https://checkmarx.com/blog/surprise-when-dependabot-contributes-malicious-code/ [CHeckmarx-Logo-2][CHeckmarx-Logo-2][checkmarx-lo] * Solutions + Products o Checkmarx One Industry's Most Comprehensive AppSec Platform o Checkmarx SAST Static Application Security Testing o Checkmarx SCA Software Composition Analysis o Checkmarx SCS Supply Chain Security o Checkmarx API Security Secures APIs During Development o Checkmarx DAST Dynamic Application Security Testing o Checkmarx IaC Security Secure Infrastructure as Code o Checkmarx Fusion Scan Results Correlation o Checkmarx Codebashing Secure Code Training o Checkmarx IAST Interactive Code Scanning o KICS Open Source: Infrastructure as Code Project Services o AppSec Services o AppSec Accelerator o AppSec Maturity Assessment o Public Sector o Financial Services o Developer Hub AWS Team AWS and Checkmarx team up for seamless, integrated security analysis. Tell Me More * Why Checkmarx + Why Checkmarx o Developer Experience o Why We're the Right Choice o Customer Stories o Compliance and Certifications o Integrations o Languages We Support Solutions For o Developers o AppSec o Leadership Gartner Report We've been a Leader in the Gartner(r) Magic Quadrant(tm) for Application Security Testing six years in a row. Get the Report * Company + Company o About Us o Culture and Careers (We're Hiring!) o Checkmarx Newsroom o Our Leadership o Investors o Awards and Industry Recognition o Upcoming Events Careers with Checkmarx Help us make code, and the world, safer. It's a job and a mission. Explore Open Roles * Developer Experience * Partners * Careers * Community + Videos + Articles + Comics + Lessons + Tech Blog + Community Events * Resources + Webinars + Ebooks & Whitepapers + Videos + Solution Briefs + Customer Stories + Documentation + All Resources * Blog * Contact + Chat With Us + Call Us + Office Locations + Support Portal + Partner Portal * + Chinese + English + French + German + Japanese + Korean + Spanish * Request a Demo Search [ ] START TYPING AND PRESS ENTER TO SEARCH [ ] * Solutions + Products + Checkmarx One + Checkmarx SAST + Checkmarx SCA + Checkmarx SCS + Checkmarx API Security + Checkmarx DAST + Checkmarx IaC Security + Checkmarx Fusion + Checkmarx CodeBashing + Checkmarx IAST + KICS + Services + AppSec Services + AppSec Accelerator + AppSec Program Methodology + Public Sector + Financial Services + Developer Hub * Why Checkmarx + Why Checkmarx + Developer Experience + Why We're the Right Choice + Customer Stories + Compliance and Certifications + Integrations + Languages We Support + Solutions For + Developers + AppSec + Leadership * Company + Company + About Us + Culture And Careers (We're Hiring!) + Checkmarx Newsroom + Our Leadership + Investors + Awards and Industry Recognition + Upcoming Events * Developer Experience * Partners + Partnering with Checkmarx o Partnership Overview # Reseller Program # MSSP Program o Become a Checkmarx Partner + Technical Partners o AWS o Gitlab o JetBrains o Brinqa o Integration Partners + Find a Partner o Find a Checkmarx Partner + Already a Checkmarx Partner? o Partner Portal o Partner Hub - Learn from other Partners o Partner Academy * Careers * Resources + Webinars + E-books & WhitePapers + Videos + Customer Stories + Solution Briefs + Documentation + Checkmarx University + All Resources * Blog * Contact Us + Chat With Us + Call Us + Office Locations + Support Portal + Partner Portal * Request a Demo * Global + Chinese + English + French + German + Japanese + Korean + Spanish Search Blog Surprise: When Dependabot Contributes Malicious Code * Guy Nachshon By Guy Nachshon * Jossef Harush Kadouri, Tzachi Zornshtain, Aviad Gershon * September 27, 2023 [Case_study] What Happened? * In July 2023, our scanners detected nontypical commits to hundreds of GitHub repositories appear to be contributed by Dependabot and carrying malicious code. * Those commit messages were fabricated by threat actors to appear as a Dependabot automated contribution in the commit history, an attempt to disguise the malicious activity * After reaching out and talking to some of the victims who got compromised, we can confirm that the victims' GitHub personal access token was stolen and used by the attackers to contribute those malicious code contributions. * The malicious code exfiltrates the GitHub project's defined secrets to a malicious C2 server and modify any existing javascript files in the attacked project with a web-form password-stealer malware code effecting any end-user submitting its password in a web form. * This attack also impacted private GitHub organizations repositories as some of the victim's GitHub tokens also had access to. * It is unclear how the victims' personal access tokens were stolen - it may be due to a maliciousopen-source package installed on their PC. * We will elaborate in this blog on the malicious payload and how using GitHub personal access tokens is currently undetectable to most GitHub users. [image-50] About Dependabot Dependabot is GitHub's free automated dependency management tool for software projects. It continuously monitors a project's dependencies (like libraries and packages) for security vulnerabilities and outdated versions. When it detects issues, it automatically generates pull requests with updates, helping developers keep their software secure and up to date. [image-51] A screenshot of dependabot's automatic pull-request from the Flask project The Fake Dependabot Commits Between July 8-11 a threat actor started compromising hundreds of GitHub repositories, both public and private. Most victims are Indonesian user accounts. The attackers used a technique to fake commit messages (read more about how it's done here) to trick developers thinking this was contributed by the real dependabot and to ignore this activity. The attackers created a commit message "fix" appear to be contributed by user account "dependabot[bot]" [image-52] A screenshot of the fake commit, taken from highpolar-softwares/ I-help-privacy-policy repository Malicious Code In the various repositories we analyzed (full list remains internal but it was hundreds of repositories) we saw two groups of repeated code changes, most likely done with an automated script. A New GitHub Action to Steal Secrets New GitHub Action file named "hook.yml" was added as a new workflow file, triggers a code push event. It sends GitHub secrets and variables to URL hxxps://send[.]wagateway.pro/webhook. This action is triggered on every push event [image-53] A screenshot of the malicious commit contributed to highpolar-softwares/I-help-privacy-policy Patching *.js Files to Steal Passwords In addition to the added GitHub Action, the attackers modified every existing project file having the "*.js" extension and append an obfuscated line at the end of the file. This new line is designed to create a new script tag as the code is executed on a browser environment and load an additional script from this URL: hxxps://send[.]wagateway.pro/client.js?cache=ignore. [image-54] A screenshot of the malicious commit contributed to juniorriau/ kejaribiak The code loaded from hxxps://send[.]wagateway.pro/client.js?cache= ignore is attempting to intercept any web-based password form and send the user-credentials to the same exfiltration endpoint as before; URL hxxps://send[.]wagateway.pro/webhook [image-55] A screenshot of the malicious code; designed to steal user-form credentials. How Was It Done? At first it was unclear to us how the attacker's got access to those accounts, especially earlier this year when GitHub raised the bar for mandatory 2FA. To get a better understanding of how this happened, we approached some of the victims by sending an email notifying them of the breach and asking for help understanding the full picture. Luckily, some victims agreed to share information with us, and surprisingly when inspecting the accounts activity we realized that the attackers accessed the accounts using compromised PATs (Personal Access Token) -- most likely exfiltrated silently from the victim's development environment. [image-56] Step 1 - Workspace Initialization The victim must set up their development environment with a personal access token (or SSH/GPG key) identifying their account whenever they make git operations. This token is stored locally on the developer's machine and can be extracted easily. Such access tokens do not require 2FA and can be used to access the account by any computer with internet access. Step 2 - Stealing the Developer's Credentials We can only guess how the attackers got the developers credentials but seeing many cases of malicious packages aiming to perform that task suggest that it is one potential way that the attackers could have gotten their hands on those precious GitHub tokens. We believe the most likely scenario is that the victims were infected with such a malicious package, which exfiltrated the token to the attacker's C2 server. Step 3 - Poisoning the Victim's Code Projects In this step the attackers used the stolen victim's personal access tokens to authenticate to GitHub and make the malicious code changes described above. Analysis of the scale of the attack reveals that it appears to be automated. Conclusion This whole situation teaches us to be careful about where we get our code, even from trusted places like GitHub. It shows that even big platforms can have problems, so we need to always watch out and protect ourselves online. This is the first incident we witnessed a threat actor using fake git commits to disguise activity, knowing that many developers do not check the actual changes of dependabot when they see it. To make things safer, consider switching to GitHub's fine-grained personal access tokens . These tokens allow you to reduce the risk of compromised tokens. So, if someone bad gets one of these keys, they can't do a lot of damage. Sadly, the GitHub's personal access tokens access log activity is only visible for the enterprise accounts. If your token was compromised, you can't know for sure since this information is not visible for non-enterprise users in the audit log section. The attacker's Tactics, Techniques, and Procedures (TTPs) involve the use of fake commits, stealing user credentials, and impersonating Dependabot to avoid detection show us supply chain attacks are getting more sophisticated as attackers realize it doesn't take much to move silently. IOCs: * wagateway[.]pro * hxxps://send[.]wagateway[.]pro/webhook * hxxps://send[.]wagateway[.]pro/client.js Timeline * During 2023 - Attacker attacked victims and harvested personal access tokens (we don't know how it was done and guessing malicious packages were involved) * 2023-07-08 - Attacker used stolen GitHub token in an automated attack, poisoning multiple repositories. * 2023-07-24 - We first noticed this anomaly and began investigating. * 2023-07-24 - Contacted the GitHub accounts infected by this attack + reported to GitHub. * 2023-09-20 - Meeting with one of the victims, reviewed his access logs which helped us understand the attack flow. Facebook Linkedin Twitter Youtube Envelope Facebook Linkedin Twitter Youtube Envelope About the Author Guy Nachshon Guy Nachshon Guy is a Software Engineer and member of the Supply Chain Security engineering group at Checkmarx. With vast skills and engineering experience, he brings invaluable knowledge and skills to the table. Guy is responsible for developing Checkmarx's top notch Software Supply Chain attack detection technology where his deep previous development and security experience with a variety of coding languages comes into play. See All Blogs > Guy Nachshon Guy Nachshon Guy is a Software Engineer and member of the Supply Chain Security engineering group at Checkmarx. With vast skills and engineering experience, he brings invaluable knowledge and skills to the table. Guy is responsible for developing Checkmarx's top notch Software Supply Chain attack detection technology where his deep previous development and security experience with a variety of coding languages comes into play. See All Blogs > About the Author Never miss an update. Subscribe today! By submitting my information to Checkmarx, I hereby consent to the terms and conditions found in the Checkmarx Privacy Policy and to the processing of my personal data as described therein. By clicking submit below, you consent to allow Checkmarx to store and process the personal information submitted above to provide you the content requested. [ ] Sign up [ ] Sign up More Resources to Consider [Case_study] Surprise: When Dependabot Contributes Malicious Code Surprise: When Dependabot Contributes Malicious Code * September 27, 2023 [MicrosoftTeams-image-14] Checkmarx Named a Leader in the 2023 Forrester Wave(tm) for Static Application Security Testing Checkmarx Named a Leader in the 2023 Forrester Wave(tm) for Static Application Security Testing * September 20, 2023 [AWS-S3-Bucket-Security-Research-blog] Attacker Unleashes Stealthy Crypto Mining via Malicious Python Package Attacker Unleashes Stealthy Crypto Mining via Malicious Python Package * September 19, 2023 [Service-Now-_-Checkmarx-Integration-blog_Brinqa-Announcement-blog-2] Find and prioritize application vulnerabilities with ServiceNow and Checkmarx Find and prioritize application vulnerabilities with ServiceNow and Checkmarx * September 14, 2023 Contact Us Interested in learning more about our unified platform and services? Get in touch with a member of our team. Request a Demo Learn More [footer-ornament-1] Solutions * Industry's Most Comprehensive AppSec Platform * Static Application Security Testing * Software Composition Analysis * Supply Chain Security * Secure APIs During Development * Dynamic Application Security Testing * Secure Infrastructure as Code * Scan Results Correlation * Secure Coding Education and Training * Interactive Application Security Testing * Open-Source Infrastructure as Code Project * Checkmarx Fusion * Industry's Most Comprehensive AppSec Platform * Static Application Security Testing * Software Composition Analysis * Supply Chain Security * Secure APIs During Development * Dynamic Application Security Testing * Secure Infrastructure as Code * Scan Results Correlation * Secure Coding Education and Training * Interactive Application Security Testing * Open-Source Infrastructure as Code Project * Checkmarx Fusion Industry * Public Sector * Financial Services * Public Sector * Financial Services Solutions For * Developers * AppSec Managers * Leadership * Developers * AppSec Managers * Leadership Services * AppSec Services * AppSec Accelerator * AppSec Maturity Assessment * AppSec Services * AppSec Accelerator * AppSec Maturity Assessment Partners * Partner Program * Find a Partner * Managed Security Service Provider (MSSP) * Partner Program * Find a Partner * Managed Security Service Provider (MSSP) Company * Developer Experience * Why Checkmarx * Integrations and Frameworks * Languages * Trust * About Us * Newsroom * Checkmarx Leadership * Board of Directors * Investors * Careers * Awards * Contact Us * Sitemap * Developer Experience * Why Checkmarx * Integrations and Frameworks * Languages * Trust * About Us * Newsroom * Checkmarx Leadership * Board of Directors * Investors * Careers * Awards * Contact Us * Sitemap Resources * Customer Stories * Blog * Technical Blog * Glossary * Customer Stories * Blog * Technical Blog * Glossary Community * Developer Hub * Developer Hub Linkedin Twitter Youtube Facebook Terms of Use | Checkmarx Privacy Policy | Checkmarx.com Cookie Policy (c)2023 Checkmarx Ltd. All Rights Reserved. iISO/IEC 27001:2013 Certified * This site uses cookies to offer you a better experience of the site. Find out more in our Cookie Policy. I Accept Reject All Manage consent Close Privacy Overview This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience. Necessary [*] Necessary Always Enabled Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously. Cookie Duration Description This cookie is set by GDPR Cookie Consent 11 plugin. The cookie is cookielawinfo-checkbox-analytics months used to store the user consent for the cookies in the category "Analytics". The cookie is set by GDPR 11 cookie consent to record cookielawinfo-checkbox-functional months the user consent for the cookies in the category "Functional". This cookie is set by GDPR Cookie Consent 11 plugin. The cookies is cookielawinfo-checkbox-necessary months used to store the user consent for the cookies in the category "Necessary". This cookie is set by GDPR Cookie Consent cookielawinfo-checkbox-others 11 plugin. The cookie is months used to store the user consent for the cookies in the category "Other. This cookie is set by GDPR Cookie Consent 11 plugin. The cookie is cookielawinfo-checkbox-performance months used to store the user consent for the cookies in the category "Performance". The cookie is set by the GDPR Cookie Consent 11 plugin and is used to viewed_cookie_policy months store whether or not user has consented to the use of cookies. It does not store any personal data. Functional [ ] Functional Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features. Performance [ ] Performance Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors. Analytics [ ] Analytics Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc. Advertisement [ ] Advertisement Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads. Others [ ] Others Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet. SAVE & ACCEPT Skip to content Open toolbar Accessibility * Increase Text * Decrease Text * Grayscale * High Contrast * Negative Contrast * Light Background * Links Underline * Readable Font * Reset