January 2023 Summaries

GitHub's recent modification to the way archives are compressed led to widespread pipeline failures, as the change altered the checksums of archived packages, causing verification errors in developer and CI tools that rely on these checksums for security. This disruption, triggered by a Git update deployed by GitHub, was quickly retracted, but not before it affected productivity globally. To prevent future disruptions, developers are advised to proxy GitHub tarballs through Artifactory's VCS Repositories, which offer proxy and caching functionalities, ensuring stable and verified access to necessary components. By hosting local copies of critical elements, developers can safeguard against upstream changes or outages, with the option to use JFrog's free Cloud instance for this purpose.

The final entry in the Malicious Packages blog series explores the intricacies of software supply chain attacks, focusing on the stealthy techniques attackers use to integrate and conceal malicious code within software packages. The series covers the role of such packages in attacks, the infection methods, and the execution of payloads to achieve attackers' goals, including employing obfuscation techniques like base64 encoding, control flow flattening, and the use of homoglyph and bidirectional control characters. It discusses the detection of both known and unknown malicious packages, emphasizing the limitations of relying solely on public repositories and the need for advanced heuristic scanning tools like JFrog Xray. The series concludes with best practices for secure development, advocating for the use of software composition analysis tools, defining DevSecOps policies, and employing open-source tools to mitigate threats.

Ndustrial has successfully leveraged JFrog Connect to innovate IoT solutions that significantly reduce energy costs for industrial operations, saving customers tens of thousands of dollars daily. By merging computer science and industrial engineering, they created a "production-first" Energy Intensity platform to enhance production efficiency and minimize energy expenses, helping clients avert over $100 million in potential energy spend. As Ndustrial expands globally, deploying IoT devices across diverse facilities with different equipment and security requirements posed challenges, necessitating a secure, automated deployment solution. JFrog Connect has transformed Ndustrial's edge software deployment from a manual to a fully automated process, enabling rapid and scalable deployment, remote monitoring, and troubleshooting. This automation has facilitated Ndustrial's global expansion into roughly 50 facilities across Europe, Asia, and Australia, reducing the need for extensive travel and personnel investments. The integration has allowed Ndustrial to earn the trust of major industrial players by remotely managing critical operations with efficiency and security, contributing to substantial daily energy savings for clients.

The JFrog Security Research team has identified multiple vulnerabilities in popular Rust projects, such as Axum, Salvo, and conduit-hyper, which are linked to the improper handling of HTTP requests due to the lack of limits set when using the Hyper library. Hyper, a widely used low-level HTTP library in Rust, can be exploited for denial-of-service (DoS) attacks because its body::to_bytes function does not check for length, allowing arbitrary memory allocation based on the "Content-Length" header. This vulnerability can lead to zero-click DoS attacks when a small request with a large "Content-Length" value is sent, causing memory allocation failure and process crashes. To mitigate this issue, developers should implement size checks in their code to limit the size of requests and responses, as the Hyper library does not provide such restrictions by default. The JFrog team continues to notify Rust maintainers about this vulnerability to ensure all instances are addressed.