AppVeyorBYOC

Problem

Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. System security settings are the first line of defense against the most common attack vectors. For that reason, attackers often aim to tamper with system security settings. Disabling User Access Controls (UAC) and other security settings enables malicious code to execute without being blocked. While the presence of code that tampers with system security settings does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with system security settings. One example of acceptable use for such functions is allowing specialized applications to install as services that monitor the operating system events.

Problem

Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. Operating systems integrate first and third-party security solutions that can detect and block malicious code. For that reason, attackers often aim to tamper with system security software. Changing antivirus and other security software service settings may enable malicious code to execute without being blocked. While the presence of code that tampers with system security software does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that can temporarily disable system security features. One example of acceptable use for such functions is allowing specialized applications to modify protected folders and settings.

Problem

Operating systems execute application code in multiple privilege access levels. Separation of privileges is designed to protect the stability and integrity of the operating system by shielding it from issues that the user run applications may cause. However, some users may need to interact with higher privilege parts of the operating system to accomplish specific tasks. For this purpose, operating systems provide facilities that users may leverage to temporarily elevate their running privileges. Users with higher privileges can run any application with the same privilege level as their own. Attackers often try to trick privileged users into running malicious code, enabling them to infect the operating system. While the presence of code that elevates user privileges does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that can elevate user privileges. One example of acceptable use for such functions is allowing the users to install software packages and updates.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing services URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverages the GitHub service to deliver malicious payloads.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign, some are commonly abused by malicious software with the intent to cause harm. When a software package shares behavior traits with malicious software, it may become flagged by security solutions. Any detection from security solutions can cause friction for the end-users during software deployment. While the behavior is likely intended by the developer, there is a small chance this detection is true positive, and an early indication of a software supply chain attack.

Problem

Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. System certificate stores are databases that define the chain of trust for a machine. These databases control the list of websites the machine can securely connect to, and the list of applications that the operating system implicitly trusts. For that reason, attackers often abuse system certificate stores to ensure their malicious code executes without being detected by security solutions. While the presence of code that tampers with system certificate stores does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with system certificate stores. One example of acceptable use for such functions is adding publisher certificates to the system trust store during software installation.

Problem

Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. Operating systems include a complete network stack with many services that allow the machine to connect to the internet. Some of these services are used to secure network access. For that reason, attackers often aim to tamper with system network settings. Disabling firewalls and other network security features enable the malicious code to execute without being blocked. While the presence of code that tampers with system network settings does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with system network settings. One example of acceptable use for such functions is allowing specialized applications to use non-standard network ports by updating the firewall allowlist.

Problem

Operating systems provide multiple integration points for applications to insert themselves in the system startup sequence. Startup sequence is executed in its entirety each time the computer system powers on. For that reason, attackers typically try to register their malicious code in the system startup sequence. When malicious code is registered to start with the operating system, it achieves persistence, as it becomes permanently installed. While the presence of code that modifies the system startup sequence does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only applications that require constant background operation should consider installing themselves as a part of the startup sequence. One exemption to this recommendation would include running the application after the first system reboot to complete the software installation.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community. it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of using components that are rarely used to build applications lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Problem

Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. Machine power settings are high privilege functions that can change the power state of the device. This includes the ability to reboot and shutdown computer systems. Attackers often abuse machine power settings to force a system reboot, upon which malicious code can infect the system and gain persistence. While the presence of code that tampers with machine power settings does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with the machine power state. One example of acceptable use for such functions is prompting users to reboot their system during complex software installations.