November 4, 2022
Topics
Typo-squatting is a social engineering attack that takes advantage of developers' trust in open-source package managers. By having malicious packages masqueraded as legitimate software with a small change in the name, a hacker can trick internet users to mistakenly download a malicious package, infecting the given workstation and the network including every client which uses the software supplied by the malicious actor
Typo squatting is a social engineering attack that takes advantage of developers' trust in open-source package managers. By having malicious packages masqueraded as legitimate software with a small change in the name, a hacker can trick internet users to mistakenly download a malicious package, infecting the given workstation and the network including every client which uses the software supplied by the malicious actor.
Over the past few years, typo squatting has become more prevalent, with the year 2018 having more than 100 malicious packages with 600 million downloads. By April 2020, 700 more malicious typo-squatting libraries were found in the Ruby Gems package manager. This trend has only been increasing, and organizations should be informed of the dangers of typo squatting.
In this post, we will discuss what typo-squatting is and its different methods of infection vectors along with methods of detection and eradication.
Figure above shows that a user installs the malicious package from a trusted package manager, PyPi. The installed package is "request," a typo squatted form of the popular python package requests, with the omission of s at the end.
Once installed, the malicious package will contact its Command and Control (C2) server, such as GitHub and pull a second stage payload. During this stage, one of the common payloads seen in the wild called Qakbot gets downloaded. Qakbot is a piece of malware that is nefarious and notorious for infecting many organizations across all types of industry.
The danger of typo-squatting comes from developers' illusion of trust when installing packages from prominent package managers such as PyPI and NPM. While there has been improvement in response to reports of malicious packages, these managers do not vet packages uploaded to their platforms. Essentially, these package managers are more reactionary as opposed to preventative. Therefore, a malicious package can stay undetected for years on a workstation or network.
Another area of trust that developers have is the name of the said package. A popular python package is requests. This package allows developers to send HTTP requests from GET to POST and is one of the most popular libraries for python developers. As it is readily available as open-source package, threat actors can effortlessly take a fork of the requests project, add their malicious code to the project and change the package name to something very similar such as request, omitting the s at the end. Additionally, the bad actor can copy the original PyPI package description including links to the original project code to make it look more official. This ability to trick the user into downloading malicious software is a form of social engineering. Unless a developer is actively searching for inconsistencies, the probability of this malicious package landing on someone’s computer is high.
What makes typo-squatting difficult to find is the difference in source code between a typo-squatted package and the official package as it can be as little as 100 lines of code. The malicious packages, when forked, can duplicate the source code of the original PyPi or another package to make it appear more legitimate. Unless a developer manually reads the source code, these packages would appear as valid.
Homoglyphs is a technique that uses different characters with shapes that appear identical or very similar. An example of this would be the letter O and the number zero (0). A common approach is to replace upper case I as in (i) and lower-case l as in (L) in the Calibri font.
An example of this technique would be the popular python package called NumPy which can be transformed to Num-Py.
In its name, it is common for a package to have a version number. Packages such as bs4, used for web scrapping can be replaced with bs5, giving the illusion of a more updated version of the package.
Most projects are built on top of previous code, libraries, and packages. This commonly accepted practice by software developers can be taken advantage of by bad actors. Let’s say that a typo-squatted package A is being advertised as doing the same job as the original. However, the actual malicious functionality is being done in dependency B, which package A relies upon. The package manager will, in turn, take down this dependency instead of the actual typo-squatted package, which the bad actor can keep replacing with a new version. A typo-squatted package can stay up for a long time with this method.
This malicious practice was seen in the wild very recently by the malware group Lofy Gang who focused on credential stealing using malicious discord bot package software via NPM.
The idea of malicious dependencies is what makes typo squatting especially troubling, as major projects with typo-squatted packages implemented as their dependencies can exist for years and be deemed as trustworthy. Additionally, the removal of the said package from a large project can break an existing project, resulting in time constraints for completion of the project.
Typo-squatting is an infection vector for more dangerous malware samples to be loaded onto the computer. Therefore, the focus should be on preventing the usage of malicious libraries from being installed on a workstation in the first place. Software developers should have a security vetting process regarding what packages they should allow onto their system and usage. Here we will provide some essential information for detecting such packages.
The primary targets of typo-squatting attacks are the most popular packages on the package manager. These packages typically have official sites that describe their behavior and give proof of the author's intent. Verifying the program uploaded to the package manager with official sites is paramount in detecting if a bad actor recreated the package.
Before installing a package on a work computer, install it in an isolated sandbox environment first. Allows an analyst or developer to see the package's behavior before utilizing it in their environment.
Training should be done on the usage of external libraries when implementing code. Developers should not be quick to use a package without consulting their team first to understand how it will be used and affect the project. Organizations should incorporate plan in place that allows the packages to be researched before implementing them into the project in order to prevent typo-squatting attacks.
