Poisoned Pipeline / Techniques / T0100
Discover naming conventions
This technique involves analyzing the naming conventions used in container images, source code repositories, and other related artifacts.
By examining the naming conventions, an attacker can gain insights into the technologies and frameworks used in the application, as well as potentially identifying weak spots or vulnerabilities that can be exploited.
For example, an attacker might use this technique to identify the specific version of a library or software component used in an application, which could then be cross-referenced with known vulnerabilities to determine if the application is at risk.
Alternatively, an attacker might analyze naming conventions to determine the structure and organization of a codebase, which could aid in future attacks.
Where this idea came from
TXTBOOK reconstructed Tinkoff/T-Bank private package namespaces; Birsan found internal names via public docs and DNS. Also plain OWASP recon guidance.
- https://www.cloudsek.com/blog/txtbook-a-supply-chain-heist-rehearsed-in-public
- https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/01-Information_Gathering/README
Mitigations
- M1000 Limit Publicly Available Information
- M1001 Avoid Predictable Naming Conventions
- M1503 Implement SCA analysis
- M1720 Implement regular patches and updates
Detections
- D1500 Configure monitoring of used artifacts and open-source libraries
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (2)
- TXTBOOK dependency confusion against Tinkoff / T-Bank
- node-ipc 9.1.6 / 9.2.3 / 12.0.1 DNS-exfil stealer