P345 - Sicherheit 2024 - Sicherheit, Schutz und Zuverlässigkeit

Auflistung nach:

1 - 1 von 1

Konferenzbeitrag
You Can Run But You Can’t Hide: Runtime Protection Against Malicious Package Updates For Node.js
(Sicherheit 2024, 2024) Pohl, Timo; Ohm, Marc; Boes, Felix; Meier, Michael
Malicious software packages are often used in software supply chain attacks. Detecting these packages is a top priority, and there have been many academic and commercial approaches developed for this purpose. In the event of an attack, it is essential to have resilience against malicious code. To address this issue, we introduce a runtime protection for Node.js that automatically limits the capabilities of packages to a minimum level. The implementation and evaluation of the detection and enforcement of necessary capabilities at runtime was conducted against known malicious attacks. Our approach successfully prevented 90 % of historical attacks with a median install-time overhead of less than 0.6 seconds and a median runtime overhead of less than 0.2 seconds.