Add supply chain catalog #284

SantiagoTorres · 2019-10-08T20:42:29Z

This is intended to be the starting point of the supply-chain security project.
For discussion about this, see #224

Fix minor issue for Juniper Incident

Add new attacks

- 2019: ShadowHammer - 2019: Dofoil

- Impact section, shadowhammer2019 - Fix typo, dofoil2018

…442755644499a' git-subtree-dir: supply-chain-security git-subtree-mainline: e6cf7b7 git-subtree-split: 90678fb

lumjjb · 2019-10-08T22:07:38Z

I'm thinking that we could create a folder for all similar resources, so as to not end up with a ton of folders at the root level. But this can be done later as well. Not a pressing matter.

SantiagoTorres · 2019-10-09T14:36:37Z

I agree, I can relocate all of this to a subdirectory and then move things around :)

SantiagoTorres · 2019-10-14T19:29:34Z

Hi @lumjjb, I reviewed the directory structure and it appears to me it's reasonable (i.e., supply-chain-security/compromises). Should I move this under a directory called projects instead?

I made a root README that introduces the topic (taking some text from in-toto assessment that I re-wrote for this context) Then moved most of prior README content into /compromises sub-directory, so that the (future) solutions can be separate from the catalog of past compromises.

ultrasaurus · 2019-10-19T23:44:12Z

I submitted a PR for restructuring the README -- reflecting on goals in Supply Chain Security Initiative pre-meeting notes, I tried to capture the two parts

Raise awareness of software supply chain vulnerabilities and the implications.
==> the catalog (as a subdirectory)
Provide best practice guidance and a catalogue of tools to mitigate vulnerabilities
==> future work

I suggest we make the directory top-level for now and refactor into a /projects sub-directory after this and policy PR is merged (https://github.com/cncf/sig-security/pulls) -- then we could put this, policy and assessments into /projects.

I suggest the name of this directory be simply supply-chain since I think security is redundant since it's in the name of the repo (following similar pattern to assessments)

ultrasaurus

see PR for README refactor based on discussion in SIG meeting (I think it was 2019-09-04 though not explicit in notes that we don't intend the catalog to be exhaustive, rather to be useful toward education and coming up with best practices, etc.

also suggest making catalog a flat list of files (for example, instead of 2017/ccleaner.md, just make it 2017-ccleaner.md which I think would make browsing a lot easier)

SantiagoTorres · 2019-10-21T20:40:41Z

Hi @ultrasaurus , I can't seem to find the PR you mentioned. Am I missing something?

supply-chain-security/README.md

lumjjb · 2019-10-22T19:49:02Z

supply-chain-security/compromises/2010/aurora.md

+More than 34 organizations affected, including Symanted, Northrop Grumman,
+Morgan Stanley, Dow chemical, Yahoo, Rackspace, Adobe and Google.
+
+## Type of Compromise


Let's set a good example for caps consistency from contributing guide for our new additions.. I think we need to add a CI for this. Which unfortunately will probably fail for our existing repo :p

lumjjb · 2019-10-22T19:51:30Z

supply-chain-security/compromises/2018/gentoo.md

+
+It seems that the attackers have been able to hack 
+the source code repository but not developer keys.
+


trailing whitespace

supply-chain-security/README.md

ultrasaurus · 2019-10-25T10:28:06Z

@SantiagoTorres I attempted to make a PR against the branch in your fork here: SantiagoTorres#1

proposed refactor of supply chain README

SantiagoTorres · 2019-11-05T21:51:04Z

Hi @lumjjb ! I addressed your comments. I also updated the PR wit some incidents that users submitted.

@ultrasaurus I merged your suggestion, so it's ready for another review.

Thanks!

lumjjb

LGTM!

rficcaglia

love it!

ultrasaurus

see notes on compromises/README.md broken links

ultrasaurus · 2019-11-13T17:50:29Z

supply-chain-security/compromises/README.md

+
+| Name              | Year               | Type of compromise    | Link        |
+| ----------------- | ------------------ | ------------------    | ----------- |
+| [electron-native-notify] | 2019 | Source Code Compromise | [1](https://blog.npmjs.org/post/185397814280/plot-to-steal-cryptocurrency-foiled-by-the-npm)[2](https://komodoplatform.com/update-agama-vulnerability/)|


is [electron-native-notify] supposed to have a link?

ultrasaurus · 2019-11-13T17:52:13Z

supply-chain-security/compromises/README.md

+| Name              | Year               | Type of compromise    | Link        |
+| ----------------- | ------------------ | ------------------    | ----------- |
+| [electron-native-notify] | 2019 | Source Code Compromise | [1](https://blog.npmjs.org/post/185397814280/plot-to-steal-cryptocurrency-foiled-by-the-npm)[2](https://komodoplatform.com/update-agama-vulnerability/)|
+| [ShadowHammer](compromises/2019/shadowhammer.md) | 2019 | Multiple steps | [1](https://www.csoonline.com/article/3384259/asus-users-fall-victim-to-supply-chain-attack-through-backdoored-update.html), [2](https://securelist.com/operation-shadowhammer/89992/) |


broken links: since README is in compromises directory, need to remove compromises/ from links

ultrasaurus · 2019-11-13T17:52:33Z

supply-chain-security/compromises/README.md

+
+| Name              | Year               | Type of compromise    | Link        |
+| ----------------- | ------------------ | ------------------    | ----------- |
+| [electron-native-notify] | 2019 | Source Code Compromise | [1](https://blog.npmjs.org/post/185397814280/plot-to-steal-cryptocurrency-foiled-by-the-npm)[2](https://komodoplatform.com/update-agama-vulnerability/)|


[electron-native-notify] supposed to have a link?

The README.md of supply-chain-security/compromises was adding a compromises prefix to its relative links. This would make the links direct to a 404 rather then the correct location.

ultrasaurus

one more link to fix and then I think we're good to go!

ultrasaurus · 2019-11-14T17:48:31Z

supply-chain-security/compromises/README.md

+| [Monju Incident](2014/monju.md) | 2014    | Publishing infrastructure| [1](https://www.contextis.com/en/blog/context-threat-intelligence-the-monju-incident)
+| [Operation Aurora](2010/aurora.md) | 2010 | Watering-hole attack | [1](https://www.wired.com/2010/03/source-code-hacks/) | 
+| [ProFTPD](2010/proftpd.md) | 2010 | Source Code Repository | [1](https://www.zdnet.com/article/open-source-proftpd-hacked-backdoor-planted-in-source-code/) |
+| [gentoo rsync compromise](2003/gentoo-rsync.md) | 2003 | Source Code Repository[1](https://archives.gentoo.org/gentoo-announce/message/7b0581416ddd91522c14513cb789f17a) |


This line is missing a column separator... I think it should be Source Code Repository | [1]

and 2003/gentoo-rsync.md is a broken link -- looks like the actual file has a typo in filename

SantiagoTorres · 2019-11-14T17:59:30Z

@ultrasaurus thank you! I did a click-test through all the links this time (on gh, rather than locally). It should be ok now...

ultrasaurus

Looks great -- thank you!

root README that introduces the topic (taking some text from in-toto assessment that I re-wrote for this context) additional README for /compromises sub-directory, so that the (future) solutions can be separate from the catalog of past compromises.

SantiagoTorres and others added 30 commits March 27, 2019 14:30

README: add basic structure

58e008b

compromises: add juniper backdoor

537b537

compromises: add aurora

b94a5a8

compromises: add CCleaner

ac7cddc

compromises: add handbrake

2bbe7df

compromises: add kingslayer

7aba492

compromises: add hacktask

d0ac678

compromises: add xcodeghost

0c624de

compromises: add notpetya

234cead

compromises: add bitcoin gold

d893d68

compromises: add expensivewall

265ef7d

compromises: add keydnap

b2d6bc2

compromises: add ceph and inktank

c86bf81

compromises: add elmedia

9d116c0

compromises: add proftpd

298e4e4

README: add a comma bewtween link 1 and 2

3ca00dc

Fix unvalid link for ProFTPD

74872c2

Reorder the attack history

7e7d27a

compromises: add operation-red

052ad2c

compromises: add pear

f7316cf

compromises: add unnamed-maker

48ee34c

compromises: add fosshub

b040519

compromises: add gentoo

4b9ca4d

compromises: add mint

b63efac

Use consistent patterns for attack descriptions

319edac

Fix minor issue for Juniper Incident

compromises: add code-spaces

870e2af

compromises: add monju

c09613b

Merge pull request #1 from hmdfsn/dev

56191b3

Add new attacks

Add new attacks:

f6a17d6

- 2019: ShadowHammer - 2019: Dofoil

Minor updates:

7f00643

- Impact section, shadowhammer2019 - Fix typo, dofoil2018

Add 'supply-chain-security/' from commit '90678fb94c4e5dbca0bc8505366…

638493e

…442755644499a' git-subtree-dir: supply-chain-security git-subtree-mainline: e6cf7b7 git-subtree-split: 90678fb

ultrasaurus requested review from ultrasaurus and lumjjb October 19, 2019 23:48

ultrasaurus suggested changes Oct 20, 2019

View reviewed changes

lumjjb reviewed Oct 22, 2019

View reviewed changes

SantiagoTorres added 4 commits November 5, 2019 16:22

Merge pull request #1 from ultrasaurus/supply-chain-readme

91b6aa7

proposed refactor of supply chain README

supply-chain-security: address comments by @lumjjb

b21588a

sc-security:compromises add electron-native-notify

74729fa

ssc:compromises: add gento-rsync

9b83a28

lumjjb approved these changes Nov 6, 2019

View reviewed changes

rficcaglia reviewed Nov 6, 2019

View reviewed changes

ultrasaurus suggested changes Nov 13, 2019

View reviewed changes

supply-chain-security: fix wrong urls

e395f7c

The README.md of supply-chain-security/compromises was adding a compromises prefix to its relative links. This would make the links direct to a 404 rather then the correct location.

ultrasaurus reviewed Nov 14, 2019

View reviewed changes

SantiagoTorres added 2 commits November 14, 2019 12:54

rename gento-rsync to gentoo-rsync

b2e5ec3

ssc: compromises: consistent spacing of references

1e1a418

compromises: fix missing column separator

3ea2146

ultrasaurus approved these changes Nov 14, 2019

View reviewed changes

Merge branch 'master' into supply-chain-security-project

8e27aa9

ultrasaurus merged commit 20db6ee into cncf:master Nov 14, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add supply chain catalog #284

Add supply chain catalog #284

SantiagoTorres commented Oct 8, 2019

lumjjb commented Oct 8, 2019

SantiagoTorres commented Oct 9, 2019

SantiagoTorres commented Oct 14, 2019

ultrasaurus commented Oct 19, 2019 •

edited

Loading

ultrasaurus left a comment

SantiagoTorres commented Oct 21, 2019

lumjjb Oct 22, 2019

lumjjb Oct 22, 2019

ultrasaurus commented Oct 25, 2019

SantiagoTorres commented Nov 5, 2019

lumjjb left a comment

rficcaglia left a comment

ultrasaurus left a comment

ultrasaurus Nov 13, 2019

ultrasaurus Nov 13, 2019

ultrasaurus Nov 13, 2019

ultrasaurus left a comment

ultrasaurus Nov 14, 2019

SantiagoTorres commented Nov 14, 2019

ultrasaurus left a comment


		It seems that the attackers have been able to hack
		the source code repository but not developer keys.

Add supply chain catalog #284

Add supply chain catalog #284

Conversation

SantiagoTorres commented Oct 8, 2019

lumjjb commented Oct 8, 2019

SantiagoTorres commented Oct 9, 2019

SantiagoTorres commented Oct 14, 2019

ultrasaurus commented Oct 19, 2019 • edited Loading

ultrasaurus left a comment

Choose a reason for hiding this comment

SantiagoTorres commented Oct 21, 2019

lumjjb Oct 22, 2019

Choose a reason for hiding this comment

lumjjb Oct 22, 2019

Choose a reason for hiding this comment

ultrasaurus commented Oct 25, 2019

SantiagoTorres commented Nov 5, 2019

lumjjb left a comment

Choose a reason for hiding this comment

rficcaglia left a comment

Choose a reason for hiding this comment

ultrasaurus left a comment

Choose a reason for hiding this comment

ultrasaurus Nov 13, 2019

Choose a reason for hiding this comment

ultrasaurus Nov 13, 2019

Choose a reason for hiding this comment

ultrasaurus Nov 13, 2019

Choose a reason for hiding this comment

ultrasaurus left a comment

Choose a reason for hiding this comment

ultrasaurus Nov 14, 2019

Choose a reason for hiding this comment

SantiagoTorres commented Nov 14, 2019

ultrasaurus left a comment

Choose a reason for hiding this comment

ultrasaurus commented Oct 19, 2019 •

edited

Loading