In a significant cybersecurity breach, North Korean hackers have orchestrated an attack on the open source software (OSS) supply chain, specifically targeting the Rust programming environment. This incident, reported by cybersecurity firm Wiz, highlights vulnerabilities within widely used software ecosystems.
Targeted Rust Crates Compromised
The attack unfolded on August 20, impacting arrayref, a highly popular Rust crate utilized for array conversions. This crate boasts over 245 million downloads and is prevalent in approximately 75% of Rust environments. The compromised version, [email protected], was deceptively uploaded to crates.io, the official Rust package registry, from the legitimate maintainer’s account.
Shortly after this initial breach, altered versions of two additional crates, internment and append-only-vec, were released from the same developer’s account. These, along with several attacker-owned crates such as aovine and tinymember, incorporated a malicious dependency masquerading as the genuine proc-macro2 package.
Malicious Code and Response
Within the malicious package, a file named build.rs was embedded, designed to retrieve a harmful binary over TLS, circumventing certificate validation. The Rust Security Response Team swiftly intervened, removing the compromised packages within 86 minutes and restoring clean versions. They confirmed the exploit involved a new arrayref version with a dependency on proc-macro1, executing a harmful build script.
Despite the swift response, the security team found no indications of the malicious packages being deployed in active environments. Investigations suggest that the arrayref maintainer’s credentials might have been compromised, and efforts are underway to contact them.
Perpetrator and Implications
Wiz attributes the attack to the North Korean threat actor group Sapphire Sleet, previously linked to notable NPM supply chain attacks earlier this year. Evidence includes overlapping infrastructure and command-and-control (C&C) traffic consistent with past incidents.
The attack’s sophistication underscores the need for vigilant security practices within open source ecosystems. It highlights the potential for supply chain vulnerabilities to be exploited by state-sponsored groups, posing significant risks to global software security.
As the cybersecurity community continues to address these threats, the Rust incident serves as a cautionary tale for developers and organizations relying on open source software.
