Malicious Go Package Backdoor Remains Undetected for Over Three Years

In a significant software supply chain security incident, a malicious Go package impersonating the widely-used BoltDB database module remained undetected for more than three years, potentially compromising numerous systems.

Discovery of the Malicious Package

Security researchers from Socket Security uncovered a backdoored typosquat of the BoltDB package. The legitimate BoltDB, hosted at github.com/boltdb/bolt, is a popular key/value store for Go. The malicious actor created a similarly named package at github.com/boltdb-go/bolt, aiming to deceive developers into downloading the compromised version.

Mechanism of the Attack

The attacker exploited Go's module proxy caching mechanism. After publishing the malicious package, it was cached by the Go Module Mirror service, which stores modules indefinitely to enhance reliability. Subsequently, the attacker altered the Git tags in the repository to point to a clean version, making manual inspection appear benign. However, developers fetching the package via the Go Module Proxy continued to receive the cached malicious version, facilitating persistent distribution of the backdoored code.

Impact and Implications

The backdoored package contained a backdoor that enabled remote code execution, allowing attackers to execute arbitrary commands on infected systems. While the exact number of affected developers is unclear, the incident underscores the risks associated with typosquatting and the challenges posed by immutable caching mechanisms in package management systems.

Recommendations for Developers

To mitigate such risks, developers are advised to:

• Verify package names and sources carefully before inclusion in projects.
• Regularly audit dependencies for any unauthorized or suspicious changes.
• Utilize security tools designed to detect malicious packages and typosquatting attempts.

Staying vigilant and implementing robust security practices are essential to safeguard against supply chain attacks in the software development ecosystem.

Sources

• Researcher sniffs out three-year Go supply chain attack - The Register
• A cracked malicious version of a Go package lay undetected online for years - TechRadar
• Go Module Mirror served backdoor to devs for 3+ years - Ars Technica
• Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching for Persistence - Socket Security