Microsoft has released a whitepaper outlining a new cyberattack (opens in new tab) method that the firm is calling, "dependency confusion" or a "substitution attack." The approach looks to take advantage of the open ecosystem that many businesses use as part of their app development (opens in new tab) process, mixing public and private feeds within the same development supply chain.
When apps are being constructed, developers often use a mixture of code stored in private libraries as well as dependencies from public portals.
However, if an attacker were to learn the names of the private libraries used by corporate apps, they could register the same name on public package repositories and fill it with malicious code. Microsoft has dubbed this threat, a “substitution attack”.
- We've highlighted the best antivirus (opens in new tab) programs around
- We've put together a list of the best endpoint protection (opens in new tab) software
- Keep your devices virus-free with the best malware removal (opens in new tab) software
“One common hybrid configuration that clients use is storing internal packages on a private feed but allowing the retrieval of dependencies from a public feed,” the Microsoft whitepaper explains (opens in new tab). “This ensures that the latest package releases are automatically adopted when referenced from a package that does not need to be updated. Internal developers publish their packages to this private feed, and consumers check both private and public feeds for the best available versions of the required packages. This configuration presents a supply chain risk: the substitution attack.”
Supply chain risk
Given that business apps (opens in new tab) have become increasingly important, being used for network monitoring (opens in new tab), lead generation (opens in new tab), employee experience (opens in new tab), and many more corporate needs, any threat to the app development supply chain could potentially have huge implications.
In order to test this attack method, independent security researchers (opens in new tab) registered code to public libraries using private package names accidentally leaked by tech firms. They found that they could upload new code to apps built by 35 major tech firms, including Shopify, Netflix, PayPal, and Microsoft itself.
Fortunately, there are several mitigation strategies that organizations can employ to reduce the likelihood of being targeted by these dependency confusion attacks. Microsoft advises that companies only reference one private feed in their app development, protect their packages using controlled scopes, and utilize client-side verification features.
- Also, check out our roundup of the best ransomware protection (opens in new tab) tools
Via ZDNet (opens in new tab)
