How to stop the “Gradle Snatchers”: Securing your builds from baddies @ Droidcon Lisbon 24

@sp4ghetticode / spght.dev How to stop the “Gradle Snatchers” Securing
your builds from baddies Ed Holloway-George @ Droidcon Lisbon

@sp4ghetticode / spght.dev Who am I? • Lead Android Dev
@ ASOS • Android Google Dev Expert • I like to talk about mobile security a lot • Available on all good social media platforms (and also Twitter) • First talk in Lisbon, thanks for inviting me Introduction

@sp4ghetticode / spght.dev Supply Chain Attacks A quick intro…

@sp4ghetticode / spght.dev Supply Chain Attacks Don’t let it happen
to you!

@sp4ghetticode / spght.dev • Real-world stories • Securing Dependencies •
How to do it via Gradle • Securing Tooling • Securing Gradle wrappers • Securing Gradle distros What we will look at today

@sp4ghetticode / spght.dev Now let’s talk about the elephant in
the room...

@sp4ghetticode / spght.dev

@sp4ghetticode / spght.dev Android & Gradle A timeline… 2008-2012 ‘The
Eclipse Years’ Ant + ADT

@sp4ghetticode / spght.dev Android & Gradle A timeline… 2008-2012 ‘The
Eclipse Years’ Ant + ADT The ‘Dark Ages'

@sp4ghetticode / spght.dev Android & Gradle 2008-2012 ‘The Eclipse Years’
Ant + ADT Fall 2012 ‘New Build Tool’ AGP v0.1 A timeline…

@sp4ghetticode / spght.dev Android & Gradle 2008-2012 ‘The Eclipse Years’
Ant + ADT Fall 2012 ‘New Build Tool’ AGP v0.1 Winter 2014 ‘Initial Release’ AGP v1.0 A timeline…

@sp4ghetticode / spght.dev l 2012 uild Tool’ P v0.1 Winter
2014 ‘Initial Release’ AGP v1.0 2024 Present Day AGP v8.x Android & Gradle A timeline…

2014 ‘Initial Release’ AGP v1.0 2024 Present Day AGP v8.x Android & Gradle A timeline… Winter 2018 ‘A Confusing Dependency’

@sp4ghetticode / spght.dev Márton Braun @zsmb13 A Confusing Dependency…

@sp4ghetticode / spght.dev Márton Braun @zsmb13 A Confusing Dependency… com.example:foo:0.0.1
jitpack.io FROM

@sp4ghetticode / spght.dev Márton Braun @zsmb13 A Confusing Dependency… java.lang.SecurityException:
Permission denied (missing INTERNET permission?) at java.net.Inet6AddressImpl.lookupHostByName(Inet6AddressImpl.java:135) at java.net.Inet6AddressImpl.lookupAllHostAddr(Inet6AddressImpl.java:90) at java.net.InetAddress.getByName(InetAddress.java:743) 💧

@sp4ghetticode / spght.dev ???

@sp4ghetticode / spght.dev Márton Braun @zsmb13 A Confusing Dependency… repositories
{ google() jcenter() maven { url "https://jitpack.io" } } dependencies { implementation ‘com.example:foo:0.0.1’ }

@sp4ghetticode / spght.dev A Confusing Dependency… repositories { google() jcenter()
maven { url "https://jitpack.io" } } dependencies { implementation 'com.example:foo:0.0.1' }

@sp4ghetticode / spght.dev A Confusing Dependency… com.example:foo:0.0.1 repositories { google()
jcenter() maven { url "https://jitpack.io" } } dependencies { implementation 'com.example:foo:0.0.1' } Does not exist

@sp4ghetticode / spght.dev A Confusing Dependency… com.example:foo:0.0.1 repositories { google()
jcenter() maven { url "https://jitpack.io" } } dependencies { implementation 'com.example:foo:0.0.1' } Shouldn’t exist…

@sp4ghetticode / spght.dev Introducing: ‘Fake Wharton’

@sp4ghetticode / spght.dev A Confusing Dependency… jakewhaarton/timber/com.example:foo:0.0.1 repositories { google()
jcenter() maven { url "https://jitpack.io" } } dependencies { implementation 'com.example:foo:0.0.1' }

jcenter() maven { url "https://jitpack.io" } } dependencies { implementation ‘com.example:foo:0.0.1' }

jcenter() maven { url "https://jitpack.io" } } dependencies { implementation 'com.example:foo:0.0.1' }

@sp4ghetticode / spght.dev Long story short…

@sp4ghetticode / spght.dev

@sp4ghetticode / spght.dev Trust no one Original write-up link available
@ spght.dev/talks (Thanks Márton!)

@sp4ghetticode / spght.dev Dependency Verification

@sp4ghetticode / spght.dev Dependency Verification • Are my app’s dependencies
legitimate? 🧐 • Is integrity compromised? • i.e. Are the files the ones we expected? • Is the origin compromised? • i.e. Was it published by the expected author? • a.k.a The ‘provenance’

@sp4ghetticode / spght.dev • Gradle offers a solution for both:
• Checksum Verification • Signature Verification Dependency Verification

@sp4ghetticode / spght.dev Checksum Verification

@sp4ghetticode / spght.dev Checksum Verification Example • Checksum is used
to confirm that a file is unchanged • Common algorithms to use: MD5 / SHA-1 / SHA-256 • MD5 was proved to be broken in late 90s • SHA-1 also proved to be broken in 2017

@sp4ghetticode / spght.dev Checksum Verification Example $ echo "Hello World"
>> example.txt SHA-1 $ shasum example.txt 648a6a6ffffdaa0badb23… SHA-256 $ shasum -a 256 example.txt d2a84f4b8b650937ec8f73…

@sp4ghetticode / spght.dev Gradle Dependency Setup ./gradlew --write-verification-metadata sha256 <task>

@sp4ghetticode / spght.dev Gradle Dependency Setup ./gradlew --write-verification-metadata sha256 {project
root}/gradle/verification-metadata.xml

@sp4ghetticode / spght.dev Gradle Dependency Setup ./gradlew --write-verification-metadata sha256 <verification-metadata>
<configuration> <verify-metadata>true</verify-metadata> <verify-signatures>false</verify-signatures> </configuration> <components>…</components> </verification-metadata> {project root}/gradle/verification-metadata.xml

@sp4ghetticode / spght.dev Gradle Dependency Setup ./gradlew --write-verification-metadata sha256 <components>
<component group="com.jakewharton.timber" name="timber" version="5.0.1"> <artifact name="timber-5.0.1.aar"> <sha256 value="c6edddfc..." origin="Generated by Gradle"/> <sha512 value="37a3e784..." origin="Generated by Gradle"/> </artifact> </component> </components> {project root}/gradle/verification-metadata.xml

@sp4ghetticode / spght.dev How it works… Maven Repo

@sp4ghetticode / spght.dev How it works… <components> <component group="com.jakewharton.timber" name="timber"
version="5.0.1"> <artifact name="timber-5.0.1.aar"> <sha256 value="c6edddfc..." origin="Generated by Gradle"/> <sha512 value="37a3e784..." origin="Generated by Gradle"/> </artifact> </component> </components> .sha256 .sha512 Maven Repo

@sp4ghetticode / spght.dev Reporting issues <components> <component group="com.jakewharton.timber" name="timber" version="5.0.1">
<artifact name="timber-5.0.1.aar"> <sha256 value="ffedddfc..." origin="Generated by Gradle"/> <sha512 value="ffa3e784..." origin="Generated by Gradle"/> </artifact> </component> </components>

<artifact name="timber-5.0.1.aar"> <sha256 value="ffedddfc..." origin="Generated by Gradle"/> <sha512 value="ffa3e784..." origin="Generated by Gradle"/> </artifact> </component> </components> {project root}/gradle.properties org.gradle.dependency.verification.console=verbose

<artifact name="timber-5.0.1.aar"> <sha256 value="ffedddfc..." origin="Generated by Gradle"/> <sha512 value="ffa3e784..." origin="Generated by Gradle"/> </artifact> </component> </components> {project root}/build/reports/dependency-verification

@sp4ghetticode / spght.dev Signature Verification

@sp4ghetticode / spght.dev Signature Verification Example • Public Maven repos
often require signed artifacts • Signed using PGP standard • Developer must create a key-pair • Upload public key to key-server • Sign artifacts and upload to Maven repo

@sp4ghetticode / spght.dev Gradle Dependency Setup ./gradlew --write-verification-metadata sha256,pgp

@sp4ghetticode / spght.dev Gradle Dependency Setup ./gradlew --write-verification-metadata sha256,pgp <verification-metadata>
<configuration> <verify-metadata>true</verify-metadata> <verify-signatures>true</verify-signatures> </configuration> <trusted-keys>…</trusted-keys> </verification-metadata> {project root}/gradle/verification-metadata.xml

@sp4ghetticode / spght.dev Gradle Dependency Setup ./gradlew --write-verification-metadata sha256,pgp <trusted-keys>
<trusted-key id=“47bf5922…” group="com.jakewharton.timber" name=“timber" version="5.0.1"/> </trusted-keys> {project root}/gradle/verification-metadata.xml

@sp4ghetticode / spght.dev How it works… Maven Repo

@sp4ghetticode / spght.dev How it works… .asc Maven Repo timber-5.0.1.aar
timber-5.0.1.aar.asc

@sp4ghetticode / spght.dev How it works…

@sp4ghetticode / spght.dev Dependency Verification The pros… • Gain trust
in your app’s dependencies • Flexible in the type of verification you wish to use Supply chain attacks mitigated • You will sleep a lot easier at night! (and so will I)

@sp4ghetticode / spght.dev The cons… • This is not a
frictionless process • You MUST start with total trust in the dependencies • You could still include compromised dependencies • XML 💩 • Simplest solution: Ship with no dependencies! (Yes, really 😅) Dependency Verification

@sp4ghetticode / spght.dev Repository Filter • Filter what packages can
be fetched from repos • Rules to include and exclude dependencies • Works for dependencies and plugins • Note: Use Gradle 7.0+ (Due to CVE-2021-29427)* * Discovered by Droidcon regular @ZacSweers

@sp4ghetticode / spght.dev Repository Filter repositories { maven { url
"https://jitpack.io" content { // Fetch dependencies includeGroup "com.example" includeModule("com.example", "foo") // Exclude dependencies excludeGroupByRegex("dev\\.spght\\..*") } } }

@sp4ghetticode / spght.dev Repository Filter • Gain trust your dependencies
come from the right source • Ordering issues eliminated • Can easily create simple or complex rulesets • Do not leak dependencies by calling multiple repos * Discovered by Droidcon regular @ZacSweers

2014 ‘Initial Release’ AGP v1.0 2023 Present Day AGP v8.x Android & Gradle A timeline… Winter 2018 ‘A Confusing Dependency’

@sp4ghetticode / spght.dev 014 lease’ 0 2023 Present Day AGP
v8.x Android & Gradle A timeline… Winter 2018 ‘A Confusing Dependency’ Winter 2022 ‘Wrapper Exploit Observed’

@sp4ghetticode / spght.dev Where’s a great place to see hacking
in the wild?

@sp4ghetticode / spght.dev (It’s relevant I promise) • MinecraftOnline.com •
Oldest multiplayer Minecraft Server (2010- present) • 290,000 unique players Background

@sp4ghetticode / spght.dev (It’s relevant I promise) • Minecraft servers
use ‘plugins’ • Plugins are JVM language projects (like Android) • Gradle is the build system used (like Android) Background

@sp4ghetticode / spght.dev Banned Player What happened?

@sp4ghetticode / spght.dev What happened? Totally Legit Player

@sp4ghetticode / spght.dev What happened? Totally Legit Dev-Team Member

@sp4ghetticode / spght.dev What happened? Totally Legit Dev-Team Member Malicious
Commit 😈

@sp4ghetticode / spght.dev What happened? Totally Legit Dev-Team Member

@sp4ghetticode / spght.dev How to prevent this! • First known
public supply-chain attack on the Wrapper • Verification of wrapper’s integrity prevents this • Verification of Gradle binary is a good second step • Hashes of wrapper and distributions available • gradle.org/release-checksums

@sp4ghetticode / spght.dev Gradle Wrapper Verification Verification Script gist.github.com/ed-george/3751d09ccdfd33cfe48d8987d9f68510

@sp4ghetticode / spght.dev Gradle Wrapper Verification Github Action github.com/marketplace/actions/gradle-wrapper-validation

@sp4ghetticode / spght.dev Verifying the Wrapper The pros… • Mega
straightforward • You could probably do it before I finish this talk • Easily slips into most CI pipelines • GitHub users pretty much get it for free

@sp4ghetticode / spght.dev Verifying the Wrapper The cons… • Still
fairly unlikely to be an attack vector • Otherwise, no other cons (that I can think of)!

@sp4ghetticode / spght.dev Verifying the Distribution {project root}/gradle/wrapper/gradle-wrapper.properties distributionUrl=https\://services.gradle.org/distributions/gradle-7.5-bin.zip

@sp4ghetticode / spght.dev Verifying the Distribution {project root}/gradle/wrapper/gradle-wrapper.properties distributionUrl=https\://services.gradle.org/distributions/gradle-7.5-bin.zip distributionSha256Sum=cb87f222c5585bd46838ad4…

@sp4ghetticode / spght.dev Verifying the Distribution ./gradlew wrapper --gradle-version=7.5 \
--gradle-distribution-sha256-sum=cb87f222c…

@sp4ghetticode / spght.dev Verifying the Distribution ./gradlew wrapper --gradle-version=7.5 \
--gradle-distribution-sha256-sum=cb87f222c… Remember: Run this cmd twice!

@sp4ghetticode / spght.dev Verifying the Distribution

@sp4ghetticode / spght.dev Verifying the Distribution The pros… • Guarantees
integrity of your Gradle distro • Simple to setup • Verification is quick

@sp4ghetticode / spght.dev Verifying the Distribution The cons… • Remembering
to update via wrapper command and flag • As well as remembering to call it twice… • Again, not many other cons (that I can think of)!

@sp4ghetticode / spght.dev Verifying the gradlew file (Not yet) •
The gradlew script is also often overlooked • No official process for verifying • Roll your own solution? 😅 • Have thorough PR review processes!

@sp4ghetticode / spght.dev Verifying the gradlew file (Not yet)

@sp4ghetticode / spght.dev Summary

@sp4ghetticode / spght.dev In summary… • Gradle supply-chain attacks are
very rare but do occur • Consider dependency verification • Use repository filtering to ensure the origin • Verify your wrappers • Verify your distribution

@sp4ghetticode / spght.dev I want to learn more… (Perhaps from
someone better?!) • Great talk by Cédric Champeau from Gradle at Devoxx 2019 • Gradle Security documentation • Speak to a nice human from Gradle @ Android Makers

@sp4ghetticode / spght.dev I was asleep/hungover/otherwise absent for this talk
What did I miss? Now also available as a blog!

@sp4ghetticode / spght.dev Droidcon Lisbon 2-for-1 Offer!!! I am talking
again today - 14:20 in this room “How to keep your app’s secret, secret!”

@sp4ghetticode / spght.dev spght.dev/talks For more in-depth Mobile Security talks/blogs

@sp4ghetticode / spght.dev Thanks! spght.dev/talks

@sp4ghetticode / spght.dev EOF spght.dev/talks

How to stop the “Gradle Snatchers”: Securing yo...

How to stop the “Gradle Snatchers”: Securing your builds from baddies @ Droidcon Lisbon 24

More Decks by Ed Holloway-George

Other Decks in Technology

Featured

Transcript