Packagecloud can help protect you from attacks on software package mirrors

Apr 03, 2023 · 5 min read

security

Software mirrors are often used by popular open-source projects and package managers such as Debian, Ubuntu, Python Package Index (PyPI), and Node Package Manager (NPM), among others.

Normally Linux distributions have several servers from which users can download packages and package metadata. The content of the main repositories is usually copied by many other repositories known as mirrors.

Attacks on package mirrors are attacks that targeted the package managers to get to end-users. For example, an attacker can fake being a legitimate mirror and respond to a client's request with malicious content, thus installing software that hosts backdoor, malware, trojan, etc without the consent of the user.

Attacks on software package mirrors can be detrimental to the security and integrity of the software being distributed.

Common attacks on software package mirrors

Man-in-the-middle (MITM) attacks: In this type of attack, an attacker intercepts the communication between the user and the mirror server. The attacker can then modify or replace the software package being downloaded, potentially injecting malicious code into the software before it is installed on the user's system.
Mirror compromise: An attacker could gain unauthorized access to a mirror server and modify the software packages hosted on it, injecting malicious code or malware into the packages. Users downloading and installing these packages could then unknowingly introduce security risks to their systems.
Typosquatting: Attackers can create malicious package mirrors with similar domain names or package names to the legitimate ones, tricking users into downloading and installing malicious software. This type of attack relies on users mistyping the package name or not verifying the authenticity of the source.
Replay attacks: An attacker could intercept an old version of a software package with known vulnerabilities and serve it to users, leading to the installation of vulnerable software. This can happen when the software package mirror doesn't enforce the use of secure and up-to-date communication protocols.
Denial of service (DoS) attacks: Attackers can flood a software package mirror with traffic, making it unavailable to users attempting to download software packages. This can lead to delays in software deployment and updates, potentially leaving users with outdated and vulnerable software. Endless attack: it's a form of denial-of-service. In this scenario, the attacker responds to a client request with an endless stream of data that can crash the OS. This can be done by filling up the disk partitions or by exhausting the server memory.
Metadata manipulation: An attacker who can manipulate metadata can also lie to the clients regarding the dependencies that a package need to work properly. If the attacker knows how to exploit a vulnerability that is present in a package, he can exploit it by providing metadata that says every package depends on the vulnerable one. With this, the client will install the software that the attacker wants while installing the other software.

A popular threat is also the software supply chain attack where malicious actors penetrate a legitimate program, modify the source code, and conceal malware inside the build and update processes to automatically spread the malware downstream to a larger audience.

How Packagecloud can help

Packagecloud will scan and validate all of the packages in your repository for vulnerabilities. Packagecloud detects vulnerabilities, poisonings, and trojan-horse threats and verifies the integrity of the packages you use. Additionally, Packagecloud checks your packages guaranteeing that nothing included inside them is vulnerable.

Packagecloud can store all of your packages in one location, giving you complete control over the packages you use. Rather than relying on public repositories, you can maintain safety by always using packages from your controlled environment.

In most cases, the target packages were developed as legitimate by the original authors. The malicious actors made code modifications to include malicious code. It's important to use official repositories to avoid some risks and to also use security tools to scan the packages you are using.

(Image courtesy: Unsplash)