A new software supply chain attack is being exploited in the wild, according to security researchers.
The technique targets Python applications distributed via the Python Package Index, or PyPI.
Researchers at software supply chain security firm JFrog believe that the attack, dubbed “Revival Hijack,” could affect 22,000 existing Python packages. That, in turn, could lead to tens of millions of infected downloads.
Revival Hijack exploits a potential security gap created when authors delete projects from the PyPI repository.
Once a developer removes the package from PyPI, the package name becomes available for any other user to register. Hackers can then hijack the package name and use it to distribute malicious code.
“Once Safe” Supply Chain Attack Risk
Revival Hijack makes use of the fact that victims can unwittingly update a “once safe” package, without knowing that it has been altered or infected. In addition, CI/CD machines are often set up to install package updates automatically.
JFrog researchers Brian Moussalli and Andrey Polkovnichenko warn that this poses a far greater risk than previous software supply chain attacks which relied on typosquatting, and therefore human error, to distribute malicious code.
The research team reproduced the attack, using an imposter package with the same name but a different version number and entirely different code. In further tests, they found that “safely hijacked” packages had been downloaded 200,000 times in three months.
“The Revival Hijack is not just a theoretical attack – our research team has already seen it exploited in the wild,” explained Brian Moussalli, Research Team Leader at JFrog.
“Using a vulnerable behavior in the handling of removed packages allowed attackers to hijack existing packages, making it possible to install it to the target systems without user interaction.”
Infected Code Warning For Developers
According to the JFrog researchers, cybersecurity teams have reduced the risks from typosquatting. This forces malicious hackers to look at other ways to put infected code into repositories, such as Revival Hijack.
Read more about typosquatting on PyPI: New Typosquatting and Repojacking Tactics Uncovered on PyPI
Although PyPI does warn developers who delete packages that its name can be reused, and restricts replacing specific versions of a package, the JFrog researchers have called for “a stricter policy which completely disallows a package name from being reused.”
Developers using code repositories also need to be vigilant, Michael Clark, Director of Threat Research at Sysdig, a cloud security specialist, told Infosecurity.
“Repositories, such as PyPI, offer a tough challenge when it comes to security because they are often implicitly trusted by developers,” he said.
“As long as the name is correct, the feeling of danger is low. The Revival Hijack attack demonstrates this issue as the name of the malicious repository will match the previously trusted name. Static and runtime analysis of dependencies from these repositories is a must in order to prevent attacks using this vector.”