CAPEC-693: StarJacking
Description
An adversary spoofs software popularity metadata to deceive users into believing that a maliciously provided package is widely used and originates from a trusted source.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- Identification of a popular open-source package whose popularity metadata is to be used for the malicious package.
Skills required
- LowAbility to provide a package to a package manager and associate a popular package's source code repository URL.
Consequences
- Integrity
Modify Data
- Accountability
Hide Activities
- Access ControlAuthorization
Execute Unauthorized Commands; Alter Execution Logic; Gain Privileges
Mitigations
- Before downloading open-source packages, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leveraged.
- Look for conflicting or non-unique repository references to determine if multiple packages share the same repository reference.
- Reference vulnerability databases to determine if the software contains known vulnerabilities.
- Only download open-source packages from reputable package managers.
- After downloading open-source packages, ensure integrity values have not changed.
- Before executing or incorporating the package, leverage automated testing techniques (e.g., static and dynamic analysis) to determine if the software behaves maliciously.