January 2023 Summaries

GitHub's recent update to its compression algorithm for release files led to changes in software checksums, causing widespread issues in software supply chains reliant on GitHub releases, such as Homebrew and Bazel. This disruption highlighted the delicate balance between security and productivity, as integrity checks failed, prompting some development teams to disable them, which in turn decreased trust in security controls. The incident underscores the need for secure, yet user-friendly, supply chain processes, as developers often prioritize convenience over security when faced with complex security measures. Although GitHub provides methods for verifying package integrity, these require additional work from developers, which may not be feasible for all open-source communities. The situation emphasizes the importance of making security measures accessible and straightforward to ensure they are consistently adopted, thereby reinforcing the interconnected nature of modern software ecosystems.

Open source licensing plays a pivotal role in software development, allowing developers to share their work while protecting their rights. It encompasses various licenses, mainly categorized as permissive, like the MIT License, which imposes minimal restrictions, and restrictive, like the GPL License, which requires any modifications to be released under the same license. Understanding these licenses is essential as they dictate how software can be used, modified, and distributed. For instance, permissive licenses like the MIT allow for commercial use without releasing modifications, whereas restrictive licenses like the GPL mandate that derivative works remain open-source. Effective license management, often aided by software tools, ensures compliance with these terms, enabling organizations to leverage the benefits of open source technology while mitigating risks.

VEX, or Vulnerability Exploitability Exchange, is a system that enables software producers to share assessments of vulnerabilities within their software components with consumers, providing a standardized format to describe vulnerabilities, their severity, and potential exploitability. VEX documents improve upon traditional security advisories by being machine-readable, facilitating integration into workflows, and allowing producers to communicate their due diligence regarding vulnerabilities. When used in conjunction with a Software Bill of Materials (SBOM), which lists all software components and their versions, VEX provides context about whether vulnerabilities impact the application, thus aiding organizations in addressing vulnerabilities more efficiently. This process, often manual and time-consuming, can be automated through tools like Endor Labs, which use static analysis to determine code reachability and generate comprehensive SBOM and VEX documents. These documents help security managers quickly assess vulnerability criticality, make informed decisions on actions such as patching, and maintain effective vulnerability management.

The author describes their experience developing a prototype using Go to detect risky packages from real-time repository feeds, leading to the discovery of a malicious Python package named Whatfuscator. This package, which downloads and executes a Windows executable, is part of a common pattern of attacks that leverage simple, often reused code snippets for initial infections, akin to spam emails. The low effort required to create and publish such packages encourages attackers to continue their efforts, despite the presence of detection mechanisms. The author advocates for enhanced detection tools that leverage dataflow analysis and suggests that public repositories should conduct malware scans before publication to reduce exposure. They also highlight the importance of balancing false-positive and false-negative detection rates, noting the challenge of detecting more sophisticated attacks that subtly alter legitimate code. The text emphasizes the role of startups, open-source communities, and regulatory bodies in addressing software supply chain security, expressing hope that current investments will eventually lead to the detection of even the most advanced attacks.

Open-source software supply chain attacks, which involve injecting malicious code into open-source projects, have become increasingly common, with attackers employing techniques like typosquatting and dependency confusion. To address this, a comprehensive taxonomy was developed in 2021 by Piergiorgio Ladisa and his colleagues, offering a technology-agnostic overview of attack vectors. This taxonomy, structured as an attack tree with over 100 nodes, aims to systematically classify these attacks and enhance understanding of the threat landscape. The taxonomy is accompanied by the Risk Explorer tool, which provides an interactive visualization of attack vectors to facilitate education, threat modeling, and risk assessment. This tool is open-sourced and hosted by SAP, with contributions from Endor Labs, and is continuously updated to remain relevant amidst evolving threats. The taxonomy and Risk Explorer have been presented at various conferences and are intended to be part of broader industry efforts to secure software supply chains.

Endor Labs, a company specializing in helping enterprises efficiently and securely use open source software (OSS) without incurring high maintenance costs, has partnered with Intuitive.Cloud, a leader in cloud solutions, as both an investor and strategic partner. This collaboration aims to assist security and development teams in leveraging OSS safely and cost-effectively. The announcement follows Endor Labs' recent $25 million seed funding led by prominent investors including Lightspeed Venture Partners and Dell Technology Capital, along with support from industry leaders across major tech companies. With a focus on Dependency Lifecycle Management™, Endor Labs seeks to optimize OSS adoption by reducing security issues and enhancing development speed, drawing on the expertise of leading engineers and academics. Intuitive.Cloud, known for delivering cloud and cybersecurity solutions on a global scale, views Endor Labs as a disruptive force in OSS security, aligning with their shared mission to bolster developer productivity without compromising security.