June 2024 Summaries

Socket has updated its alert system by introducing two new alert actions, "Warn" and "Monitor," alongside the existing "Block" (formerly "Error") and "Ignore" actions, enhancing the control and flexibility users have over managing alerts. These changes allow organizations to handle notifications with greater precision, enabling them to block or highlight certain alerts without halting development workflows. The new triage functionality further complements this system by allowing users to override default alert actions for individual alerts, providing the ability to manage false positives and reduce alert noise effectively. This feature ensures that organizations can maintain a balanced security posture, prioritizing and categorizing alerts without unnecessarily impeding progress, while the upcoming default security policies aim to leverage these enhanced alert actions for improved security management.

OpenSSF has issued a warning to open source maintainers about the practice of reputation farming on GitHub, where users artificially boost their status by manipulating interactions on closed issues and pull requests. This practice can deceive others about an individual's genuine contributions and expertise, potentially setting the stage for social engineering attacks. Participants have reported suspicious accounts that comment on and approve issues and PRs that were closed or merged long ago, falsely inflating their activity feed. This not only misleads the community but also diverts maintainers' efforts from more productive work, especially if these activities are automated. GitHub has faced several spam campaigns in 2024, highlighting the ongoing challenge of maintaining platform integrity. OpenSSF advises maintainers to monitor repository activity, report suspicious behavior, and consider using tools like GitHub Actions to manage inactive discussions, although these measures can be labor-intensive. While no direct attacks have resulted from reputation farming, vigilance is recommended to prevent repositories from inadvertently lending credibility to spam accounts.

A controversy erupted in the open-source community when Jordan Harband, the new maintainer of the axobject-query JavaScript library, merged a pull request to support legacy Node.js versions, sparking a backlash from the community who felt the decision was unilateral and unnecessary. The axobject-query library, crucial for improving web accessibility, is widely used, and Harband's decision introduced 16 additional dependencies to support outdated Node versions, which many developers deemed impractical due to security and performance concerns. Harband, known for his commitment to long-term support, defended his decision by emphasizing accessibility and compatibility, although the move was perceived as a potential security risk by some. The situation highlighted the challenges faced by open-source maintainers, who often navigate between community expectations and personal judgment, amid a lack of support and recognition. The incident also underscored the need for respectful communication within the open-source ecosystem to prevent misunderstandings and promote a collaborative environment.

The popular JavaScript library ua-parser-js is transitioning from the MIT license to a dual AGPLv3 + PRO licensing model in its upcoming version 2.0 release, sparking significant concern and debate within the developer community. The library, which is extensively used to detect browser, engine, OS, CPU, and device types from user-agent data, will now require projects to comply with the AGPL license or opt for a paid PRO license, with fees ranging from $12 to $500, depending on usage. This change has led to apprehension among developers and businesses, as the AGPL license mandates that derivatives be released under the same terms, potentially affecting proprietary projects. The decision has been met with criticism, with some developers planning to fork the library to maintain control under the permissive MIT license, as seen with Matteo Collina's creation of "my-ua-parser." Despite the backlash, the library's maintainer, Salman, intends to proceed with the change, prompting users to either stick with the existing MIT-licensed version or explore alternative solutions.

Researchers have identified a significant vulnerability in the npm Registry, revealing its susceptibility to Cache-Poisoned Denial-of-Service (CPDoS) attacks, which combine cache poisoning with Denial of Service (DoS) tactics to disrupt package availability. This vulnerability can lead to severe consequences for the npm ecosystem, particularly if widely used packages such as Express, which sees over 30 million downloads weekly, become targets, potentially causing application failures and widespread disruption in CI/CD pipelines. The researchers demonstrated that a single machine could maintain the attack across servers by sending repeated requests, highlighting the potential for widespread operational and economic impacts. Despite GitHub's quick response capability, the incident underscores the necessity for robust security measures to prevent sophisticated attacks that could exploit leaked secrets or compromised credentials, thereby amplifying their impact. Importantly, mechanisms like package lockfiles and tools like Socket, which flag mismatches between expected and actual package contents, offer some defense against such vulnerabilities by detecting unauthorized changes before they can affect applications.

Feross Aboukhadijeh, CEO of Socket, was featured on Basarat Ali Syed’s YouTube channel as part of the Node Congress Speaker Showcase, where they discussed the intricacies of NodeJS and the challenges of securing open source dependencies. The interview highlighted Feross's journey of managing over 100 npm packages, which exposed him to the vulnerabilities in downloading open source code and inspired him to create Socket to address these security issues. The conversation also explored the emergence of his StandardJS project, which aimed to maintain consistent coding styles across various projects. Additionally, the episode delved into the innovative application of Language Learning Models (LLMs) in detecting malicious code within dependencies, demonstrating their potential beyond chat interfaces and into real-world security applications. Feross plans to elaborate on these topics and offer practical security improvement steps at Node Congress, drawing on Socket’s experiences in safeguarding open source software at scale.

At the 102nd TC39 meeting in Finland, eight proposals for ECMAScript advancements were approved to move to the next stages of development. This meeting is part of a six-stage proposal process that determines major changes to the ECMAScript programming language specification. Among the proposals advanced were Promise.try to Stage 3, Deferred Import Evaluation and RegExp.escape to Stage 2.7, and Error.isError to Stage 2. Additionally, four more proposals were discussed, including Joint Iteration, which aims to enhance iteration capabilities by allowing simultaneous iteration over multiple iterables, and ESM Phase Imports, which seeks to improve performance and predictability by controlling module initialization timing. The Discard Bindings proposal introduces syntax to avoid unnecessary variable bindings, improving code efficiency and readability, while Iterator Sequencing aims to standardize the management of asynchronous and synchronous iteration. The next TC39 meeting is slated for July 2024 as a virtual event, where further developments will be deliberated.

Researchers at the University of Illinois Urbana-Champaign have demonstrated that teams of large language model (LLM) agents can autonomously exploit zero-day vulnerabilities with a 53% success rate, presenting a cost-effective alternative to human penetration testers. Utilizing a technique called Hierarchical Planning with Team of SubAgents (HPTSA), these AI agents can work collaboratively to handle complex cybersecurity tasks by dividing responsibilities among specialized agents. The study highlighted that while LLMs can outperform open source vulnerability scanners and are closing in on the capabilities of GPT-4 agents with prior vulnerability knowledge, they still face limitations, such as failing to exploit certain vulnerabilities due to endpoint detection issues. Despite these challenges, the declining costs of AI technology suggest that LLM agents may soon become significantly cheaper than human experts, with potential for further development in targeting specific software vulnerabilities.

Ecma TC39, the committee responsible for maintaining the ECMAScript programming language specification, met in Finland for its 102nd meeting, advancing several key proposals. These include Deferred Import Evaluation, which aims to improve performance by delaying the execution of JavaScript imports until necessary, and Error.isError(), a method to determine if a value is an error instance, aiding debugging and serialization efforts. Other proposals like RegExp Escaping and Promise.try also progressed, the latter providing a more straightforward way to start promise chains and handle errors. The committee, which operates on consensus, discussed these advancements over a three-day period, with more proposals expected to be evaluated during the week. All open proposals and their statuses are tracked on GitHub, and a detailed agenda for the meeting is available online.

In May 2024, over 5,000 Common Vulnerabilities and Exposures (CVEs) were published, marking an unprecedented increase in cybersecurity alerts with an average of 164 daily, nearly doubling the previous year's average. This surge, partly attributed to the controversial inclusion of numerous Linux kernel issues, highlights ongoing debates about the criteria for CVE classification. The National Vulnerability Database (NVD) is currently overwhelmed by the growing backlog of CVEs awaiting analysis, prompting the engagement of a contractor to address this issue by September. Meanwhile, the Cybersecurity and Infrastructure Security Agency (CISA) has been designated as the first-ever CVE Authorized Data Publisher (ADP), enhancing CVE records with additional data and aiming to streamline the process through a two-pass enrichment strategy. Despite these efforts, the backlog remains substantial, with future plans to expand the ADP program to alleviate bottlenecks in CVE enrichment and processing.

Following reports that over 50% of known exploited vulnerabilities (KEVs) remained unenriched since mid-February, the National Institute of Standards and Technology (NIST) announced a major contract to address the backlog in the National Vulnerability Database (NVD) by the end of the fiscal year. NIST has engaged additional processing support and formalized an agreement with the Cybersecurity and Infrastructure Security Agency (CISA) to process Common Vulnerabilities and Exposures (CVEs), aiming to return to pre-February processing rates. Despite these efforts, NIST has faced criticism for a lack of transparency regarding the backlog's cause and its consortium plan, with cybersecurity professionals calling for congressional oversight and urging organizations to diversify their sources of CVE data. The agency's plan includes modernizing the NVD to handle the increasing volume of vulnerabilities, but skepticism remains due to previous communication failures and the perceived loss of credibility in the software security community.

A malicious Python package named 'crytic-compilers' was identified by the Socket Research Team as a typosquatting attempt to exploit the popular crytic-compile utility used in smart contract development. This package, which differed slightly in naming from the legitimate 'crytic-compile', contained a trojan designed to execute on Windows systems and was flagged by multiple antivirus engines. The legitimate crytic-compile is widely used in crypto development, being downloaded around 6,000 times daily and integrated into various tools like Slither and Echidna. This incident underscores the risks posed by typosquatting attacks in open-source package registries, highlighting the necessity for vigilant monitoring and vetting of software packages to safeguard the integrity of the software supply chain. Socket offers tools to flag such vulnerabilities and malicious packages within PR workflows, emphasizing the importance of securing dependencies.

NIST has released a draft of its Artificial Intelligence Risk Management Framework aimed at enhancing the security and reliability of generative AI systems, addressing the challenges posed by malicious AI exploits, and aligning with President Biden's executive order on AI. The framework highlights the growing threats of AI-augmented hacking, malware, and phishing, emphasizing the ease with which AI can facilitate offensive cyber capabilities and increase vulnerabilities. It identifies key security risks such as prompt-injection and data poisoning, which could lead to significant downstream consequences. NIST's draft includes feedback from a large public working group and outlines 13 risks with over 400 recommended actions for developers to manage these risks, focusing on securing supply chains and conducting regular adversarial testing. The drafts are open for public comment until June 2, 2024, and are expected to help shape best practices for securing AI systems in alignment with potential future regulatory requirements.