Containing Malicious Package Updates in npm with a Lightweight Permission System
Containing Malicious Package Updates in npm with a Lightweight Permission System
复制标题
DOI：
10.1109/icse43902.2021.00121
复制
发表时间：
2021-03
期刊：
影响因子：
--
通讯作者：
G. Ferreira;Limin Jia;Joshua Sunshine;Christian Kästner
中科院分区：
文献类型：
--
作者：
G. Ferreira;Limin Jia;Joshua Sunshine;Christian Kästner
在快速发展的软件生态系统中，大量的第三方软件包（如Node.js/npm）使攻击者能够通过将恶意更新推送到其软件包依赖关系中来危害应用程序。通过研究npm存储库，我们发现Node.js应用程序中使用的npm存储库中的许多包只执行简单的计算，不需要访问文件系统或网络API。这提供了对每个包强制执行最小特权设计的机会，从而保护应用程序和包依赖项免受恶意更新的影响。我们提出了一个轻量级的权限系统，通过在运行时强制执行包权限来保护Node.js应用程序。我们讨论了解决方案的设计空间，并表明我们的系统使得大量的软件包更难被利用，几乎是免费的。
The large amount of third-party packages available in fast-moving software ecosystems, such as Node.js/npm, enables attackers to compromise applications by pushing malicious updates to their package dependencies. Studying the npm repository, we observed that many packages in the npm repository that are used in Node.js applications perform only simple computations and do not need access to filesystem or network APIs. This offers the opportunity to enforce least-privilege design per package, protecting applications and package dependencies from malicious updates. We propose a lightweight permission system that protects Node.js applications by enforcing package permissions at runtime. We discuss the design space of solutions and show that our system makes a large number of packages much harder to be exploited, almost for free.