Photo credit: arstechnica.com
A proxy service operated by Google for developers of the Go programming language hosted a compromised package for over three years before its removal on Monday. This denotes a significant vulnerability within the ecosystem, as researchers had previously alerted the service to the presence of malicious code on two occasions.
The platform, referred to as the Go Module Mirror, is designed to cache open source packages sourced from GitHub and other repositories. This functionality not only accelerates download speeds but also ensures compatibility across the Go ecosystem. By default, any command-line requests made to download or install packages are channeled through this service. The proxy is advertised as a product of the Go team, operated by Google.
Exploiting Cache Vulnerabilities
Since November 2021, the Go Module Mirror has been serving a backdoored variant of a popular module. According to a report by the security firm Socket released on Monday, the malicious package utilized “typosquatting” tactics. This technique involves deceptively naming harmful files in a manner closely resembling that of widely recognized legitimate files. Consequently, if a user miskeys or slightly alters the correct filename during a download attempt, they unwittingly retrieve the malicious package instead.
The nefarious module was labeled boltdb-go/bolt, a variant of the highly popular boltdb/bolt package, which is essential for the functioning of 8,367 other packages. The malicious version first emerged on GitHub before it was reverted to its authentic state. However, by that stage, the Go Module Mirror had already cached the compromised iteration, effectively preserving it for three additional years.
“The effectiveness of this attack hinged on the structure of the Go Module Proxy service, which emphasizes caching for enhanced performance and accessibility,” the researchers from Socket noted. “Once a module version is cached, it remains retrievable via the Go Module Proxy, regardless of modifications made to the original source later on. Although this design is advantageous for legitimate applications, it also creates an avenue for threat actors to consistently distribute malicious code, undeterred by updates to the repository.”
Source
arstechnica.com