Open-source software supply chain attacks are posing significant threats to the banking sector. These attacks exploit vulnerabilities in the software supply chain, compromising the security of banks and their customers. Checkmarx, a leading cybersecurity company, has recently identified the first instances of such attacks, highlighting the need for heightened vigilance and robust security measures within the banking industry.
First Attack: Overview
In February 2023, the first attack targeting banks was initiated. Malicious actors uploaded a package to NPM, a popular repository for JavaScript packages. This attack served as a wake-up call to the banking sector, demonstrating the risks posed by vulnerabilities in the software supply chain.
First Attack: Payload Description
The package uploaded during the first attack contained a payload designed specifically to intercept login data. Once installed on a vulnerable system, the package would discreetly transmit the stolen login information to a remote location, enabling the attackers to gain unauthorized access to sensitive banking accounts.
Second Attack: Overview
Following the first attack, a similar attack pattern emerged in early April 2023. Once again, threat actors utilized the NPM platform to upload packages targeting the banking sector. This repetition reinforces the urgency for banks to fortify their software supply chain against such attacks.
Second Attack: Downloading Malicious Binary
To execute the second attack, the malicious actors employed encrypted files within the NPM packages. These files facilitated the download and installation of a malicious binary onto the victim’s system. Such malware presents a significant risk, as it may grant unauthorized access and control to the attackers.
Subdomain Creation for Evasion
To avoid detection and bypass traditional deny list methods, the attackers cleverly created a subdomain on Microsoft Azure CDN. By utilizing this subdomain, the attackers were able to disguise their activities, making it more challenging for security systems to identify and mitigate the threat promptly.
Utilization of the Havoc Framework
In their quest for comprehensive control, the attackers leveraged the Havoc Framework – an advanced post-exploitation command and control framework. This framework equipped the attackers with sophisticated tools and techniques, amplifying their ability to exploit vulnerabilities and inflict substantial damage within the compromised banking systems.
Checkmarx’s investigation into the attacks revealed a disturbing revelation—a link between the contributor behind the malicious packages and a fake LinkedIn profile. The fake profile masqueraded as an employee of the targeted bank, enabling the attacker to gain credibility and potentially deceive unsuspecting victims or bypass security measures.
The Ongoing Trend
Considering the severity and success of these attacks, Checkmarx predicts a persistent trend of attacks against the banking sector’s software supply chain. Threat actors are increasingly recognizing the potential rewards of exploiting vulnerabilities in this crucial sector. To safeguard against future attacks, banks must remain vigilant and prioritize robust security measures across their software supply chain.
The recent open source software supply chain attacks targeting the banking sector underline the need for heightened security practices within the industry. The identified attacks, which involved uploading malicious packages to NPM, demonstrated the ease with which threat actors can exploit vulnerabilities in the software supply chain. To protect themselves and their customers, banks must invest in comprehensive security measures, including rigorous code review processes, vulnerability assessments, and continuous monitoring. By remaining vigilant and proactive in defending against such attacks, the banking sector can ensure the integrity and security of their software supply chain.