Getty Images/iStockphoto

News

Top.gg supply chain attack highlights subtle risks

Threat actors used fake Python infrastructure and cookie stealing to poison multiple GitHub code repositories, putting another spotlight on supply chain risks.

By
Published: 26 Mar 2024

Threat actors compromised multiple GitHub accounts and made malicious commits to several GitHub code repositories, including that of a popular Discord server and bot discovery platform, highlighting the subtle but serious risks of software supply chain attacks.

Application security vendor Checkmarx published research Monday dedicated to a threat campaign it observed involving unidentified threat actors. According to Checkmarx researchers, attackers "distributed a malicious dependency hosted on a fake Python infrastructure, linking it to popular projects on GitHub and to legitimate Python packages."

The actors took over influential GitHub accounts and made malicious commits to popular GitHub organizations. One affected organization that Checkmarx highlighted was Top.gg, whose official Discord server maintains more than 170,000 members.

On March 3, Checkmarx said, users of the Top.gg Discord server notified user "editor-syntax," a contributor with write permissions to Top.gg's Git repositories, that malicious activity was originating from their GitHub account.

As it turned out, attackers had compromised the account and used the access to poison Top.gg's repository. "It became evident that the malware had compromised multiple individuals, highlighting the scale and impact of the attack," Checkmarx's blog post read.

Checkmarx said editor-syntax was likely compromised via the account's session cookies, allowing attackers to bypass authentication entirely. "This method of account takeover is particularly concerning, as it does not require the attacker to know the account's password," the blog post read.

This was one of multiple tactics, techniques and procedures the threat actors used during the campaign. In another instance, researchers said the actors copied popular software development tool Colorama, injected malicious code and hosted it on a fake Python package site using a typosquatted URL.

"The multi-stage and evasive malicious payload harvests passwords, credentials, and more dumps of valuable data from infected systems and exfiltrates them to the attacker's infrastructure," Checkmarx said.

Jossef Harush Kadouri, head of software supply chain security at Checkmarx and an author of the blog post, told TechTarget Editorial that researchers discovered the campaign through indicators of compromise discovered in a malicious package. Asked how many users of the 170,000-plus could have been compromised in Top.gg's repository poisoning, Kadouri said, "It's hard to tell." He said Checkmarx's blog post assertion that "over 170,000" users were affected "was an assumption based on the Discord community size."

In a statement shared with TechTarget Editorial, a GitHub spokesperson said the company was aware of the report and that GitHub itself did not experience a compromise as a result of the activity described in the research.

"GitHub hosts over 100M developers building across over 420M repositories, and is committed to providing a safe and secure platform for developers," the spokesperson said. "We have teams dedicated to detecting, analyzing, and removing content and accounts that violate our Acceptable Use Policies. We employ manual reviews and at-scale detections that use machine learning and constantly evolve and adapt to mitigate malicious usage of the platform. We also encourage customers and community members to report abuse and spam."

TechTarget Editorial reached out to Top.gg for additional comment, but did not receive a response at press time

Python TUFs up software delivery

Awareness in mainstream enterprise IT about software supply chain security risks arose in 2020 with a high-profile attack on SolarWinds and users of its popular IT monitoring software, which prompted the Biden administration to issue an executive order meant to shore up U.S. software supply chains. Since then, multiple efforts among open source projects, private sector vendors and the federal government have been developing new ways to thwart supply chain attacks.

One such mitigation that could have disrupted this campaign is The Update Framework (TUF), an open source project for securing software update systems. The Python programming language community and maintainers of its associated scripting framework, PHP, have been working to add TUF to official update delivery processes, said David Strauss, co-founder and CTO at WebOps service provider Pantheon and founder of TUF implementation project PHP-TUF.

"It's the exact sort of attack Python has been working to mitigate through integrating The Update Framework (TUF) to establish trust from package authoring and building all the way through projects using the packages," he said in an email.

TUF represents an improvement over previous methods of validation for software update delivery such as certificates, TLS or HTTPS, because it provides more specific, detailed validation of data, according to Strauss.

"[Other methods] are equivalent to being sent to a branch office's street address to handle some paperwork and then validating that you've reached the correct street address -- this prevents an attacker from occupying an adjacent street address and fooling you into walking in, but it doesn't prevent someone from misleading you about the correct street address to go to in the first place," he said.

"Systems like TUF put a wax seal -- kept at the company's headquarters, not the branch office -- onto the paperwork packet itself. ... This is harder to forge because only headquarters has the stamp, [and] the process for validating the stamp is the same regardless of what branch office you go to," Strauss said.

Dan Lorenc, creator of the Sigstore software supply chain security project and CEO of supply chain security startup Chainguard, felt similarly about TUF's potential.

"It's not clear to me why [the attackers] hosted this on their own package repository, but TUF would have flagged that someone was installing something that didn't come directly from the real PyPI [Python Package Index]," he said. "These [attackers] could have just published on the real PyPI, but they must have been worried something there would detect the malware -- lots of companies run bots against PyPI to look for stuff like this."

Sophisticated series of attacks reveals tricky risks

The attackers in this campaign also took the extra step of compromising the GitHub account of a trusted contributor to the Top.gg repo through cookie stealing, an aspect of the attack that's tricky to mitigate, said Kyler Middleton, senior principal software engineer at healthcare tech company Veradigm.

"At the point the session token/cookie is generated, you're past any multifactor authentication requirements, and you're not even prompted for a password," she said. "Platforms could potentially mitigate this by invalidating any cookies that are coming from different IPs, but that'd create a host of issues, and would perhaps only block a small segment of attackers. If they have sufficient control of a host's machine to steal the cookie, they likely are also able to proxy traffic through that machine to do other malicious activities."

This type of sophisticated attack highlights the unique challenges of securing software supply chains, Middleton said.

"The security of the software we rely on is ultimately beholden to the people and organizations that maintain it," she said. "Especially when we're talking about individuals or small startups -- they're always underfunded, overworked or volunteers."

The best bet for developers to guard against this kind of attack is to ensure they don't use the latest versions of software immediately as they're released, Middleton said.

"That gives smart security folks a chance to audit changes and hopefully catch the next time stuff like this happens," she said. "Give it time to percolate and let the leading edge [adopters] find the bugs and sharp edges."

Alexander Culafi is a senior information security news writer and podcast host for TechTarget Editorial.

Beth Pariseau, senior news writer for TechTarget Editorial, is an award-winning veteran of IT journalism covering DevOps. Have a tip? Email her or reach out @PariseauTT.

Dig Deeper on Application and platform security