September 2024 Summaries

Cloudflare has introduced a new setup wizard to simplify the creation and management of security.txt files for vulnerability disclosure on websites. This format allows organizations to specify their security policies and suitable reporting channels, enhancing the process of vulnerability reporting. Previously, setting up security.txt involved a complex manual process through Cloudflare Workers, but the new wizard, accessible under Security settings and available on Cloudflare's free plan, aims to facilitate broader adoption. Despite its benefits, the security.txt file has been attracting spam bots, leading to concerns about its implementation, as users have reported receiving spam messages after deploying it. To mitigate this, Cloudflare provides options for the Contact field, allowing users to choose between an email address, phone number, or URL link, while the email is not mandatory. This initiative, first noticed by Troy Hunt, could significantly increase the adoption of security.txt across the web, as Cloudflare serves a substantial portion of internet traffic.

The Internet Archive's Wayback Machine experienced a security breach where it was hacked and defaced, resulting in the exposure of 31 million records. Troy Hunt, creator of Have I Been Pwned, verified the authenticity of the compromised data, which included a 6.4GB SQL file containing 31 million unique email addresses, 54% of which were already in the HIBP database. Although the Internet Archive has acknowledged a DDoS attack, they have not detailed the entry point of the hack or addressed the defacement directly. The breach has led to significant concern among users about the preservation of historical data, sparking discussions on platforms like X and Reddit about potential causes, including a stored cross-site scripting (XSS) incident or a polyfill-related attack. Speculation also suggests a possible orchestrated attack by parties opposed to the Archive's mission of preserving information. The Internet Archive has confirmed the defacement was due to a JavaScript library issue, which has since been disabled, and the website is currently operating normally, with further details on the breach anticipated.

A malicious npm package named "express-dompurify" has been identified by the Socket Research team as targeting users by masquerading as the legitimate and widely-trusted DOMPurify library, which is known for preventing cross-site scripting (XSS) attacks. This package serves as a dangerous supply chain attack, using obfuscated code to hide its intent to exfiltrate sensitive data, including browser credentials, cryptocurrency wallet information, and system details, to an external server. The package's README file mimics that of the legitimate DOMPurify, increasing the likelihood of unsuspecting developers installing it, thereby compromising their applications. The attack utilizes dynamically generated variable names and commands to conceal its malicious activities, while also employing specific functions to gather and upload sensitive data from various system locations and browser profiles. This scenario highlights the growing threat of impersonation attacks on trusted libraries and underscores the importance of regular audits and vigilance against obfuscated code in packages.

ENISA's 2024 Threat Landscape Report outlines the escalating cybersecurity threats facing the EU, with a focus on state-sponsored supply chain attacks on open source software, increasing DDoS incidents, and the persistent threat of ransomware. The report highlights that DDoS attacks represent the majority of reported incidents, severely impacting sectors such as public administration, transport, and finance. Ransomware remains a significant concern, with groups like LockBit and Cl0p targeting diverse industries. Supply chain vulnerabilities are exploited by state actors from countries like Russia, Iran, and North Korea, often using "Living Off the Land" techniques to remain undetected. Financially motivated attackers are turning to zero-day and one-day vulnerabilities, while the rise of Malware-as-a-Service, particularly info stealers, poses a growing threat. Additionally, the weaponization of AI presents new challenges, as it allows for more efficient and harder-to-detect attacks. The report emphasizes the importance of AI and automation in reducing the costs associated with data breaches, highlighting their role in faster identification and containment of threats.

NIST (National Institute of Standards and Technology) is updating its Digital Identity Guidelines to improve authentication practices by eliminating the requirements for periodic password changes and the use of special characters, instead emphasizing longer and more complex passwords. The new guidelines, aimed at enhancing security for Federal Information Systems, suggest minimum password lengths of eight to fifteen characters and recommend accepting a wider range of characters, including Unicode. They also discourage composition rules that mandate mixing character types, as well as periodic password changes, unless there is evidence of compromise. The guidelines emphasize user-friendliness and security by supporting password managers, allowing password visibility for verification, and using encryption for secure handling. The proposed changes aim to guide users in creating strong passwords and encourage secure practices among verifiers and Credential Service Providers (CSPs). After the public comment period ends, NIST will incorporate feedback into a revised version of the guidelines, although no specific timeline for the final publication is provided.

The 2024 Ruby on Rails Community Survey, conducted by Planet Argon, attracted a record participation of 2,709 developers, highlighting key trends and challenges within the Rails ecosystem. The survey reveals a mature developer community, with over 70% having more than seven years of experience and a notable challenge in attracting newcomers, which led to the formation of the Rails Foundation in 2022. Despite Rails' success as an open-source project, many developers contribute infrequently, but there remains a dedicated core group of consistent contributors. Stimulus.js has become the most popular JavaScript library among Rails developers, surpassing React, and there is a growing preference for continuous deployment practices, with GitHub Actions as the leading CI tool. Security remains a priority, with GitHub Dependabot being the most utilized tool for tracking vulnerabilities, and the survey reflects a strong confidence in the Rails core team's direction and their handling of security concerns.

Data breaches surged by 78% in 2023, primarily due to zero-day and supply chain attacks, yet developers remain inundated with ineffective alerts that do not prevent these threats. Supply chain compromises, especially through software dependencies, are identified as the top threat for the next five years, with malicious actors exploiting trusted vendors to access sensitive data. Despite 90% of software being built with open-source code, attacks on open-source repositories have risen, highlighting the need for robust security measures beyond basic updates. The overwhelming volume of false-positive alerts has led to burnout among cybersecurity professionals, with 70% of IT security leaders noting a doubling in alert volume over the past five years. The unreliability of CVE data has exacerbated alert fatigue, with many high-profile attacks going undetected. To combat this, strategies such as modernizing security tools to focus on real threats, empowering developers to make informed security decisions, and enabling forward momentum on addressing alerts are crucial. Leveraging automation, machine learning, and artificial intelligence can help reduce false positives and prioritize high-priority incidents, allowing security teams to concentrate on the most pressing threats effectively.

NIST has missed its deadline to clear the National Vulnerability Database (NVD) backlog, with the number of Common Vulnerabilities and Exposures (CVEs) awaiting analysis increasing by 33% since June 2024. Despite contracting cybersecurity firm Analygence for $865,657 to aid in processing these vulnerabilities, the backlog has grown to nearly 18,000 CVEs, as the influx of new vulnerabilities outpaces analysis efforts. The lack of updates from NIST, coupled with the backlog's impact on timely vulnerability information dissemination, raises concerns about exposed systems. While some progress has been made, such as the adoption of CISA's Vulnrichment for CVSS enrichment, the overall challenge remains formidable, exacerbated by a 33.8% year-over-year increase in CVEs. Legislative proposals to include AI system vulnerabilities in the NVD could further strain resources, necessitating a transparent strategy to enhance the CVE processing system and improve national cybersecurity.

Solo open source maintainers face increasing burnout and security challenges, with a significant portion remaining unpaid despite the critical role they play in maintaining essential software. A survey by Tidelift reveals that 60% of these maintainers are unpaid, and many are considering quitting due to the mounting pressures and lack of appreciation. The survey also highlights that paid maintainers tend to create more secure software, as they have more resources to address security issues and implement best practices. Despite multiple initiatives and discussions aimed at improving support for maintainers, the open-source ecosystem remains precarious, with unpaid volunteers shouldering the burden of maintaining critical software infrastructure. This situation persists even as trust issues among maintainers grow, particularly following incidents like the xz-utils backdoor attack, leading to increased scrutiny of contributions and a sense of being undervalued.

License exceptions are modifications to open-source licenses that provide additional permissions or restrictions, impacting how software can be used, modified, and distributed. These exceptions are less common but crucial for bridging the gap between open source and proprietary software, as exemplified by MySQL AB's adoption of the FOSS License Exception in 2004 to allow linking with proprietary software without violating the GNU General Public License (GPL). By introducing exceptions like linking, classpath, font, and non-commercial use exceptions, developers can integrate open-source software into commercial projects without having to open source their entire codebase, thereby encouraging broader adoption of open-source components. However, license exceptions can complicate legal obligations and distribution terms, prompting tools like Socket's License Exception Alert to help developers identify and understand these exceptions in their dependencies. Understanding license exceptions is vital for developers to navigate the legal landscape effectively and ensure compliance, with resources like the Software Package Data Exchange (SPDX) providing comprehensive information on known exceptions.

The Socket Python SDK, now available on PyPI, provides developers with a streamlined way to integrate Socket's security features into Python applications by offering a user-friendly wrapper around the Socket REST API. This initial version simplifies accessing the API, retrieving npm package issues, security scores, and managing dependencies, as well as handling organization data such as reports and settings. Developers can also perform full dependency scans and manage repositories linked to their Socket.dev organization. Installation is straightforward via pip, and detailed setup instructions are available on PyPI. Feedback is encouraged to enhance the SDK's functionality and better meet user security needs.

Floating dependency ranges in npm, while offering the convenience of automatic updates, can pose significant risks such as instability and security vulnerabilities by allowing unverified or incompatible versions to be installed. This practice can lead to unpredictable behavior, security flaws, and production environment disruptions, as well as challenges in maintaining reproducibility and managing dependency conflicts. Wildcards, which allow any version of a package to be installed, increase these risks by potentially introducing breaking changes or malicious code without explicit review. Although floating dependency ranges are more common in early-stage or rapidly evolving projects, many well-maintained projects avoid them due to these associated risks. Developers are encouraged to adopt strict versioning practices, such as using exact version specifications and employing package-lock.json files, to ensure consistent builds and minimize the chances of unexpected updates or conflicts. Tools like Socket's Wildcard Dependency Alert can help identify and manage these risks by flagging packages with floating version ranges.

A new Rust RFC proposes implementing "Trusted Publishing" for Crates.io to enhance security by replacing long-lived API tokens with short-lived access tokens via OpenID Connect (OIDC), inspired by successful practices from PyPI and RubyGems.org. This initiative aims to mitigate the risks associated with the current API tokens, which are susceptible to security breaches due to their longevity and the manual processes involved in their creation and revocation. The proposed system would initially target GitHub Actions users, the largest group of Crates authors, before extending to other CI/CD platforms like GitLab and CircleCI. Despite potential challenges in establishing trusted relationships between CI/CD providers and Crates.io, the adoption of OIDC is anticipated to significantly bolster supply chain security for Rust, a language increasingly vital in systems programming. The move has received positive feedback from the developer community, underscoring its importance in safeguarding the integrity of published code amid growing reliance on third-party software.

Cloudflare is enhancing the Node.js compatibility of its Workers and Pages platforms by introducing a major update that combines polyfills and native code, enabling developers to access more npm packages and Node.js APIs. This update addresses previous challenges associated with running npm packages in environments like Cloudflare Workers due to missing APIs and dependencies tailored exclusively for Node.js. By using the v2 compatibility flag in their `wrangler.toml` files, developers can now leverage popular libraries for building complex applications and integrating with backend services. The update, which will become the default behavior for Workers with the nodejs_compat compatibility flag enabled from September 23, 2024, aims to bridge the gap between Node.js and serverless environments. Cloudflare's approach lifts limitations that hindered the use of many npm packages, positioning its serverless platform as more versatile and competitive. This move is expected to boost the adoption of serverless technologies, allowing developers to harness the benefits of edge computing without extensive code modifications, while broadening the ecosystem's reach by enabling a wider utilization of npm packages in serverless contexts.

The Python Software Foundation (PSF) has expanded its role as a CVE Numbering Authority (CNA) to include the Pallets Projects, which encompass widely-used Python frameworks such as Flask, Jinja, Click, and Quart. This expansion allows for more efficient and transparent tracking of vulnerabilities, a crucial aspect for thousands of Python web applications. By incorporating the Pallets Projects, PSF aims to enhance the security landscape for developers by ensuring consistent and reliable CVE reporting, faster allocation of CVE IDs, and richer advisories. The initiative reflects the critical need for robust security processes in open-source tools that are integral to industries with stringent security requirements, such as finance and healthcare. The PSF's commitment to professional-grade security management in the open-source community aims to set a precedent for other projects, addressing the often-overlooked challenges of maintaining security in popular frameworks.

The blog post discusses a new threat to the Python ecosystem known as "revival hijacking," where malicious actors re-register deleted packages on PyPI with the same names, introducing harmful code into previously trusted libraries. This vulnerability arises because PyPI lacks a formal deprecation mechanism, leading authors to delete packages and leaving names open for re-registration. JFrog's research estimates that over 22,000 packages are at risk, while Socket offers a solution by using AI-driven monitoring to detect and block suspicious updates in re-registered packages. Unlike traditional security tools, Socket analyzes code behavior to flag unexpected changes, such as hidden telemetry or network requests, thus safeguarding the supply chain before any malicious activity can impact production environments. As a proactive measure, JFrog created security_holding accounts to replace deleted package names with benign, empty packages, but acknowledges users cannot solely rely on this method for protection. Socket's GitHub app, which can be installed easily, offers developers a robust defense against such attacks by preventing the installation of compromised packages.

Elastic's decision to return Elasticsearch to open source with the AGPL license has been met with skepticism from developers who were previously affected by its 2021 licensing change, which had prompted a mass migration to Amazon's OpenSearch. This move is perceived by many as a strategic maneuver rather than a genuine effort to restore trust, as the company had previously shifted to dual-licensing with the SSPL and Elastic License, which was criticized as "fauxpen" source. Despite the Open Source Initiative's (OSI) commendation of Elastic's AGPL adoption for its strong copyleft protection, many developers remain unconvinced, as Elastic's messaging appeared tone-deaf and disconnected from community concerns. The adoption of AGPL is seen as a way to attract engagement for applications like Retrieval-Augmented Generation (RAG) and Generative AI (GenAI), but the previous disruption has left a lasting impact on user trust. The return to open source is celebrated by some as a move towards protecting user freedoms and maintaining open collaboration, but the community remains wary of Elastic's intentions, viewing the change as more aligned with corporate strategy than a genuine commitment to open source principles.

Socket has introduced a new Analytics feature in its dashboard, now available in beta for all users, which provides insights into security risks and trends at both organizational and repository levels. This highly-requested feature presents critical and high alert metrics through various graphs, allowing users to track changes over time and assess the effectiveness of their security measures. Organization-level analytics comprise nine graphs, including metrics on alerts found and prevented from merging into main branches, while repository-level analytics offer a more granular view with similar filtering and exporting options. Data is ingested daily, and filters allow users to view trends over the last 7, 30, or 90 days. Export options include CSV and JSON formats for easy integration into workflows. This feature aims to enhance proactive decision-making and boost confidence in software integrity by ensuring transparency and measurability of security efforts. Non-users can access these insights by installing Socket's free GitHub app, which seamlessly secures pull requests against vulnerable dependencies.

A recent report by the Open Source Security Foundation (OpenSSF), commissioned by the Linux Foundation, highlights significant gaps in secure software development training, particularly among newer developers, with 75% lacking familiarity with secure practices. The report reveals that 28% of developers are unfamiliar with secure coding, and 53% have never taken a course on the subject, pointing to an urgent need for educational resources to bolster software supply chain security. Time constraints, lack of awareness, and insufficient training are major obstacles for implementing secure practices, while emerging security issues like AI, ML, and supply chain security are of growing concern. The OpenSSF plans to develop a security architecture course, recognizing its broad importance and the demand for more language-agnostic training, as 79% of respondents favored such courses over language-specific ones. As vulnerabilities in software systems become more apparent, the foundation emphasizes the critical need for comprehensive training to mitigate these risks and offers a free introductory course, "Developing Secure Software," to help address these challenges.