Poisoned Pipeline / Techniques / T0191
Malicious code in artifacts
By infecting artifacts with malicious code, attackers can gain access to a large number of unsuspecting customers who use these components in their systems or products.
This can allow the attackers to steal sensitive information, disrupt operations, or take control of affected systems.
Furthermore, because the malicious code is embedded within a seemingly legitimate component, it can be difficult to detect and remove.
This makes supply chain attacks particularly dangerous and challenging to defend against.
Overall, the goal of infecting artifacts with malicious code is to spread the malware to as many targets as possible, while remaining undetected for as long as possible.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach
- https://jfrog.com/blog/detecting-known-and-unknown-malicious-packages-and-how-they-obfuscate-their-malicious-code/
- https://www.legitsecurity.com/blog/why-you-can-still-get-hacked-even-after-signing-your-software-artifacts
Mitigations
- M1500 Verify third-party artifacts and open-source libraries
- M1502 Define trusted package managers and repositories
- M1503 Implement SCA analysis
- M1720 Implement regular patches and updates
- M1730 Implement code reviews
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
Observed in incidents (8)
- CCleaner 5.33 signed ShadowPad backdoor
- php.net git server Zerodium backdoor
- SolarWinds
- XZ Utils backdoor
- Codecov Breach
- Webmin 1.890–1.920 build-server backdoor
- 3CX Desktop
- 3CX Desktop