Checkmarx's security research team writes about malicious packages on PyPI and npm, supply chain attacks, and application security.
HN links it for supply chain attack reports and job posts; commenters raise dependency risks as a major threat while mentioning Checkmarx's scanning tools.
In agreement with frodd above.
Dependencies and supply chain attacks are probably the greatest risk to a lot of software orgs, as they run them across all their environments: Development (with secrets and other valuable artefacts on developer VMs), CI/CD pipelines which may have access tokens to production (and other) environments, and production itself.
Notably even security companies are being impacted by this[0]. The scale of these attacks has amplified quite significantly the past three years, but are not solely exclusive to the javascript ecosystem [1] or even just namesquatting/typosquatting [2].
The resolution is broader security awareness, "onion layered" security controls and implementing simple non-burden inducing processes and policies. Sometimes not updating (what was wrong with the previous version of a dependency if there was no immediate vulnerability or production issue caused by it?) or having a two week cool down for updates (which some supply chain tooling natively supports) can appease some security functions through clear communication of the supply chain risk etc.
If anyone has interest in courses aligned to your org on improving developer and broader engineering management awareness on this, e-mails in my profile :).
[0] - https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages
[1] - https://orca.security/resources/blog/hades-pypi-supply-chain-attack/
[2] -…
The Side Channel Attack?
JavaScript Zero: real JavaScript, and zero side-channel attacks
https://blog.acolyer.org/2018/03/13/javascript-zero-real-javascript-and-zero-side-channel-attacks/
Side-Channel Attacks on Everyday Applications
https://github.com/defuse/flush-reload-attacks
The DrK (De-randomizing Kernel ASLR) attack
https://github.com/sslab-gatech/DrK
Cache Template Attacks
https://github.com/IAIK/cache_template_attacks
Using Node.js Event Loop for Timing Attacks
https://snyk.io/blog/node-js-timing-attack-ccc-ctf/
Cross Frame Scripting
https://www.owasp.org/index.php/Cross_Frame_Scripting
Cross Frame Scripting (XFS) Cheat Sheet, Attack Examples & Protection
https://www.checkmarx.com/knowledge/knowledgebase/XFS
Testing for CSS Injection (OTG-CLIENT-005)
https://www.owasp.org/index.php/Testing_for_CSS_Injection_(OTG-CLIENT-005)
Stealing CSRF tokens with CSS injection (without iFrames)
https://github.com/dxa4481/cssInjection
Stealing Data With CSS: Attack and Defense
https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense
Reading Data via CSS Injection
https://curesec.com/blog/article/blog/Reading-Data-via-CSS-Injection-180.html
Checkmarx | Solution Architect / Professional Services | Remote (North America, EMEA, APAC) | Full-time
Checkmarx builds application security testing tools. Our professional services team helps customers implement them.
We're a globally distributed remote team with backgrounds across application development, DevOps, SRE, and AppSec. We come from many industries - but the one thing we have in common is we're passionate about security and helping others build secure software.
We have a great team, great perks, great accolades, and lots of open positions!
https://checkmarx.com/job-openings/position/19.527/ (North America)
https://checkmarx.com/job-openings/#EMEA|all_locations|global_services (EMEA)
https://checkmarx.com/job-openings/#APAC|all_locations|global_services (APAC)
Plenty of examples of NPM packages being taken over:
* https://www.whitesourcesoftware.com/resources/blog/npm-package-javascript-library-compromised-via-account-takeover/
* https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
* https://blog.sonatype.com/npm-project-used-by-millions-hijacked-in-supply-chain-attack
* https://checkmarx.com/blog/attackers-write-bugs-as-well/
When was the last time you audited all of the libraries a SPA depended on? If it was during the last build, congrats, you're doing great.
Lots of times it isn't automated and can be neglected, though.
Kinda relevant, as I saw few comments about how safer languages are the solution.
Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1].
[0] - https://github.com/c-skills/rust1
[1] - https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure/
This reminds me of a presentation on regular expression DoS attacks:
http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWASP_IL_2009_ReDoS.pdf [pdf]
Quick view: https://docs.google.com/gview?url=http%3A%2F%2Fwww.checkmarx.com%2FUpload%2FDocuments%2FPDF%2FCheckmarx_OWASP_IL_2009_ReDoS.pdf
P. S. Corrected wording.