Microsoft sounds the alarm over new 'dependency confusion' attack technique

Developers
(Image credit: Shutterstock)
Audio player loading…

Microsoft has released a whitepaper outlining a new cyberattack (opens in new tab) method that the firm is calling, "dependency confusion" or a "substitution attack." The approach looks to take advantage of the open ecosystem that many businesses use as part of their app development (opens in new tab) process, mixing public and private feeds within the same development supply chain.

When apps are being constructed, developers often use a mixture of code stored in private libraries as well as dependencies from public portals. 

However, if an attacker were to learn the names of the private libraries used by corporate apps, they could register the same name on public package repositories and fill it with malicious code. Microsoft has dubbed this threat, a “substitution attack”.

“One common hybrid configuration that clients use is storing internal packages on a private feed but allowing the retrieval of dependencies from a public feed,” the Microsoft whitepaper explains (opens in new tab). “This ensures that the latest package releases are automatically adopted when referenced from a package that does not need to be updated. Internal developers publish their packages to this private feed, and consumers check both private and public feeds for the best available versions of the required packages. This configuration presents a supply chain risk: the substitution attack.”

Supply chain risk

Given that business apps (opens in new tab) have become increasingly important, being used for network monitoring (opens in new tab), lead generation (opens in new tab), employee experience (opens in new tab), and many more corporate needs, any threat to the app development supply chain could potentially have huge implications.

In order to test this attack method, independent security researchers (opens in new tab) registered code to public libraries using private package names accidentally leaked by tech firms. They found that they could upload new code to apps built by 35 major tech firms, including Shopify, Netflix, PayPal, and Microsoft itself.

Fortunately, there are several mitigation strategies that organizations can employ to reduce the likelihood of being targeted by these dependency confusion attacks. Microsoft advises that companies only reference one private feed in their app development, protect their packages using controlled scopes, and utilize client-side verification features.

Via ZDNet (opens in new tab)

Barclay has been writing about technology for a decade, starting out as a freelancer with ITProPortal covering everything from London’s start-up scene to comparisons of the best cloud storage services.  After that, he spent some time as the managing editor of an online outlet focusing on cloud computing, furthering his interest in virtualization, Big Data, and the Internet of Things.