AI Security AI安全 1d ago Updated 11h ago 更新于 11小时前 46

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines SleeperGem利用三个恶意RubyGems包针对开发者机器

SleeperGem is a sophisticated supply chain attack targeting the Ruby ecosystem via three malicious gems: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab. Attackers hijacked dormant accounts and impersonated legitimate tools to deliver loaders that fetch secondary payloads from attacker-controlled Forgejo hosts. The malware specifically avoids CI/CD environments by detecting ephemeral runner variables, ensuring execution only on developer machines for persistent ac SleeperGem 是针对 Ruby 生态系统的供应链攻击,通过三个恶意 Gem 包(git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab)向开发者机器投放载荷。 攻击者利用长期休眠的账户发布恶意更新以规避检测,其中 git_credential_manager 伪装成微软官方工具,并作为依赖项传播给其他五个包。 恶意代码在检测到 CI/CD 环境时自动退出,仅在本地开发机运行,通过下载并执行原生二进制文件建立持久化,甚至尝试提权至 root。 受影响用户需立即将相关机器视为已泄露,清理特定路径

65
Hot 热度
70
Quality 质量
60
Impact 影响力

Analysis 深度分析

TL;DR

  • SleeperGem is a sophisticated supply chain attack targeting the Ruby ecosystem via three malicious gems: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab.
  • Attackers hijacked dormant accounts and impersonated legitimate tools to deliver loaders that fetch secondary payloads from attacker-controlled Forgejo hosts.
  • The malware specifically avoids CI/CD environments by detecting ephemeral runner variables, ensuring execution only on developer machines for persistent access.
  • Advanced persistence mechanisms include installing native daemons, creating systemd services, and exploiting passwordless sudo to plant a setuid root shell.
  • RubyGems is increasingly exploited not just for malware delivery but as a data exfiltration dead drop, highlighting broader risks in package registries.

Why It Matters

This incident demonstrates how attackers leverage trust in established package ecosystems and dormant accounts to bypass security scrutiny, making traditional vigilance insufficient. It highlights the critical need for developers to verify package provenance and monitor for unexpected network connections or file system changes during installation. Furthermore, it underscores the evolving threat landscape where package registries serve dual purposes for both code injection and data theft, requiring comprehensive supply chain security strategies.

Technical Details

  • Malicious Packages: The attack utilizes git_credential_manager (impersonating Microsoft's official tool), Dendreo, and fastlane-plugin-run_tests_firebase_testlab. These were published with versions that had no corresponding commits in their source repositories.
  • Evasion Logic: The initial loader checks for approximately 30 environment variables associated with CI/CD platforms (GitHub Actions, GitLab, Jenkins, etc.). If detected, the process exits immediately to avoid detection in ephemeral environments.
  • Payload Delivery: Upon confirming a local developer environment, the malware downloads a shell script (deploy.sh) and a native binary from git.disroot[.]org/git-ecosystem. Version 2.8.3 of git_credential_manager executes these to establish persistence via cron jobs and systemd user services.
  • Privilege Escalation: If the user has passwordless sudo privileges, the script escalates to root and installs a setuid copy of the system shell at /usr/local/sbin/ping6 to mimic a networking utility.
  • Data Exfiltration Context: Parallel campaigns have used RubyGems as a "dead drop" for stolen credentials (AWS keys, SSH keys, passwords) by packaging them as .gem files and uploading them via compromised browser extensions, leveraging the registry's high traffic to hide malicious uploads.

Industry Insight

  • Account Hygiene is Critical: Dormant accounts are prime targets for takeover because they attract less scrutiny. Maintainers must secure their accounts with MFA and regularly audit permissions, even for inactive projects.
  • Supply Chain Verification: Organizations should implement strict policies requiring verification of package signatures and source code alignment before installation, especially for widely used dependencies like credential managers.
  • Monitoring for Anomalies: Security teams should monitor for unusual outbound network connections from development machines and unexpected file creations in system directories (e.g., /usr/local/sbin) to detect early-stage compromise.

TL;DR

  • SleeperGem 是针对 Ruby 生态系统的供应链攻击,通过三个恶意 Gem 包(git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab)向开发者机器投放载荷。
  • 攻击者利用长期休眠的账户发布恶意更新以规避检测,其中 git_credential_manager 伪装成微软官方工具,并作为依赖项传播给其他五个包。
  • 恶意代码在检测到 CI/CD 环境时自动退出,仅在本地开发机运行,通过下载并执行原生二进制文件建立持久化,甚至尝试提权至 root。
  • 受影响用户需立即将相关机器视为已泄露,清理特定路径下的守护进程和持久化条目,检查 setuid shell,并轮换所有凭证。
  • 近期 RubyGems 还暴露出被用作数据外泄“死信箱”的风险,攻击者通过浏览器扩展窃取敏感数据后打包为 Gem 上传至注册表。

为什么值得看

该事件揭示了针对开源软件包管理器的新型社会工程学和技术结合攻击手法,特别是利用“休眠账户”降低警惕性的策略,对依赖 Ruby 生态的开发者构成直接威胁。同时,RubyGems 被滥用于数据外泄的案例表明,包注册中心正成为攻击者存储和传输窃取数据的隐蔽渠道,亟需加强供应链安全监控。

技术解析

  • 攻击载体与伪装:恶意包 git_credential_manager (v2.8.0-2.8.3) 模仿微软官方 Git Credential Manager;Dendreofastlane-plugin-run_tests_firebase_testlab 则是多年前最后更新的休眠包被劫持。git_credential_manager 被添加为其他五个包的依赖,实现了横向传播。
  • 环境检测与规避:恶意载荷安装后会扫描约 30 个环境变量(如 GitHub Actions, GitLab, Jenkins 等),若识别到 CI/CD 环境则立即退出,确保仅在开发者本地机器执行,以规避沙箱分析和自动化检测。
  • 载荷投递与持久化:版本 2.8.2 仅预加载载荷,2.8.3 进一步执行安装脚本,将二进制文件作为后台守护进程运行。通过 cron 条目和 systemd 用户服务建立持久化,并查询 sudo/wheel 组权限。
  • 提权机制:若用户可免密使用 sudo,脚本将以 root 身份重新运行,并在 /usr/local/sbin/ping6 路径放置一个模仿网络工具的 setuid root shell,实现系统级控制。
  • 数据外泄新范式:另有案例显示,恶意浏览器扩展可将窃取的凭证(密码、SSH 密钥、AWS 凭据等)封装为合法的 .gem 文件,直接上传至 RubyGems.org。此时注册中心不再是分发恶意软件的通道,而是作为攻击者回收数据的“死信箱”。

行业启示

  • 重视休眠账户风险:攻击者倾向于劫持长期无活动但历史可信的开发者账户,因其不易引起怀疑。包注册平台和用户应加强对长时间未更新包的异常版本发布的监控和预警。
  • 强化供应链依赖审计:开发者应定期审查项目依赖树,警惕新增的间接依赖关系。对于核心工具类库(如认证管理器),应严格验证发布者身份和签名,避免盲目信任同名包。
  • 多层面防御策略:除了传统的漏洞扫描,需引入行为检测以识别 CI 环境外的异常进程启动和持久化行为。同时,意识到包注册中心可能被用于数据窃取,需对上传内容进行更严格的合规性审查和数据泄露防护。

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全 Open Source 开源 Research 科学研究