Inline package name based supply chain attack detection and prevention
Inline package name based supply chain attack detection and prevention is disclosed. An indication that a client device has made a request to a remote server for a package is received. A data appliance then performs an action responsive to the received indication. In an example implementation, the data appliance makes a determination of whether the request for the package is associated with a nonexisting package.
1. A system, comprising:
a processor configured to:
receive an indication that a client device has made a request to a remote server for accessing a package, wherein the remote server makes a plurality of packages publicly available for download, and wherein the requested package is included as a dependency of a software build;
determine that the requested package is a nonexisting package that is not available at the remote server;
responsive to the determination, perform analysis of whether a name of the nonexisting package is related to a name of another package; and
perform, by a data appliance, a responsive action based on a result of the analysis, wherein the performing of the responsive action comprises to:
add a Uniform Resource Locator (URL) associated with the package to a block list, wherein the URL is distributed to another data appliance for blocking by the another data appliance;
increase a count of a number of times the package has been requested; and
in response to the count exceeding a threshold, block access to the package; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the nonexisting package is present at a local repository.
3. The system of claim 1 , wherein the name of the nonexisting package is within a predetermined edit distance of the name of the other package.
4. The system of claim 1 , wherein the name of the nonexisting package shares a commonality with the name of the other package.
5. The system of claim 1 , wherein the indication is received in response to matching a regular expression against a URL included in the request.
6. The system of claim 1 , wherein the indication is received during an inline observation of network traffic.
7. The system of claim 1 , wherein the indication is received from an agent installed at the client device.
8. The system of claim 1 , wherein performing the responsive action comprises blocking a download from the remote server.
9. The system of claim 1 , wherein performing the responsive action comprises preventing the request from being delivered to the remote server.
10. The system of claim 1 , wherein the processor is further configured to receive an alert in response to a determination that the nonexisting package has subsequently been made available by the remote server.
11. The system of claim 10 , wherein the alert is provided by an external security system.
12. The system of claim 10 , wherein the alert is generated by the data appliance.
13. A method, comprising:
receiving an indication that a client device has made a request to a remote server for accessing a package, wherein the remote server makes a plurality of packages publicly available for download, and wherein the requested package is included as a dependency of a software build;
determining that the requested package is a nonexisting package that is not available at the remote server;
responsive to the determination, performing analysis of whether a name of the nonexisting package is related to a name of another package; and
performing, by a data appliance, a responsive action based on a result of the analysis, wherein the performing of the responsive action comprises:
adding a Uniform Resource Locator (URL) associated with the package to a block list, wherein the URL is distributed to another data appliance for blocking by the another data appliance;
increasing a count of a number of times the package has been requested; and
in response to the count exceeding a threshold, blocking access to the package.
14. The method of claim 13 , wherein the nonexisting package is present at a local repository.
15. The method of claim 13 , wherein the name of the nonexisting package is within a predetermined edit distance of the name of the other package.
16. The method of claim 13 , wherein the name of the nonexisting package shares a commonality with the name of the other package.
17. The method of claim 13 , wherein the indication is received in response to matching a regular expression against a URL included in the request.
18. The method of claim 13 , wherein the indication is received during an inline observation of network traffic.
19. The method of claim 13 , wherein the indication is received from an agent installed at the client device.
20. The method of claim 13 , wherein performing the responsive action comprises blocking a download from the remote server.
21. The method of claim 13 , wherein performing the responsive action comprises preventing the request from being delivered to the remote server.
22. The method of claim 13 , further comprising receiving an alert in response to a determination that the nonexisting package has subsequently been made available by the remote server.
23. The method of claim 22 , wherein the alert is provided by an external security system.
24. The system of claim 22 , wherein the alert is generated by the data appliance.
25. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions which when executed by a processor cause the processor to perform an operation comprising:
receiving an indication that a client device has made a request to a remote server for accessing a package, wherein the remote server makes a plurality of packages publicly available for download, and wherein the requested package is included as a dependency of a software build;
determining that the requested package is a nonexisting package that is not available at the remote server;
responsive to the determination, performing analysis of whether a name of the nonexisting package is related to a name of another package; and
performing, by a data appliance, a responsive action based on a result of the analysis, wherein the performing of the responsive action comprises:
adding a Uniform Resource Locator (URL) associated with the package to a block list, wherein the URL is distributed to another data appliance for blocking by the another data appliance;
increasing a count of a number of times the package has been requested; and
in response to the count exceeding a threshold, blocking access to the package.