Supply chain attack detection and prevention based on inline packet name

Abstract

The invention discloses supply chain attack detection and prevention based on inline packet names. An indication that the client device has made a request to the remote server for the packet is received. The data appliance then performs an action in response to the received indication. In example implementations, a data appliance makes a determination of whether a request for a packet is associated with a non-existing packet.

Description

[0001] Cross-references to other applications

[0002] This application claims priority to U.S. Provisional Patent Application No. 63 / 402,294, filed on August 30, 2022, entitled “Supply Chain Attack Detection and Prevention Based on Inline Package Names,” which is incorporated herein by reference for all purposes. Background Art

[0003] Malware is a general term that is often used to refer to malicious software (e.g., including various hostile, invasive and / or otherwise unwanted software). Example uses of malicious code include disrupting computer and / or computer network operations, stealing proprietary information (e.g., confidential information, such as identity, financial, and / or intellectual property related information), and / or obtaining access to private / proprietary computer systems and / or computer networks. Malicious code can be in the form of code, scripts, dynamic content, and / or other software. Package managers allow developers to improve the efficiency of writing and building code. Unfortunately, in part due to their popularity, package managers have recently become a target for attackers, such as as a mechanism for malicious code distribution. Package manager attacks can be particularly problematic because they can also serve as attack vectors used in supply chain attacks. Accordingly, there is a continuing need for improvements in techniques for mitigating malicious code (including its spread via package manager attacks). BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Various embodiments of the invention are disclosed in the following detailed description and accompanying drawings.

[0005] Figure 1 An example of an environment is illustrated in which malicious applications are detected and prevented from causing harm.

[0006] Figure 2A An embodiment of a data appliance is illustrated.

[0007] Figure 2B is a functional diagram of the logical components of an embodiment of a data appliance.

[0008] Figure 3 Examples of logic components that may be included in a system for analyzing a sample are illustrated.

[0009] Figure 4 The diagram shows part of the package.json file.

[0010] Figure 5 An embodiment of a process for mitigating package name based attacks is illustrated. DETAILED DESCRIPTION

[0011] The present invention may be implemented in a variety of ways, including as: a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer-readable storage medium; and / or a processor, such as a processor configured to execute instructions stored on or provided by a memory coupled to the processor. In this specification, these embodiments or any other form that the present invention may take may be referred to as techniques. In general, the order of the steps of the disclosed processes may be changed within the scope of the present invention. Unless otherwise stated, a component described as being configured to perform a task (such as a processor or memory) may be implemented as a general component that is temporarily configured to perform a task at a given time, or as a specific component that is manufactured to perform a task. As used herein, the term "processor" refers to one or more devices, circuits, and / or processing cores that are configured to process data (such as computer program instructions).

[0012] The following is a schematic diagram of the principles of the present invention. Figure 1 A detailed description of one or more embodiments of the present invention is provided. The present invention is described in conjunction with such embodiments, but the present invention is not limited to any embodiment. The scope of the present invention is limited only by the claims and the present invention encompasses numerous alternatives, modifications, and equivalents. In order to provide a thorough understanding of the present invention, many specific details are set forth in the following description. These details are provided for illustrative purposes, and the present invention may be practiced according to the claims without some or all of these specific details. For purposes of clarity, technical material known in the technical field related to the present invention is not described in detail so as not to unnecessarily obscure the present invention.

[0013] I. Overview

[0014] A firewall generally protects a network from unauthorized access while allowing authorized communications to pass through the firewall. A firewall is typically a device, a collection of devices, or software executed on a device that provides firewall functionality for network access. For example, a firewall can be integrated into an operating system of a device (e.g., a computer, a smartphone, or other type of device with network communication capabilities). A firewall can also be integrated into various types of devices (such as computer servers, gateways, network / routing devices (e.g., network routers), and data appliances (e.g., security appliances or other types of dedicated devices)) or executed on these devices as one or more software applications, and in various embodiments, certain operations can be implemented in dedicated hardware (such as ASICs or FPGAs).

[0015] Firewalls typically deny or allow network transmissions based on a set of rules. These sets of rules are often referred to as policies (e.g., network policies or network security policies). For example, a firewall can filter inbound traffic by applying a set of rules or policies to prevent unwanted external traffic from reaching the protected device. A firewall can also filter outbound traffic by applying a set of rules or policies (e.g., allowing, blocking, monitoring, notifying, or logging, and / or other actions that can be specified in a firewall rule or firewall policy, which can be triggered based on various criteria such as those described herein). A firewall can also filter local network (e.g., intranet) traffic by similarly applying a set of rules or policies.

[0016] Security devices (e.g., security appliances, security gateways, security services, and / or other security devices) may include various security functions (e.g., firewalls, anti-malware, intrusion prevention / detection, data loss prevention (DLP), and / or other security functions), networking functions (e.g., routing, quality of service (QoS), workload balancing of network-related resources, and / or other networking functions), and / or other functions. For example, routing functions may be based on source information (e.g., IP address and port), destination information (e.g., IP address and port), and protocol information.

[0017] Basic packet filtering firewalls (e.g., packet filtering firewalls or first generation firewalls, which are stateless packet filtering firewalls) filter network communication traffic by inspecting individual packets transmitted on the network. Stateless packet filtering firewalls typically inspect the individual packets themselves and apply rules based on the inspected packets (e.g., using a combination of source and destination address information, protocol information, and port numbers of the packets).

[0018] Application firewalls can also perform application layer filtering (e.g., application layer filtering firewalls or second generation firewalls, which work at the application layer of the TCP / IP stack). Application layer filtering firewalls or application firewalls can generally identify certain applications and protocols (e.g., web browsing using Hypertext Transfer Protocol (HTTP), Domain Name System (DNS) requests, file transfers using File Transfer Protocol (FTP), and various other types of applications and other protocols, such as Telnet, DHCP, TCP, UDP, and TFTP (GSS)). For example, an application firewall can block unauthorized protocols that attempt to communicate on standard ports (e.g., an application firewall can generally be used to identify unauthorized / non-policy compliant protocols that attempt to sneak through by using non-standard ports for the protocol).

[0019] A stateful firewall may also perform state-based packet inspection, where each data packet is inspected within the context of a series of data packets associated with the data packet stream being transmitted by the network. This firewall technology is generally referred to as stateful packet inspection because it maintains a record of all connections that pass through the firewall and is able to determine whether a data packet is the beginning of a new connection, part of an existing connection, or an invalid data packet. For example, the state of the connection itself can be one of the criteria for triggering a rule within a policy.

[0020] Advanced or next-generation firewalls can perform stateless and stateful data packet filtering and application layer filtering as discussed above. Next-generation firewalls can also perform additional firewall technologies. For example, some newer firewalls, sometimes referred to as advanced or next-generation firewalls, can also identify users and content (e.g., next-generation firewalls). In particular, some next-generation firewalls are expanding the list of applications that these firewalls can automatically identify to tens of thousands of applications. Examples of such next-generation firewalls can be purchased from Palo Alto Networks, Inc. (e.g., Palo Alto Networks' PA series firewalls). For example, Palo Alto Networks' next-generation firewalls enable enterprises to use various identification technologies to identify and control applications, users, and content rather than just ports, IP addresses, and data packets, such as the following: APP-ID for accurate application identification, User-ID for user identification (e.g., by user or user group), and Content-ID for real-time content scanning (e.g., controlling web surfing and limiting data and file transfer). These identification technologies allow enterprises to use business-related concepts to reliably implement application use, rather than following the traditional methods provided by traditional port blocking firewalls. In addition, dedicated hardware for next-generation firewalls (e.g., implemented as a dedicated appliance) generally provides higher performance levels for application inspection than software executing on general-purpose hardware, such as, for example, the security appliance provided by Palo Alto Networks, Inc., which uses dedicated function-specific processing tightly integrated with a single-channel software engine to maximize network throughput while minimizing latency.

[0021] Advanced or next-generation firewalls may also be implemented using virtualized firewalls. Examples of such next-generation firewalls are available from Palo Alto Networks, Inc. (e.g., Palo Alto Networks' VM series firewalls, which support a variety of commercial virtualization environments, including, for example, ESXi TM and NSX TM , NetScaler SDX TM ,KVM / OpenStack(Centos / RHEL, ), and Amazon Web Services (AWS). For example, virtualized firewalls can support similar or identical next-generation firewall and advanced threat prevention features as available in physical form factor appliances, allowing enterprises to securely enable applications to flow into and across their private, public, and hybrid cloud computing environments. Automation features such as VM monitoring, dynamic address groups, and REST-based APIs allow enterprises to proactively monitor VM changes dynamically feeding that context into security policies, thereby eliminating policy lags that can occur when VMs change.

[0022] II. Sample Environment

[0023] Figure 1 An example of an environment is illustrated in which malicious applications ("malicious code") are detected and prevented from causing harm. As will be described in more detail below, the malicious code classification (e.g., as determined by the security platform 122) may be Figure 1 The various entities included in the illustrated environment are shared and / or refined in a variety of ways. And, using the techniques described herein, devices (such as endpoint client devices 104-110) can be protected from such malicious code.

[0024] Throughout the specification, the term "application" is used to collectively refer to programs, bundles of programs, manifests, packages, etc., regardless of the form / platform. An "application" (also referred to herein as a "sample") can be a standalone file (e.g., a calculator application with a file name "calculator.apk" or "calculator.exe"), and can also be an independent component of another application (e.g., a mobile advertising SDK or library embedded in a calculator app).

[0025] As used herein, "malicious code" refers to an application that engages in behaviors that the user does not approve / would not approve if fully informed, whether or not these behaviors are performed secretly (also whether or not illegal). Examples of malicious code include Trojans, viruses, root kits (rootkits), spyware, hacker tools, keyboard loggers, etc. An example of malicious code is a desktop application that collects and reports the location of the terminal user to a remote server (but does not provide location-based services, such as map services, to the user). Another example of malicious code is a malicious Android application package .apk (APK) file, which appears as a free game to the terminal user, but secretly sends SMS premium messages (e.g., each costs $10), thereby increasing the terminal user's phone bill. Another example of malicious code is an Apple iOS flash application that secretly collects the user's contacts and sends those contacts to spammers. Other forms of malicious code (e.g., ransomware) can also be detected / thwarted using the technology described herein. Additionally, although malicious code signatures are described herein as being generated for malicious applications, the techniques described herein may also be used in various embodiments to generate profiles for other types of applications (eg, adware profiles, beneficial software profiles, etc.).

[0026] The techniques described herein may be used in conjunction with various platforms (e.g., desktops, mobile devices, gaming platforms, embedded systems, etc.) and / or various types of applications (e.g., Android .apk files, iOS applications, Windows PE files, Adobe Acrobat PDF files, etc.). Figure 1 In the example environment shown, client devices 104-108 are laptop computers, desktop computers, and tablet computers (respectively) that reside within enterprise network 140. Client device 110 is a laptop computer that is external to enterprise network 140.

[0027] Data appliance 102 is configured to enforce policies regarding communications between client devices (such as client devices 104 and 106) and nodes external to enterprise network 140 (e.g., reachable via external network 118). Examples of such policies include policies that manage traffic shaping, quality of service, and traffic routing. Other examples of policies include security policies, such as policies that require scanning for threats in: incoming (and / or outgoing) email attachments, website content (including website content based on rules applied by URL module 152), files exchanged through instant messaging programs, and / or other file transfers. In some embodiments, data appliance 102 is also configured to enforce policies for traffic that remains within enterprise network 140.

[0028] Although in Figure 1Although illustrated as a single element in FIG. 1 , enterprise network 140 may include multiple networks, any / each of which may include one or more data appliances or other components embodying the techniques described herein. For example, the techniques described herein may be deployed by a large multinational corporation (or other entity) having multiple offices in multiple geographic locations. Furthermore, although client devices 104-108 may be deployed in Figure 1 1. Although illustrated as being directly connected to the data appliance 102, it will be understood that one or more intermediate nodes (eg, routers, switches, and / or proxies) can be, and typically are, interposed between the various elements in the enterprise network 140.

[0029] Figure 2A 102. An embodiment of a data appliance is shown in . The examples shown are representations of physical components included in the data appliance 102 in various embodiments. Specifically, the data appliance 102 includes a high-performance multi-core central processing unit (CPU) 202 and a random access memory (RAM) 204. The data appliance 102 also includes a storage device 210 (such as one or more hard disks or solid-state storage units). In various embodiments, the data appliance 102 stores (whether in RAM 204, storage device 210 and / or other appropriate locations) information for monitoring the enterprise network 140 and implementing the disclosed technology. Examples of such information include application identifiers, content identifiers, user identifiers, requested URLs, IP address mappings, policies and other configuration information, signatures, host name / URL category information, malicious code profiles, and machine learning models. The data appliance 102 may also include one or more optional hardware accelerators. For example, the data appliance 102 may include a cryptographic engine 206 configured to perform encryption and decryption operations, and one or more field programmable gate arrays (FPGAs) 208 configured to perform matching, act as a network processor, and / or perform other tasks.

[0030] The functions described herein as being performed by the data appliance 102 may be provided / implemented in a variety of ways. For example, the data appliance 102 may be a dedicated device or a collection of devices. The functions provided by the data appliance 102 may also be integrated into or executed as software on a general-purpose computer, computer server, gateway, and / or network / routing device. In some embodiments, alternatively (or additionally), at least some of the services described as being provided by the data appliance 102 are provided to a client device (e.g., client device 104 or client device 110) by software (e.g., endpoint protection application 132) executed on the client device.

[0031] Whenever data appliance 102 is described as performing a task, a single component, a subset of components, or all components of data appliance 102 can cooperate to perform the task. Similarly, whenever a component of data appliance 102 is described as performing a task, a subcomponent can perform a task and / or a component can perform a task in conjunction with other components. In various embodiments, parts of data appliance 102 are provided by one or more third parties. Depending on factors such as the amount of computing resources available to data appliance 102, various logical components and / or features of data appliance 102 can be omitted and the technology described herein can be adapted accordingly. Similarly, where applicable, additional logical components / features can be included in the embodiments of data appliance 102. In various embodiments, an example of a component included in data appliance 102 is an application identification engine, which is configured to identify an application (e.g., based on data packet flow analysis, using various application signatures to identify an application). For example, an application identification engine can determine what type of traffic a session involves, such as web browsing-social networking, web browsing-news, SSH, etc.

[0032] Figure 2B 102 is a functional diagram of the logical components of an embodiment of a data appliance. The examples shown are representations of the logical components that may be included in the data appliance 102 in various embodiments. Unless otherwise specified, the various logical components of the data appliance 102 can generally be implemented in various ways, including as a collection of one or more scripts (e.g., written in Java, python, etc., where applicable).

[0033] As shown, the data appliance 102 includes a firewall, and includes a management plane 232 and a data plane 234. The management plane is responsible for managing user interactions, such as by providing a user interface for configuring policies and viewing log data. The data plane is responsible for managing data, such as by performing data packet processing and session processing.

[0034] The network processor 236 is configured to receive data packets from a client device (such as the client device 108) and provide them to the data plane 234 for processing. Whenever the flow module 238 identifies a data packet as part of a new session, it creates a new session flow. Subsequent data packets will be identified as belonging to the session based on the flow lookup. If applicable, SSL decryption is applied by the SSL decryption engine 240. Otherwise, the processing of the SSL decryption engine 240 is omitted. The decryption engine 240 can help the data appliance 102 to inspect and control SSL / TLS and SSH encrypted traffic, and thus help prevent threats (which may otherwise remain hidden in the encrypted traffic). The decryption engine 240 can also help prevent sensitive content from leaving the enterprise network 140. Decryption can be selectively controlled (e.g., enabled or disabled) based on parameters such as: URL category, traffic source, traffic destination, user, user group, and port. In addition to decryption policies (e.g., which specify which sessions are decrypted), decryption profiles can be assigned to control various options for sessions controlled by the policy. For example, it may be necessary to use a specific cipher suite and encryption protocol version.

[0035] The application identification (APP-ID) engine 242 is configured to determine what type of traffic the session involves. As an example, the application identification engine 242 can identify a GET request in the received data and infer that the session requires an HTTP decoder. In some cases (e.g., a web browsing session), the identified application may change, and such changes will be noted by the data appliance 102. For example, a user may initially browse to a company wiki (classified as "web browsing - productivity" based on the URL visited), and then subsequently browse to a social networking site (classified as "web browsing - social networking" based on the URL visited). Different types of protocols have corresponding decoders 244.

[0036] Based on the determination made by the application identification engine 242, the data packets are sent to the appropriate decoder 244. The decoder 244 is configured to assemble the data packets (which may be received out of order) into the correct order, perform tokenization, and extract information. The decoder 244 also performs signature matching to determine what should be done with the data packets. As needed, the SSL encryption engine 246 can re-encrypt the decrypted data. The forwarding module 248 is used to forward the data packets for transmission (e.g., to a destination).

[0037] Also Figure 2BAs shown in , policies 252 are received and stored in the management plane 232. A policy may include one or more rules, which may be specified using domains and / or host / server names, and the rules may apply one or more signatures or other matching criteria or heuristics, such as security policy enforcement for subscribers / IP flows based on various extracted parameters / information from monitored session traffic flows. An interface (I / F) communicator 250 is provided for management communications (e.g., via a (REST) ​​API, messaging or network protocol communications, or other communication mechanisms).

[0038] III. Security Platform

[0039] Back to Figure 1 In various embodiments, the security platform 122 is configured to provide various services (including providing various services to the data appliance 102), including analyzing samples (e.g., documents, applications, etc.) for maliciousness, classifying applications, classifying domains / URLs / URIs, etc.

[0040] Assume that a malicious individual (using system 120) has created malicious code 130. The malicious individual hopes that a client device (such as client device 104) will execute a copy of the malicious code 130, thereby compromising the client device and causing the client device to become a zombie in a botnet. The compromised client device can then be directed to perform tasks (e.g., cryptocurrency mining, or engaging in a denial of service attack) and, where applicable, report information to an external entity (such as a command and control (C&C) server 150) and receive instructions from the C&C server 150.

[0041] Assume that data appliance 102 has intercepted (e.g., by system 120) an email sent to user "Alice" who operates client device 104 as an employee of ACME Corporation (which maintains enterprise network 140). A copy of malicious code 130 has been attached to the message by system 120. As an alternative, but similar scenario, data appliance 102 is able to intercept an attempted download of malicious code 130 by client device 104 (e.g., from a website). In either scenario, data appliance 102 determines whether a signature for a file (e.g., an email attachment or website download of malicious code 130) exists on data appliance 102. The signature, if present, may indicate that the file is known to be safe (e.g., whitelisted), and may also indicate that the file is known to be malicious (e.g., blacklisted).

[0042] In various embodiments, the data appliance 102 is configured to work in cooperation with the security platform 122. As an example, the security platform 122 may provide the data appliance 102 with a collection of signatures of files that are known to be malicious (e.g., as part of a subscription). If the signature of the malicious code 130 (e.g., the MD5 hash of the malicious code 130) is included in the collection of signatures, the data appliance 102 may accordingly prevent the malicious code 130 from being transmitted to the client device 104 (e.g., by detecting that the MD5 hash of the email attachment sent to the client device 104 matches the MD5 hash of the malicious code 130). The security platform 122 may also provide the data appliance 102 with a list of domains and / or IP addresses that are known to be malicious, thereby allowing the data appliance 102 to block traffic between the enterprise network 140 and the C&C server 150 (e.g., where the C&C server 150 is known to be malicious). The list of malicious domains (and / or IP addresses) may also help the data appliance 102 determine when one of its nodes has been compromised. For example, if the client device 104 attempts to contact the C&C server 150, such an attempt is a strong indication that the client 104 has been compromised by malicious code (and accordingly remedial action should be taken, such as isolating the client device 104 from communicating with other nodes within the enterprise network 140). The security platform 122 may also provide other types of information to the data appliance 102 (e.g., as part of a subscription), such as a collection of machine learning models that can be used by the data appliance 102 to perform inline analysis of files.

[0043] In various embodiments, if the signature of the attachment is not found, the data appliance 102 can take various actions. As a first example, the data appliance 102 can achieve failure safety by blocking the transmission of any attachment that is not listed as benign by the white list (e.g., does not match the signature of a file known to be beneficial). The potential disadvantage of this method is that there may be many legitimate attachments that are unnecessarily blocked as potential malicious code when they are actually benign. As a second example, the data appliance 102 can achieve failure risk by allowing the transmission of any attachment that is not listed as malicious by the black list (e.g., does not match the signature of a file known to be harmful). The potential disadvantage of this method is that it will not prevent newly created malicious code (which the platform 122 has not seen before) from causing harm. As a third example, the data appliance 102 can be configured to provide a file (e.g., malicious code 130) to the security platform 122 for static / dynamic analysis to determine whether it is malicious and / or to classify it in other ways. The data appliance 102 can take various actions while the security platform 122 performs analysis of the attachment (for which there is no signature yet). As a first example, the data appliance 102 may prevent the email (and attachment) from being delivered to Alice until a response is received from the security platform 122. Assuming that the platform 122 takes approximately 15 minutes to thoroughly analyze the sample, this means that incoming messages to Alice will be delayed by 15 minutes. In this example, since the attachment is malicious, this delay will not negatively affect Alice. In an alternative example, assume that someone has sent a time-sensitive message with a benign attachment to Alice, for which the signature also does not exist. Delaying the delivery of the message to Alice by 15 minutes may be considered unacceptable (e.g., by Alice). As will be described in more detail below, an alternative approach is to perform at least some real-time analysis of the attachment on the data appliance 102 (e.g., while waiting for a ruling from the platform 122). If the data appliance 102 can independently determine whether the attachment is malicious or benign, the data appliance 102 can take an initial action (e.g., block or allow delivery to Alice), and once a ruling is received from the security platform 122, additional actions can be adjusted / taken where applicable.

[0044] The security platform 122 stores a copy of the received sample in a storage device 142 and starts (or schedules, where applicable) the analysis. An example of a storage device 142 is an Apache Hadoop cluster (HDFS). The results of the analysis (and additional information about the application) are stored in a database 146. In the event that the application is determined to be malicious, the data appliance can be configured to automatically block file downloads based on the analysis results. In addition, signatures can be generated for malicious code and distributed (e.g., to data appliances, such as data appliances 102, 136, and 148) to automatically block future file transfer requests from downloading files that are determined to be malicious.

[0045] In various embodiments, the security platform 122 includes one or more dedicated commercially available hardware servers (e.g., with (one or more) multi-core processors, 32G+ of RAM, (one or more) Gigabit network interface adapters, and (one or more) hard drives) running a typical server-class operating system (e.g., Linux). The security platform 122 can be implemented across a scalable infrastructure that includes multiple such servers, solid-state drives, and / or other applicable high-performance hardware. The security platform 122 can include several distributed components, including components provided by one or more third parties. For example, part or all of the security platform 122 can be implemented using Amazon Elastic Compute Cloud (EC2) and / or Amazon Simple Storage Service (S3). In addition, as with the data appliance 102, whenever the security platform 122 is referred to as performing a task (such as storing data or processing data), it should be understood that one or more subcomponents of the security platform 122 (whether alone or in cooperation with third-party components) can cooperate to perform the task. As an example, the security platform 122 can optionally cooperate with one or more virtual machine (VM) servers (such as VM server 124) to perform static / dynamic analysis.

[0046] An example of a virtual machine server is a physical machine that includes commercially available server-class hardware (e.g., a multi-core processor, 32+ gigabytes of RAM, and one or more gigabit network interface adapters) running open source and / or commercially available virtualization software (such as Linux Kernel-based Virtual Machine (KVM), VMware ESXi, Citrix XenServer, and / or Microsoft Hyper-V). In some embodiments, the virtual machine server is omitted. In addition, the virtual machine server can be under the control of the same entity that manages the security platform 122, but can also be provided by a third party. As an example, the virtual machine server can rely on EC2, where the remainder of the security platform 122 is provided by dedicated hardware that is owned by the operator of the security platform 122 and under the control of the operator of the security platform 122. The VM server 124 is configured to provide one or more virtual machines 126-128 for emulating client devices. The virtual machines can execute various operating systems and / or various versions of operating systems. The observed behavior of the executed application generated from the virtual machine is recorded and analyzed (e.g., for indications that the application is malicious). In some embodiments, log analysis is performed by a VM server (e.g., VM server 124). In other embodiments, the analysis is performed at least in part by other components of the security platform 122 , such as the orchestrator 144 .

[0047] In various embodiments, as part of a subscription, the security platform 122 makes available to the data appliance 102 the results of the security platform 122's analysis of the sample via a list of signatures (and / or other identifiers). For example, the security platform 122 may periodically send content packages that identify malicious code apps (e.g., daily, hourly, or at some other interval, and / or based on events configured by one or more policies). An example content package includes a list of identified malicious code apps, with information such as the following: package name, a hash value for uniquely identifying the app, and a malicious code name (and / or malicious code family name) for each identified malicious code app. A subscription may cover only the analysis of those files (intercepted by the data appliance 102 and sent to the security platform 122 by the data appliance 102), and may also cover signatures of all malicious code known to the security platform 122 (or a subset thereof, such as only mobile malicious code and not other forms of malicious code (e.g., PDF malicious code)). The platform 122 may also make other types of information available, such as machine learning models that may help the data appliance 102 detect malicious code (e.g., through techniques other than hash-based signature matching).

[0048] In various embodiments, the security platform 122 is configured to provide security services to various entities in addition to (or, where applicable, in lieu of) the operator of the data appliance 102. For example, other enterprises with their own respective enterprise networks 114 and 116 and their own respective data appliances 136 and 148 may contract with the operator of the security platform 122. Other types of entities may also utilize the services of the security platform 122. For example, an Internet service provider (ISP) that provides Internet service to the client device 110 may contract with the security platform 122 to analyze applications that the client device 110 attempts to download. As another example, the owner of the client device 110 may install endpoint protection software 134 on the client device 110 that communicates with the security platform 122 (e.g., in order to receive content packages from the security platform 122, use the received content packages to inspect attachments according to the techniques described herein, and transmit applications to the security platform 122 for analysis).

[0049] In various embodiments, the security platform 122 is configured to collaborate with one or more third-party services. As one example, the security platform 122 can provide malicious code scan results (and other information, where applicable) to a third-party scanner service (e.g., VirusTotal). The security platform 122 can similarly incorporate information obtained from a third-party scanner service (e.g., maliciousness determinations from entities outside the security platform 122) into its own information (e.g., information stored in the database 146 or another appropriate information repository).

[0050] IV. Analyze the sample using static / dynamic analysis

[0051] Figure 3 An example of a logical component is illustrated that may be included in a system for analyzing a sample. Analysis system 300 may be implemented using a single device. For example, the functionality of analysis system 300 may be implemented in a malicious code analysis module 112 incorporated into data appliance 102. Analysis system 300 may also be implemented collectively across multiple different devices. For example, the functionality of analysis system 300 may be provided by security platform 122.

[0052] In various embodiments, the analysis system 300 utilizes a list, database, or other collection of known safe content and / or known harmful content (in Figure 3100 and / or 101). Collection 314 may be obtained in a variety of ways, including via a subscription service (e.g., provided by a third party) and / or as a result of other processing (e.g., performed by data appliance 102 and / or security platform 122). Examples of information included in collection 314 are: URLs, domain names, and / or IP addresses of servers known to be malicious; URLs, domain names, and / or IP addresses of servers known to be safe; URLs, domain names, and / or IP addresses of known command and control (C&C) domains; signatures, hashes, and / or other identifiers of applications known to be malicious; signatures, hashes, and / or other identifiers of applications known to be safe; signatures, hashes, and / or other identifiers of files known to be malicious (e.g., Android exploit files); signatures, hashes, and / or other identifiers of libraries known to be safe; and signatures, hashes, and / or other identifiers of libraries known to be malicious.

[0053] A. Intake

[0054] In various embodiments, when a new sample is received for analysis (eg, an existing signature associated with the sample does not exist in analysis system 300), it is added to queue 302. Figure 3 As shown, application 130 is received by system 300 and added to queue 302 .

[0055] B. Static Analysis

[0056] Coordinator 304 monitors queue 302, and when resources (e.g., static analysis workers) become available, coordinator 304 obtains samples from queue 302 for processing (e.g., obtaining a copy of malicious code 130). In particular, coordinator 304 first provides samples to static analysis engine 306 for static analysis. In some embodiments, one or more static analysis engines are included in analysis system 300, where analysis system 300 is a single device. In other embodiments, static analysis is performed by a separate static analysis server including multiple workers (i.e., multiple instances of static analysis engine 306).

[0057] The static analysis engine (which may be implemented via a collection of scripts written in an appropriate scripting language) obtains general information about the sample and includes it (along with heuristics and other information, where applicable) in a static analysis report 308. The report may be created by the static analysis engine, or by the coordinator 304 (or another appropriate component) which may be configured to receive information from the static analysis engine 306. In some embodiments, the collected information is stored in a database record for the sample (e.g., in a database 316) instead of or in addition to creating a separate static analysis report 308 (i.e., portions of the database record form the report 308). In some embodiments, the static analysis engine also forms a verdict for the application (e.g., "safe," "suspicious," or "malicious"). As an example, if even one "malicious" static feature is present in the application (e.g., the application includes a hard link to a domain known to be malicious), the verdict may be "malicious." As another example, points may be assigned to each feature (e.g., based on severity, if found; based on how reliable the feature is for predicting maliciousness; etc.), and static analysis engine 306 (or orchestrator 304, if applicable) may assign a verdict based on the number of points associated with the static analysis results.

[0058] C. Dynamic Analysis

[0059] Once the static analysis is complete, the coordinator 304 locates an available dynamic analysis engine 310 to perform dynamic analysis on the application. As with the static analysis engine 306, the analysis system 300 may directly include one or more dynamic analysis engines. In other embodiments, the dynamic analysis is performed by a separate dynamic analysis server that includes multiple work units (i.e., multiple instances of the dynamic analysis engine 310).

[0060] Each dynamic analysis work unit manages a virtual machine instance. In some embodiments, the results of a static analysis (e.g., performed by a static analysis engine 306), whether in the form of a report (308) and / or as stored in a database 316 or otherwise, are provided as input to a dynamic analysis engine 310. For example, static report information can be used to help select / customize a virtual machine instance (e.g., Microsoft Windows 7 SP 2 vs. Microsoft Windows 10 Enterprise, or iOS 11.0 vs. iOS 12.0) used by the dynamic analysis engine 310. When multiple virtual machine instances are executed simultaneously, a single dynamic analysis engine can manage all instances, or multiple dynamic analysis engines can be used where applicable (e.g., each dynamic analysis engine manages its own virtual machine instance). During the dynamic portion of the analysis, actions taken by the application (including network activity) are analyzed.

[0061] In various embodiments, static analysis of samples is omitted or performed by a separate entity, where applicable. As an example, conventional static and / or dynamic analysis may be performed on a file by a first entity. Once a given file is determined to be suspicious or malicious (e.g., by a first entity), the file may be provided to a second entity (e.g., an operator of security platform 122), specifically for additional analysis of use of network activity by malicious code (e.g., by dynamic analysis engine 310).

[0062] The environment used by the analysis system 300 is instrumented / hooked so that behaviors observed when the application is executed are logged as they occur (e.g., using a custom kernel that supports hooks and logcat). Network traffic associated with the emulator is also captured (e.g., using pcap). The log / network data can be stored as temporary files on the analysis system 300, and can also be stored more permanently (e.g., using HDFS or other appropriate storage technology or combination of technologies, such as MongoDB). The dynamic analysis engine (or another appropriate component) can compare the connections established by the sample to a list (314) of domains, IP addresses, etc., and determine whether the sample has communicated (or attempted to communicate) with a malicious entity.

[0063] As with the static analysis engine, the dynamic analysis engine stores the results of its analysis in a record associated with the application being tested in database 316 (and / or includes the results in report 312, where applicable). In some embodiments, the dynamic analysis engine also forms a verdict (e.g., "safe," "suspicious," or "malicious") for the application. As an example, if the application takes even one "malicious" action (e.g., makes an attempt to contact a domain known to be malicious, or is observed to leak sensitive information), the verdict may be "malicious." As another example, points may be assigned to the action taken (e.g., based on severity, if found; based on how reliable the action is for predicting maliciousness; etc.), and the dynamic analysis engine 310 (or coordinator 304, if applicable) may assign a verdict based on the number of points associated with the dynamic analysis results. In some embodiments, a final verdict associated with the sample is made (e.g., by coordinator 304) based on a combination of report 308 and report 312.

[0064] V. Supply Chain Attack Detection and Prevention Based on Inline Package Names

[0065] A. Introduction

[0066] A package registry (e.g., provided by a registry maintainer) is a centralized repository that software developers can use to find and install hosted packages, as well as automate processes such as installing and updating dependencies. Examples include PyPI (for Python), npm (for Node.JS and JavaScript), and RubyGems (for Ruby). The package management ecosystem (also referred to herein as a "package manager" for simplicity) helps developers efficiently share their code and incorporate third-party code into their own projects. A package manager typically includes two main components: a client application that provides access to packages (used by developers on their endpoint devices), and a network-based application that provides package services. Using Python as an example, "pip" is an example of a package management client application, and "pypi.org" is an example of a corresponding network application. Typically, registry maintainers require package maintainers (people who submit packages to the package registry) to create an account with a network application. Developers (people who want to download / incorporate packages into their own projects) are typically not required to create an account (but this may be the case if they choose to do so).

[0067] Unfortunately, unscrupulous individuals / organizations may exploit the package management ecosystem to facilitate the distribution of malicious code. One type of attack that may be implemented is account compromise (e.g., where a package maintainer's account with a repository is compromised by an attacker). In an example of such an attack, an unscrupulous individual may compromise a legitimate package compiled by a legitimate maintainer and replace the legitimate code with the compromised code (for download by others). Another type of attack exploits package names. A first example of this type of attack is called typosquatting, where a malicious author submits a package to a repository that has a name similar to the name of another (usually popular) package, but differs by one or two characters (or other appropriate editor / Levenstein distance). When an unsuspecting developer inadvertently requests a misspelled package (e.g., "python-toolkit-for-grapics" instead of "python-toolkit-for-graphics"), the package manager will install the malicious package instead of the legitimate package. A second similar example of this attack is known as combosquatting, where a malicious author submits a package to a repository with a name that is confusingly similar to another package (e.g., "pykit-for-graphics" instead of "python-toolkit-for-graphics"). A third example is dependency confusion, described with reference to an employee ("Bob") who develops software for ACME Corporation. Although the examples are described in the context of a Python code development environment, other ecosystems (e.g., JavaScript / npm) can be similarly exploited.

[0068] The installation of a given package will typically depend on the presence of other packages. If any required packages are missing (i.e., those packages that the package to be installed depends on), the package manager will also identify and retrieve / install them. In a typical development environment, developers utilize a mix of internal packages (e.g., packages compiled by a company for internal / proprietary use by / within the company) and public packages (e.g., other packages that are open source or publicly available at a repository). Internal packages are stored in an internal repository with a corresponding internal package index. As mentioned above, a public repository (e.g., at pypi.org) with a corresponding public package index is used to store public packages.

[0069] Assume that Bob is working on an internal application for ACME, Inc. As part of his development, he needs to install "ACME-CORE.py" (an internal package that includes various functions commonly used in the internal ACME, Inc. application). ACME-CORE.py in turn depends on other internal packages, and also depends on various public packages.

[0070] To install ACME-CORE.py, Bob uses the pip client at the command line as follows:

[0071] #pip install --index https: / / pypi.org / simple--extra-index-url https: / / dev.acmecorporation.com / repository ACME-CORE.py

[0072] The command line parameters "--index" and "--extra-index-url" instruct the pip client to look for any dependencies (as well as the ACME-CORE.py package itself) in both the ACME, Inc. internal package repository and the pypi.org public repository, download them, and install them on Bob's computer. It is worth noting that pip will check both repositories for all required packages. If a given package exists in only one repository, it installs that package. However, the same named package may potentially exist in both the internal repository and the public repository. "Dependency confusion" is used to refer to the uncertainty of which copy of a package should be installed if a given package name exists in both repositories. Pip defaults to installing from the repository hosting the copy of the package with the highest version number. Other package managers may have other default behaviors (e.g., preferring public packages over internal packages, regardless of version numbers).

[0073] If a malicious individual is able to determine the name of an internal ACME corporate package (e.g., "ACME-CORE-helper.py", "ACME-CORE.py" depends on "ACME-CORE-helper.py"), he could publish a malicious package with the same name ("ACME-CORE-helper.py") on pypi.org, assign it a high version number, and cause Bob to automatically download and install the malicious package (instead of the private, benign package).

[0074] While it seems unlikely that an external attacker could obtain (and therefore be able to exploit) the name of a private package, this is unfortunately not the case. As an example, in the summer of 2020, a Node.js source code snippet hosted at github.com was found to contain a Figure 4 The source code shown in (in its package.json file). Figure 4 , both a publicly hosted npm package (402) and a package (404) whose name did not (at the time) exist on the npm registry - believed to be an internal PayPal package. During the build process, internal package.json files (such as Figure 4The file shown) often ends up being embedded in public JavaScript files (e.g., potentially across many different websites that utilize the PayPal service to collect payments).

[0075] B. Preventing attacks based on package names

[0076] Figure 1 The various elements shown in can be used to help prevent attacks based on packet names, such as the attacks described above. As previously mentioned, one task that can be performed by data appliance 102 is to enforce policies on network traffic between nodes inside network 140 and nodes outside network 140. Assume that Figure 1 In the illustrated environment, client device 106 is Bob's computer. And further, assume that code repository 154 is a web-based application that provides package services (such as pypi.org). Data appliance 102 (optionally working in cooperation with security platform 122) can evaluate requests made by client device 106 (and corresponding responses from code repository 154) and take remedial actions if it is determined, for example, that client device 106 is potentially involved in a package name-based attack. In addition, in addition to helping protect client device 106 (and other client devices within network 140), security platform 122 can also help protect other client devices in other networks (e.g., networks 114 and 116) based on the information it learns from data appliance 102.

[0077] 1. Identify the packet request

[0078] The following are examples of strings used by various package managers to fetch metadata from their corresponding repositories on a per-package basis:

[0079] *pip:https: / / pypi.python[.]org / simple / $pkg /

[0080] *npm:https: / / registry.npmjs[.]org / $pkg

[0081] *mvn:

[0082] https: / / repo.maven.apache[.]org / maven2 / $group / $artifact / maven-metadata.xml or

[0083] https: / / repo.maven.apache[.]org / maven2 / $group / $artifact / $version / $artifact-$version.pom

[0084] *nuget:

[0085] https: / / www.nuget[.]org / api / v2 / FindPackagesById()?id=$pkg or

[0086] https: / / www.nuget[.]org / api / v2 / FindPackagesById()? $filter=IsLatestVersion&$orderby=Versiondesc&$top=1&id=$pkg

[0087] *Go:https: / / github[.]com / $scope / $pkg (domain can vary)

[0088] URL module 152 is configured to evaluate URLs in requests made by clients in network 140 against policy 252. As an example, a policy included in policy 252 may specify that users of network 140 are not allowed to access pornographic websites. If such a request is made (e.g., via client device 108 requesting access to sexytime.example.com), the request may be blocked / logged / etc., where applicable. In various embodiments, URL module 152 is configured to identify metadata URLs (examples of which are provided above) used by the package manager in inline traffic. In particular, URL module 152 may derive (e.g., from the request) the name of the package that Bob is trying to install, and based on the response (e.g., from the public repository), determine whether the package name in question exists in the public repository. In some cases (e.g., depending on which repository is contacted), data appliance 102 may not receive enough information in the response to determine whether the public repository includes the requested package. The data appliance 102 can handle this scenario by using the information detected in the request (e.g., the determined package name) to perform its own checks (i.e., requesting the same metadata directly from the public repository and recording the response it receives). If the response received from the repository indicates that the package does not exist ("non-existing package"), the data appliance 102 (and / or security platform 122) can perform additional processing, whether as determined from inline traffic or by direct querying.

[0089] 2. Handling non-existing packages

[0090] As described above, "ACME-CORE.py" depends on both internal and public packages. When Bob executes his "pip install" command for the package, URL module 152 will observe a collection of parallel requests issued to both public code repository 154 and internal code repository 156 for all dependencies (internal code repository 156 may be located within network 140 or may be located outside network 140 but otherwise "inside" ACME (e.g., through the use of access controls)). As mentioned above, ACME-CORE-helper.py is an example of an internally hosted dependency of ACME-CORE.py. As such, the pip client executing on client device 106 will receive a "non-existing package" response from public repository 154, but a copy of the package from internal repository 156. Noting this non-existing package response, data appliance 102 may take various actions. As a first example, data appliance 102 may immediately add a URL corresponding to a request for ACME-CORE-helper.py from public repository 154 to a blocklist. Any subsequent requests from within network 140 for ACME-CORE-helper.py from public repository 154 will be blocked, meaning that even if an unscrupulous individual subsequently registers a malicious copy of ACME-CORE-helper.py at public repository 154 (e.g., with a higher version number than the internal copy of ACME-CORE-helper.py), the malicious copy will be prevented from being installed within network 140.

[0091] The data appliance 102 (or, where applicable, the security platform 122) may perform various checks before taking additional actions with respect to the URL corresponding to ACME-CORE-helper.py at the public server 154. One example of a check is that the data appliance 102 (or, where applicable, the security platform 122) confirms the report that ACME-CORE-helper.py is a non-existing package by making its own request for the URL, rather than relying on analyzing the response to the client 106 (e.g., to ensure that a legitimate, existing publicly available package is not blocked in error). Another example of a check is tracking the number of times requests are made for ACME-CORE-helper.py within the network 140 (or, where applicable, across all networks 114, 116, and 140), and blocking the URL once a threshold number of requests has been reached. Where applicable, the package may be reported to the security platform 122 (e.g., for distribution to other data appliances, and / or for monitoring) by adding the block list of the data appliance.

[0092] It is noteworthy that, according to embodiments of the technology described herein, processing detection of non-existing packages can be used not only to prevent dependency confusion attacks, but also to prevent other types of package name attacks (e.g., spelling phishing and / or combination phishing attacks). As an example, assume that Bob intends to include a public package "graphics-library.py" in the code he is writing, but accidentally calls it "grphics-library.py" (a non-existing package). During the build process, Bob may immediately notice his mistake, correct it, and not make the same mistake again. However, it may also be the case that he (and / or others) habitually mistype non-existing package names. By automatically blocking access to such frequently referenced non-existing packages (either immediately or after a threshold number of attempted accesses has been reached), malicious individuals who later attempt to exploit this tendency to mistype package names will be thwarted.

[0093] 3. Monitoring and Notification

[0094] In various embodiments, the security platform 122 (or the data appliance 102, where applicable) is configured to monitor detected non-existing packages (e.g., by periodically checking whether the corresponding package is eventually added to the public repository). If a state change is detected (i.e., a non-existing package subsequently becomes available), a notification can be sent (e.g., to the data appliance 102, to an administrator of the network 140, and / or other applicable entities). The presence of such a newly available package can indicate various package name attacks, including implemented dependency obfuscation, spelling phishing, or combination phishing. The presence of such a newly available package may also be benign (e.g., because ACME Corporation has chosen to make its internal package public, or because a legitimate developer inadvertently uses the same name as ACME's internal package name for a new public package). Where applicable, the security platform 122 (and / or the data appliance 102) can be configured to receive reports of false positives (i.e., packages that should not / should no longer be blocked) for review / removal from the block list.

[0095] 4. Additional Embodiments

[0096] Some package managers do not obtain metadata on a per-package basis. Examples include RubyGems (gem), Packagist (composer), Debian (aptitude), Fedora (yum), and CocoaPods (pod). These package managers either obtain all metadata at once for a given installer, or obtain it on a per-shard basis. In these situations, the data appliance 102 may not be able to determine whether a given package included in a bundle request is a non-existing package. However, in various embodiments, protection against name attacks using these package managers can be provided through the use of an agent (e.g., an endpoint protection application 132) executing on the developer's client device. In an example implementation, the agent can observe locally which packages the developer attempts to install, and then individually check (or report to the data appliance 102 and / or security platform 122 for inspection) which packages are non-existing.

[0097] The methods described herein can also be adapted to enforce specific resolutions for package name conflicts. As an example, as mentioned above, the default behavior of pip (when a package with a particular name exists on both the internal repository and the public repository) is to install the version with the highest version number. The techniques described herein can be used to determine that there is a conflict (i.e., both repositories have a package with the same name available) and block access to the public repository's copy of the package.

[0098] For reasons such as faster download times or to bypass censorship, developers may choose to download packages from a package registry mirror instead of the official package registry / incorporate packages into their own projects. In these cases, the client behavior remains unchanged (e.g., obtaining package metadata, selecting packages to install from internal / public registries, etc.). Only the package hosting domain name and / or URL for the public registry is different. As an example, the official npm registry is https: / / registry.npmjs.org, and developers can use its public mirrors, such as https: / / registry.npm.taobao.org or https: / / registry.npmmirror.com. Because the client behavior remains the same, the same techniques can help protect users of registry mirrors.

[0099] The mirror list of the package registry can be automatically identified by associating the URL pattern for a given domain name with the URL pattern of the official package registry using popular packages. As an example, according to https: / / pypistats.org / top, the top five (in an embodiment, K) PyPI packages downloaded in September 2022 are boto3, setuptools, urllib3, idna, and botocore. Their metadata URL will be https: / / pypi.python[.]org / simple / $pkg / . The firewall can check the base URL with the pattern $BASE_URL / $pkg / for popular packages. $BASE_URL will be a public mirror that can also be added for monitoring and protection.

[0100] C. Example Process

[0101] Figure 5 An embodiment of a process is illustrated for mitigating attacks based on package names. In various embodiments, process 500 is performed by data appliance 102. In some embodiments, process 500 is performed at least in part by or in cooperation with security platform 122.

[0102] Process 500 begins at 502 when an indication is received that a client device has made a request to a remote server for a package. As an example, the indication is received at 502 when data appliance 102 observes in network traffic that Bob (via the pip client installed on client 106) requests ACME-CORE-helper.py from pypi.org in conjunction with his installation of ACME-CORE.py. As another example, such an indication may be received from an agent executing on Bob's machine when the agent observes Bob requesting a Debian package or other package.

[0103] At 504, an action is performed in response to the indication received at 502. As one example, data appliance 102 may determine whether the request is associated with a blocked URL, and if so, prevent the package from being downloaded from the remote server. As another example, data appliance 102 may determine whether the request is associated with a non-existing package, and if so, take additional action (e.g., confirm whether the package is in fact non-existing, check / update a count of previous requests for the reported non-existing package, add the URL to a block list, and / or report the URL (or other package information) to security platform 122).

[0104] For the action taken at 504, additional actions may also be taken, including taking actions asynchronously. As one example, the data appliance 102 (and / or the security platform 122) may periodically monitor changes in the availability of non-existing packages at the remote server. If a change is detected, one or more alerts (as described above) may be generated. As another example, a URL added to a block list (e.g., a block list associated with the data appliance) may be propagated (e.g., to other data appliances).

[0105] Although the above embodiments have been described in detail for the purpose of clear understanding, the invention is not limited to the details provided. There are many alternative ways to implement the invention. The disclosed embodiments are illustrative rather than restrictive.

Claims

1. A system comprising: The processor is configured to: receiving an indication that the client device has made a request to a remote server for a packet; as well as performing, by the data appliance, an action in response to the received instruction; as well as A memory is coupled to the processor and configured to provide instructions to the processor. 2 . The system of claim 1 , wherein the processor is further configured to determine whether the request for the packet is associated with a non-existing packet. 3 . The system of claim 2 , wherein the non-existing package exists at a local repository and does not exist at the remote server. 4 . The system of claim 2 , wherein the name of the non-existing package is within a predetermined edit distance of the name of another package.

5. The system of claim 2, wherein the name of the non-existing package shares commonality with a name of another package.

6. The system of claim 1, wherein the indication is received in response to matching a regular expression to a URL included in the request.

7. The system of claim 1, wherein the indication is received during inline observation of network traffic.

8. The system of claim 1, wherein the indication is received from an agent installed at the client device.

9. The system of claim 1, wherein performing a responsive action comprises preventing downloading from the remote server.

10. The system of claim 1, wherein performing a responsive action comprises preventing the request from being delivered to the remote server.

11. The system of claim 1, wherein performing a responsive action comprises incrementing a count of the number of times the packet has been requested.

12. The system according to claim 11, wherein: In response to the count exceeding a threshold, the data appliance is configured to block access to the packet.

13. The system of claim 1, wherein performing a responsive action comprises adding a URL associated with the packet to a block list.

14. The system of claim 13, wherein the URL is distributed to another data appliance for blocking by the other data appliance.

15. The system of claim 1, wherein the processor is further configured to receive an alert in response to determining that the remote server has subsequently made a non-existing package available.

16. The system of claim 15, wherein the alarm is provided by an external security system.

17. The system of claim 15, wherein the alert is generated by the data appliance.

18. A method comprising: receiving an indication that the client device has made a request to a remote server for a packet; as well as An action responsive to the received indication is performed by the data appliance.

19. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: receiving an indication that the client device has made a request to a remote server for a packet; and An action responsive to the received indication is performed by the data appliance.

Images