Detecting the use of “curl | bash” server side

Re:Detecting the use of “curl | bash” server side by freeqaz on Tuesday December 27, 2022 @05:28AM (#34147395)

This is a real problem that I believe will become increasingly commonly used by attackers to break into companies.

Unfortunately, it's not an easy problem to automate the detection. There are some heuristics, but you're basically writing something like Norton Antivirus for Python packages lol.

A sufficiently skilled attacker can make their code look totally innocent[0]. :)

Source: Former security engineer at Uber/Snap that's now working on tooling in this space[1].

0: "Underhanded C Competition" http://www.underhanded-c.org/

1: Open Source "Supply Chain Security" platform https://github.com/lunasec-io/lunasec

[ Parent | on HN ]

Re:Detecting the use of “curl | bash” server side by jollofricepeas on Tuesday December 27, 2022 @10:59AM (#34149760)

It’s already extremely common in the Python, Ruby and Node ecosystem (see sources below).

The only company that has a real chance at making a dent in the issue is GitHub and to a degree they already have.

SOURCES:

- https://www.mandiant.com/resources/blog/supply-chain-node-js

- https://www.zdnet.com/article/backdoor-found-in-ruby-library...

- https://www.reversinglabs.com/blog/mining-for-malicious-ruby...

- https://news.sophos.com/en-us/2021/10/24/node-poisoning-hija...

- https://www.bleepingcomputer.com/news/security/dev-corrupts-...

- https://portswigger.net/daily-swig/amp/malicious-python-libr...

[ Parent | on HN ]