Obfuscation Nation: Detecting Malicious Dependencies at Scale with Static Analysis
Channel: OWASP Foundation
Date: 2024-01-24

Slides: https://static.sched.com/hosted_files/owasp2023globalappsecwashin/93/OWASP%20DC%20Malicious%20Dependencies.pptx

Incidents of malicious dependencies in open source package managers continue to grow in number every year. However, we are not defenseless. Techniques to identify and neutralize malicious packages are also improving, and we add our own static analysis techniques to the mix.

Static analysis has become more accessible in recent years, making it a great tool for inspecting source code with speed and accuracy. By studying the code in malicious packages, combined with our own experience, we developed Semgrep rules for code patterns that are common to malicious packages and uncommon to normal software. We further used static analysis plus package metadata to identify features which, when examined collectively, signal possible inclusion of malicious code into existing packages.

Finally, we discuss how static analysis can speed up auditing third-party software in highly-controlled environments.

Kurt Boberg
Semgrep
Security Research Team

Kurt is a member of the Security Research team at Semgrep, where he currently works on building the next generation of open-source supply chain security tools. Previously he was an AppSec practitioner and team-builder, and in the long, long ago he started his career in what is now considered DevOps. It could be argued that he was DevSecOps before it had a name.

When not working to secure the world's software, Kurt can be found trying to keep dramatic tropical houseplants alive or waiting on parts for his 20 year old Honda.

Managed by the OWASP® Foundation
https://owasp.org/