A new approach to prevent supply chain attacks
Exploring a protection solution to avoid Supply Chain Attacks
Understanding the mechanics of a Supply Chain Attack
A supply chain attack is a sophisticated cyber threat that exploits vulnerabilities in the interconnected network of suppliers, manufacturers, distributors, and vendors involved in the production and distribution of software or hardware. Instead of directly targeting the end user, attackers focus on infiltrating and compromising a trusted element within the supply chain, aiming to inject malicious code, tampering with software components, or manipulating the distribution process.
The mechanics of a supply chain attack typically involve several key stages:
Initial Compromise: Attackers gain access to a trusted entity within the supply chain, often through phishing, malware injection, or exploiting vulnerabilities.
Manipulation of Software Components: Malicious actors tamper with or insert malicious code into software components during the development, build, or distribution phases.
Distribution of Compromised Software: The compromised software, appearing legitimate, is distributed through regular supply chain channels. This could involve infiltrating software repositories, compromising update mechanisms, or manipulating the distribution process.
Unsuspecting Installation: End users unknowingly install the compromised software, believing it to be from a reputable source. The compromised software may include backdoors, spyware, or other malicious payloads.
Activation of Malicious Payloads: The malicious code is triggered under specific conditions, allowing attackers to gain unauthorized access, execute harmful actions, or establish a foothold within the target system.
Exfiltration of Data or Control: Once activated, the attackers may exfiltrate sensitive data, gain control over systems, or use the compromised software as a launching pad for further attacks.
Supply chain attacks are challenging to detect and mitigate because they exploit trust in the software supply chain. As a result, organizations must implement robust security measures at various stages of the software development and distribution lifecycle to safeguard against these sophisticated threats. Measures may include code integrity checks, secure build processes, supply chain visibility, and continuous monitoring for unusual or malicious activities.
Learnings from Previous Incidents
Reflecting on previous incidents, we observe a recurring pattern in supply chain attacks. The Ledger library was compromised in one instance, incorporating a malicious code version. The attacker successfully published a deceptive version (connect-kit@1.1.7) on npm. Further details are available in the post:
https://twitter.com/Verichains/status/1735311871786258656
Another case involves the Copay wallet, where a vulnerability emerged in a third-party Node.js module, specifically an "event stream" utilized in versions 5.0.2 through 5.1.0 of BitPay’s Copay and BitPay apps. According to a GitHub issue report, this module was manipulated to load malware capable of pilfering users’ private keys. Further information can be found at https://cointelegraph.com/news/bitpays-copay-wallet-compromised-by-malicious-code-firm-issues-advice-for-users.
A common thread in these attacks is the exploitation of not the code itself but vulnerable libraries loaded during the development process. Developers often incorporate third-party elements into their code without thorough verification, relying on trust rather than a rigorous validation process. This underscores the critical need for enhanced scrutiny and verification practices in the software development lifecycle to mitigate the risk of compromising the entire supply chain.
Exploring A Protection Solution to Avoid Supply Chain Attacks
Introducing a proactive solution to fortify your software against potential supply chain attacks: Lavamoat, a project initiated by Metamask and funded by ConsenSys.
Lavamoat provides a comprehensive defense mechanism throughout various phases of the development process, including installation, build, and runtime. By leveraging Lavamoat's robust security features, developers can significantly enhance the integrity of their software and protect it from potential compromise.
Explore Lavamoat on GitHub: https://github.com/LavaMoat/LavaMoat/tree/main
Key Features of Lavamoat:
Secure Installation:
Lavamoat enhances the security of your software right from the installation phase, ensuring that the initial setup is free from tampering or compromise.
Build Phase Protection:
During the build process, Lavamoat guards against the introduction of malicious code or manipulation of software components, providing a secure foundation for the final product.
Runtime Security
Lavamoat continues to protect your software during runtime, actively monitoring and preventing the activation of any malicious payloads that may have been inserted during development or distribution.
How Lavamoat Works:
Lavamoat achieves its security objectives through a combination of code integrity checks, dependency verification, and runtime monitoring. It establishes a robust perimeter of defense around your software, ensuring that only trusted components are integrated at each stage of development.
By adopting Lavamoat into your development workflow, you empower your software with a proactive defense against supply chain attacks, mitigating the risks associated with compromised libraries and dependencies.
Stay one step ahead of potential threats by integrating Lavamoat into your development process today. Visit the GitHub repository to learn more and get started.
Protect in an installation step
Understanding npm Lifecycle Scripts:
The installation of packages using npm introduces a potential security vulnerability due to the execution of bash scripts before and after the completion of the installation process. This feature allows attackers to run malicious scripts, compromising a developer's machine. To counteract this threat, Lavamoat intervenes at the installation step, particularly during the npm lifecycle, where it focuses on npm lifecycle scripts.
Lifecycle Scripts Overview:
npm defines a set of predefined script names executed automatically at specific stages during a package's lifecycle.
These scripts, listed in the package.json file of a Node.js project, perform tasks like installing dependencies, running tests, building the project, and deploying the application.
Examples include prepublish, prepare, preinstall, postinstall, preuninstall, postuninstall, preversion, and postversion.
The prefixes "pre-" and "post-" indicate whether the script runs before or after the associated npm command.
Lavamoat's Intervention:
In the installation phase, Lavamoat introduces a crucial configuration known as allow-script. This configuration serves to disable all dependency scripts in the npm lifecycle, mitigating the risk of malicious script execution.
Disabling Dependency Scripts:
Lavamoat's
allow-scriptconfiguration acts as a safeguard, preventing the automatic execution of potentially harmful scripts during the npm lifecycle.
Policy File Generation:
Lavamoat generates a policy file during this phase, outlining specific rules and permissions related to script execution.
Developer Control:
Lavamoat empowers developers by allowing them to make informed decisions about each dependency's script execution. Developers can selectively permit or deny specific scripts based on their trustworthiness.
Quick application
An example policy
An example list of results of packages after applying the policy:
Customize of node to protect at the build step
Understanding Lavamoat-Node:
As part of Lavamoat's comprehensive defense strategy, the project introduces lavamoat-node—a customized NodeJS runtime specifically designed to enhance security at the build step. Node.js, being a standard runtime for JavaScript, forms a critical component in the software development lifecycle. Lavamoat-Node builds upon this foundation to reduce the risk of malicious code in the application dependency graph, focusing on preventing software supply chain attacks.
Key Features of Lavamoat-Node:
SES Compartments for Isolation:
Lavamoat-Node leverages Secure ECMAScript (SES) Compartments to isolate the execution environment for each module.
This isolation is crucial in preventing tampering with the execution environment, providing a secure foundation for the build process.
Lockdown Mechanism:
Utilizes SES's
lockdown()to prevent tampering and guard against prototype pollution, addressing potential vulnerabilities in the build environment.
Package Isolation:
Ensures that packages executed within Lavamoat-Node do not share references to external entities unless explicitly allowed by policy or passed in during the build process.
Custom
requireImplementation:Lavamoat-Node provides a custom
requireand linking implementation specifically designed for loading only the dependencies that adhere to the defined security policy.
Policy Enforcement:
Enforces the app-specified LavaMoat policy, allowing or disallowing the exposure of global, built-in APIs to packages during the build step.
Developers have granular control over which packages can access certain functionalities, enhancing security customization.
When integrating Lavamoat-Node into the build process, developers benefit from a secure and isolated runtime environment. The customized require implementation and SES Compartments work in tandem to enforce security policies, mitigating the risk of malicious code infiltration during the build step. By adhering to the principles of least privilege and explicit permission, Lavamoat-Node empowers developers to build applications with enhanced resilience against potential supply chain attacks.
Quick application
An example policy
A runtime step is protected by a plugin of browserify and visualization of npm dependencies
Certainly! I look forward to continuing the discussion on protecting the runtime step in the next post. If you have any specific points or details you'd like to emphasize in that post, feel free to share them, and I'll ensure to incorporate them into the upcoming content.
Conclusion
In the quest for resilient software security, proactive measures become paramount. Lavamoat addresses the vulnerability in the installation phase by disabling potentially malicious scripts. Lavamoat-Node takes the reins during the build step, enforcing isolation and strict policies on dependencies.
Stay tuned for our next post, where we'll explore tools safeguarding the runtime step. By adopting these security measures, developers fortify their software against supply chain threats, contributing to a more secure software ecosystem.