arXiv subjects

Felix Boes

Publications and source records attributed to Felix Boes.

3 recordsLinked to original sources

arXiv2023

You Can Run But You Can't Hide: Runtime Protection Against Malicious Package Updates For Node.js

Maliciously prepared software packages are an extensively leveraged weapon for software supply chain attacks. The detection of malicious packages is undoubtedly of high priority and many academic and commercial approaches have been developed. In the inevitable case of an attack, one needs resilience against malicious code. To this end, we present a runtime protection for Node.js that automatically limits a package's capabilities to an established minimum. The detection of required capabilities as well as their enforcement at runtime has been implemented and evaluated against known malicious attacks. Our approach was able to prevent 9/10 historic attacks with a median install-time overhead of less than 0.6 seconds and a median runtime overhead of less than 0.2 seconds.

cs.CR↗

arXiv2022

Computations in the unstable homology of moduli spaces of Riemann surfaces

In this article we give a survey of homology computations for moduli spaces $\mathfrak{M}_{g,1}^m$ of Riemann surfaces with genus $g\geqslant 0$, one boundary curve, and $m\geqslant 0$ punctures. While rationally and stably this question has a satisfying answer by the Madsen-Weiss theorem, the unstable homology remains notoriously complicated. We discuss calculations with integral, mod-2, and rational coefficients. Furthermore, we determine, in most cases, explicit generators using homology operations.

math.AT↗

arXiv2021

Supporting the Detection of Software Supply Chain Attacks through Unsupervised Signature Generation

Trojanized software packages used in software supply chain attacks constitute an emerging threat. Unfortunately, there is still a lack of scalable approaches that allow automated and timely detection of malicious software packages and thus most detections are based on manual labor and expertise. However, it has been observed that most attack campaigns comprise multiple packages that share the same or similar malicious code. We leverage that fact to automatically reproduce manually identified clusters of known malicious packages that have been used in real world attacks, thus, reducing the need for expert knowledge and manual inspection. Our approach, AST Clustering using MCL to mimic Expertise (ACME), yields promising results with a $F_{1}$ score of 0.99. Signatures are automatically generated based on characteristic code fragments from clusters and are subsequently used to scan the whole npm registry for unreported malicious packages. We are able to identify and report six malicious packages that have been removed from npm consequentially. Therefore, our approach can support analysts by reducing manual labor and hence may be employed to timely detect possible software supply chain attacks.

cs.CR↗