Microsoft has released a whitepaper outlining a new cyberattack method that the firm is calling, "dependency confusion" or a "substitution attack." The approach looks to take advantage of the open ecosystem that many businesses use as part of their app development process, mixing public and private feeds within the same development supply chain.
When apps are being constructed, developers often use a mixture of code stored in private libraries as well as dependencies from public portals.
However, if an attacker were to learn the names of the private libraries used by corporate apps, they could register the same name on public package repositories and fill it with malicious code. Microsoft has dubbed this threat, a “substitution attack”.
- We've highlighted the best antivirus programs around
- We've put together a list of the best endpoint protection software
- Keep your devices virus-free with the best malware removal software
“One common hybrid configuration that clients use is storing internal packages on a private feed but allowing the retrieval of dependencies from a public feed,” the Microsoft whitepaper explains. “This ensures that the latest package releases are automatically adopted when referenced from a package that does not need to be updated. Internal developers publish their packages to this private feed, and consumers check both private and public feeds for the best available versions of the required packages. This configuration presents a supply chain risk: the substitution attack.”
Supply chain risk
Given that business apps have become increasingly important, being used for network monitoring, lead generation, employee experience, and many more corporate needs, any threat to the app development supply chain could potentially have huge implications.
In order to test this attack method, independent security researchers registered code to public libraries using private package names accidentally leaked by tech firms. They found that they could upload new code to apps built by 35 major tech firms, including Shopify, Netflix, PayPal, and Microsoft itself.
Fortunately, there are several mitigation strategies that organizations can employ to reduce the likelihood of being targeted by these dependency confusion attacks. Microsoft advises that companies only reference one private feed in their app development, protect their packages using controlled scopes, and utilize client-side verification features.
- Also, check out our roundup of the best ransomware protection tools
Via ZDNet
