GitHub Warns Java Developers of New Malware Poisoning NetBeans Projects (zdnet.com) 45
GitHub issued a security alert Thursday warning about new malware spreading on its site via boobytrapped Java projects, ZDNet reports:
The malware, which GitHub's security team has named Octopus Scanner, has been found in projects managed using the Apache NetBeans IDE (integrated development environment), a tool used to write and compile Java applications. GitHub said it found 26 repositories uploaded on its site that contained the Octopus Scanner malware, following a tip it received from a security researcher on March 9.
But the article adds GitHub "believes that many more projects have been infected during the past two years." GitHub says that when other users would download any of the 26 projects, the malware would behave like a self-spreading virus and infect their local computers. It would scan the victim's workstation for a local NetBeans IDE installation, and proceed to burrow into the developer's other Java projects. The malware, which can run on Windows, macOS, and Linux, would then download a remote access trojan (RAT) as the final step of its infection, allowing the Octopus Scanner operator to rummage through an infected victim's computer, looking for sensitive information.
GitHub says the Octopus Scanner campaign has been going on for years, with the oldest sample of the malware being uploaded on the VirusTotal web scanner in August 2018, time during which the malware operated unimpeded.
But the article adds GitHub "believes that many more projects have been infected during the past two years." GitHub says that when other users would download any of the 26 projects, the malware would behave like a self-spreading virus and infect their local computers. It would scan the victim's workstation for a local NetBeans IDE installation, and proceed to burrow into the developer's other Java projects. The malware, which can run on Windows, macOS, and Linux, would then download a remote access trojan (RAT) as the final step of its infection, allowing the Octopus Scanner operator to rummage through an infected victim's computer, looking for sensitive information.
GitHub says the Octopus Scanner campaign has been going on for years, with the oldest sample of the malware being uploaded on the VirusTotal web scanner in August 2018, time during which the malware operated unimpeded.
Project maintainers (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Our chief data security officer has been down on Java for a while, cranking up the security restrictions on Java-based applications so high as to make many of them unusable. This won't help change his opinion.
However, I'm not convinced the alternatives are more reliable, except perhaps Microsoft has a better update & patch infrastructure in place because they are so ubiquitous that they have to.
Re: (Score:2)
I think the biggest problem with Java is the fact it kind of lost all top level maintenance for almost 2 decades so far. When Sun still owned it it was probably about the most secure at nearly everything it did.
If anything, we should be looking to other similar tools to gain similar problems in the near future, as some of these attacks seem to start with Java and then branch out to other technologies that could be similarly affected (like MS Build say).
As to judging, I wholeheartedly agree, Java is certain
Re: (Score:3)
This, however, is not a Java specific type of attack. Anything that auto-loads code from a remote repository is susceptible. And that's becoming an increasingly common method of development. Languages that I can think of that use that approach include Javascript, perl, rust, and go. Some of them have mitigation tools, but I've never studied how effective those are as I just want to avoid the process.
The advantage, of course, is that a library can have it's bugs fixed without the end user intervention.
Re: (Score:2)
Any external library or framework is suspect.
One of the problems today is that there's a huge amount of libraries and frameworks out there so just target a few for malware added piece by piece. Even better if that malware also offers functionality that actually do what it says because then it can be undetected for a long time. A good malware is working slowly behind the scenes - like the "telemetry" in Windows.
Re: (Score:2)
Re: (Score:2)
Good points though!
The actual skill of programming seems to be a declining art - and what happens when those that created the frameworks moves on to greener pastures?
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
It also only works on projects that use the Netbeans specific build system, not on Maven or Gradle projects. That rules out most java projects. So I doubt it infects projects using C, C++, PHP or any of the other languages supported by Netbeans.
Re: (Score:1)
Does GitHub run malware scans on all repos? (Score:1)
Re: (Score:3)
Github faithfully notifies me if one of my repositories includes a library/framework/etc. for which a significant security vulnerability has been reported. That's not true for every language, but it's true for my Python, Ruby, and Javascript projects... I don't think I've have gotten one for my Elixir projects. Pretty sure they don't scan BLOBs for malware— but I imagine that's a pretty obscure edge case. Something like source code heuristics scanning would probably be an insanely complex undertaking,
Re: (Score:2)
*effective
It affects the project files (Score:5, Insightful)
Re:It affects the project files (Score:4)
Re: (Score:2)
+1 to parent. ANY commit change to most of these files would be highly unusual to begin with.
In fact, often they might not be needed in a project at all if they can be regenerated by the IDE, though some of these files are required when a new project is created. On new project creation this type of problem sounds like it would be incredibly difficult to notice.
Re: (Score:2)
Each time you add, remove or rename a source file or you change a project setting some project metadata is updated.
Re: (Score:2)
Or you can replace the entire branch and history with a completely historically independent repository branch. "git push :master" is a permitted operation for most repositories, which do not track history well enough to notice the insertion of security violating debris in the history. It's one of the issues of git's willngness to allow deletion of history.
Re: (Score:2)
The type of project this malware targets uses the Netbeans build system. You need those file to be able to build the project in the first place, so they have to be in the repository. This is comparable to infecting the pom.xml of a Maven project, or the gradle build files.
That said, this could be made to work just fine on Gradle, since Gradle build scripts are also executed scripts. Making this work for Maven projects is probably a lot harder, since the pom.xml of Maven is not a script. For Maven the malwar
Re: (Score:2)
Re: (Score:2)
"How can a committer know it's malicious or not?"
If it's not a change intentionally made by the committer, why would the committer commit that change?
"Self-spreading virus" (Score:2)
Doesn't that make it a worm?
Re: (Score:2)
Re: (Score:2)
bacterial infection*
Re: (Score:2)
An evil caffeine molecule is my bet.
Re: (Score:2)
A virus needs to attach to a computer program (like netbeans) to propogate. A worm doesn't need to do that and may spread all on it's own.
I also recall worms being stated as having multiple infection vectors, but not finding that in searches at the moment.
People still use NetBeans? (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Re: (Score:3)
Because the Oracle licensing have infected it.
Does NetBeans (Score:1)
cause gas?
Apache response (Score:1)