of PBOM over SBOM are:
1. Improved defence against attacks: PBOM provides a broader view of potential attack vectors by looking at the entire software development process, including the design, development, testing and deployment phases. This allows organisations to identify vulnerabilities at each stage and implement robust security measures to more effectively prevent attacks.
2. Proactive Risk Management: Analysing the entire supply chain through PBOM allows security teams to identify potential vulnerabilities early in the development process and implement appropriate security measures. This proactive approach reduces the risk of introducing vulnerabilities into the software supply chain.
3. Integration with security processes: PBOM can easily integrate with existing security processes such as threat modelling, vulnerability management and incident response. By incorporating PBOM into these processes, organisations improve their ability to detect and respond to supply chain attacks, ensuring a robust security strategy.
Examples of PBOM use cases:
1. Identifying third-party library vulnerabilities: PBOM can help organisations identify vulnerabilities in third-party libraries used in the software supply chain. By analysing the entire chain, organisations can evaluate the security practices of library vendors and make informed decisions regarding their use.
2. Identify compromised build and deployment systems: A material Pipeline List enables organisations to identify and prevent attacks on build and deployment systems. By analysing the entire chain, organisations can identify anomalies, unauthorised access attempts or suspicious behaviour that may indicate compromise.
3. Securing software updates: PBOM provides visibility into the software update process, allowing organisations to verify the integrity of updates and identify potential risks. By verifying each step of the update process, organisations can prevent the propagation of compromised or malicious updates.
The software industry's prolonged use of SBOM has caused the majority of software supply chain attacks to take a back seat. PBOM now offers a new standard for software supply chain security. It provides DevOps teams with complete visibility into software supply chain attacks. This includes source code, pipeline, artefacts, container images, runtime assets and applications. In addition, there is continuous monitoring of security changes in the environment. This ensures that the software supply chain does not deviate from its original secure state. Moreover, PBOM provides clear and actionable remediation strategies. These include a prioritised list of risks and recommendations based on the company's context and business objectives. In a development ecosystem that requires both speed and security, PBOM minimises the attack surface without hindering developer flexibility. This prevents attacks on the software supply chain without slowing down development.
