Malicious package to credential theft attack tree

malware_package_credential_theft_attack_tree.yaml

# Use this with Deciduous https://www.deciduous.app/#gist=ef8809a2b8047d57e64fd082780ecdd8

theme: classic
title: Malicious package to credential theft attack tree

facts:
- metadata_email: Package maintainer emails are listed in package metadata and github commits
  from:
  - target_research
- visual_similarity: Malicious domain mimics package repo's. Some maintainers will be tricked
  from:
  - pwd_mgr
- email_delay: People don't read their emails 24x7
  from:
  - confirm_email
- pkg_download: Software engineer downloads package
  from:
  - lockfile_issues
  - intended_upgrade
  - local_mirror_bypass
- lockfile_issues: Lock files don't work for all projects
  from:
  - lockfiles
- intended_upgrade: There are still intentional upgrades
  from:
  - lockfiles
- signatures_rare: Signed packages are a rarity
  from:
  - signature
- local_mirror_bypass: Not all projects use local mirror
  from:
  - auto_assess
- dev_endpoint: ...on developer endpoint
  from:
  - malware_exec
- in_ci: ...on a CI/CD system
  from:
  - malware_exec
- in_web: ... in a web front end
  from:
  - malware_exec

attacks:
- target_research: Find package owners' email addresses
  from:
  - reality
- cred_stuff: Try passwords from data breaches
  from:
  - metadata_email
- phish: Phish package owners with lookalike domain
  from:
  - metadata_email
  - MFA:
    backwards: true
  - unique_passwords:
    backwards: true
- new_token: Create new API token for package repo
  from:
  - visual_similarity
- change_email: Alter the package owner's email to prevent notifications
  from:
  - notify_new_token
- malware: Add malicious package update
  from:
  - email_delay
- sast_bypass: Obfuscate package to bypass static tests
  from:
  - auto_assess
- malware_exec: Malicious package execution
  from:
  - signatures_rare
- obfuscate: Obfuscate malware to prevent simple detection
  from:
  - endpoint_protection
- infostealer: Install infostealer
  from:
  - dev_endpoint
  - obfuscate:
    backwards: true
- env_secrets: Steal secrets from the environment variables
  from:
  - in_ci
- escape_ci: Escape the build environment to gain access to the host
  from:
  - in_ci
- obfuscate_exfil: send stolen data more discretely or abuse trusted hosts
  from:
  - block_exfil
- js_hooks: Hook into JS APIs to modify crypto transactions
  from:
  - in_web

mitigations:
- notify_new_token: Email the maintainer when new tokens are added
  from:
  - new_token: repo
- confirm_email: Confirm email address changes with maintainer's old email.
  from:
  - change_email: repo
- unique_passwords:
  from:
  - cred_stuff: maintainer
- MFA: Multi-factor auth
  from:
  - cred_stuff: maintainer & repo
- lockfiles: Pin package versions and check hashes with a lock file
  from:
  - malware: user
- signature: Check package signature
  from:
  - pkg_download: user
  - sast_bypass: user
- auto_assess: Tooling to automatically assess packages on first retrieval with local mirror
  from:
  - malware: IT
- block_direct: Block direct package repo access
  from:
  - local_mirror_bypass: IT
- pwd_mgr: Password managers can highlight that domains do not match.
  from:
  - phish: maintainer
- hardware_token: Use a hardware token with FIDO2
  from:
  - phish: maintainer and repo
- deny_lookalike: register domain names that are visually similar to prevent malicious use
  from:
  - visual_similarity: repo
- endpoint_protection: Endpoint protection quarantines known malicious files
  from:
  - infostealer: IT
- env_ntk: limit environment variables to only the CI steps that need them
  from:
  - env_secrets: user
- ci_maint: CI environment well maintained, up to date & follows best practices.
  from:
  - escape_ci: user
- block_exfil: Block & track connections to hosts known to be malicious
  from:
  - infostealer: IT
- ci_netpol: Network policies allow only connections to trusted hosts
  from:
  - env_secrets: user
- pkg_delay: Don't update to packages that are too new for malware to have been identified manually
  from:
  - sast_bypass: user/IT


goals:
- get_creds: Obtain credentials
  from:
  - obfuscate_exfil
  - env_secrets
- steal_cryptocurrency: Steal Cryptocurrency
  from:
  - js_hooks