July 2023 Summaries

The text discusses the challenges and methodologies in evaluating and prioritizing software vulnerabilities, emphasizing the need for effective risk management over complete eradication of vulnerabilities. It critiques the Common Vulnerability Scoring System (CVSS) for its limitations in accurately reflecting the severity and risk of vulnerabilities, noting its continued use despite these issues. The Known Exploited Vulnerabilities (KEV) catalog by CISA, though useful for identifying actively exploited vulnerabilities, is critiqued for its binary nature and lack of transparency. The Stakeholder-Specific Vulnerability Categorization (SSVC) offers a structured decision-making tool but faces challenges in vagueness and subjectivity. The Exploit Prediction Scoring System (EPSS) is highlighted as a promising approach for predicting the likelihood of exploitation, though it lacks customization and impact assessment. Reachability analysis is presented as an advanced method for prioritization by evaluating the real-world applicability of vulnerabilities in specific software contexts. The text concludes that a combination of these methodologies, excluding CVSS, can provide a clearer risk picture for security teams.

Malicious packages on open source repositories like PyPI and npm often contain simple, easily detectable code, but a new variant demonstrates more sophisticated obfuscation tactics by spreading harmful functions across different files and packages. The malware, which aims to hijack Instagram accounts by extracting session identifiers from Chrome cookies on Windows, uses divided code to make detection harder. Key functions are distributed without declaring dependencies, complicating detection efforts and necessitating a comprehensive analysis of all files and packages together, which is resource-intensive compared to simple pattern searches. This sophisticated evasion technique highlights the ongoing arms race between attackers and defenders in cybersecurity, demonstrating how adversaries continually evolve to bypass detection systems. Despite these efforts, the packages gisi and ttlo, uploaded on April 16th and removed on July 7th, achieved relatively high download numbers due to the complexity of their obfuscation methods, underlining the challenges in effectively policing open source repositories.

Software supply chain security has become increasingly complex, especially with the growing reliance on open-source code, which forms up to 80% of modern applications. The Endor Labs' inaugural report, led by Henrik Plate, delves into the intricacies of selecting, securing, and maintaining open-source dependencies, emphasizing that most vulnerabilities (95%) are found in transitive dependencies, complicating developers' assessments of their impact. The report highlights the challenges in determining critical projects and the potential security risks associated with dependency confusion and outdated packages, noting that new versions are not always secure, with a 32% chance of known vulnerabilities. The rapid integration of AI technologies, such as ChatGPT's API, into numerous packages further emphasizes the need for due diligence in package selection to mitigate risks. The research underscores the importance of understanding not only which components are used within applications but also their potential vulnerabilities, advocating for comprehensive documentation through Software Bill of Materials (SBOM). Plate's work, including initiatives like Eclipse Steady and the Risk Explorer, seeks to improve open-source security, offering insights into potential attack vectors and mitigation tactics in the evolving landscape of software supply chains.

Endor Labs has released the "State of Dependency Management 2023" report, which highlights emerging trends and challenges in software security, particularly in the use of open source software (OSS) and large language models (LLMs). The report underscores the popularity of ChatGPT’s API and the inability of current LLM-based AI platforms to reliably classify malware risk, as they succeed in only 5% of cases. It also reveals that nearly half of all applications do not call security-sensitive APIs, a figure that drops drastically when dependencies are considered. Despite the widespread use of open source components, applications utilize only a small fraction of the imported code, and vulnerabilities in unused code are rarely exploitable. The report suggests that organizations should document their software components and vulnerabilities using a Software Bill of Materials (SBOM) to improve security and productivity. Endor Labs emphasizes the importance of understanding how components are used within applications to better assess risks.

Endor Labs, based in Palo Alto, has been recognized by Gartner as a Cool Vendor in Platform Engineering for Scaling Application Security Practices, highlighting its innovative approach in addressing the challenges faced by platform engineering and DevSecOps teams. This acknowledgment underscores the company's efforts to integrate application security tools into internal developer platforms, enhancing the security of software supply chains and developer productivity. The report emphasizes the growing importance of scaling DevSecOps practices and the need for effective open source risk management, predicting that by 2026, 70% of platform teams will incorporate these tools, up from 20% in 2023. Endor Labs' Code Governance Platform provides crucial context for prioritizing open source risk and securing CI/CD pipelines, aiming for a comprehensive lifecycle transformation rather than reactive alert management. Founded by Varun Badhwar and Dimitri Stiliadis, and supported by notable investors, Endor Labs leverages expertise from top industry professionals to accelerate development through secure Open Source Software adoption.