Kuidas tagada, et avatud lähtekoodiga paketid poleks minu omad

Open-source repositories are critical to running and writing modern applications, but beware – carelessness could detonate mines and inject backdoors and vulnerabilities in software infrastructures. IT departments and project maintainers need to assess a project’s security capabilities to ensure malicious code is not being incorporated into the application.

A new security framework from the Cybersecurity and Infrastructure Security Agency (CISA) and Open Source Security Foundation (OpenSSF) recommends controls such as enabling multi-factor authentication for project maintainers, third-party security reporting capabilities, and warnings for outdated or insecure packages to help reduce exposure to malicious code and packages masquerading as open-source code on public repositories.

“The open-source community gathers around these watering holes in order to fetch these packages, they have to be — from an infrastructure perspective — secure,” says Omkhar Arasaratnam, general manager of OpenSSF.

Kust võib leida halba koodi

Those watering holes include Github, which hosts entire programs, programming tools, or APIs that connect software to online services. Other repositories include PyPI, which hosts Python packages; NPM, which is a JavaScript repository; and Maven Central, which is a Java repository. Code written in Python, Rust and other programming languages download libraries from multiple package repositories.

Arendajaid võidakse kogemata meelitada sisse tõmbama pahatahtlikku tarkvara, mida võidakse süstida paketihalduritesse, mis võib anda häkkeritele juurdepääsu süsteemidele. Sellistes keeltes nagu Python ja Rust kirjutatud programmid võivad sisaldada pahatahtlikku tarkvara, kui arendajad lingivad valele URL-ile.

The guidelines in the “Principles for Package Repository Security” build on security efforts already adopted by repositories. The Python Software Foundation last year vastu võetud Sigstore, mis tagab selle PyPI-s ja muudes hoidlates sisalduvate pakettide terviklikkuse ja päritolu.

Arasaratnam ütleb, et hoidlate turvalisus ei ole kohutavalt halb, kuid see on ebajärjekindel.

"Esimene osa on koguda kogukonnas mõned populaarsemad ja olulisemad ning hakata looma juhtelementide komplekti, mida saaks nendes universaalselt kasutada," ütleb Arasaratnam.

The guidelines laid out in CISA’s Principles for Package Repository Security could prevent incidents such as namesquatting, where malicious packages could be downloaded by developers mistyping the wrong file name or URL.

"Võite kogemata käivitada paketi pahatahtliku versiooni või see võib olla stsenaarium, kus keegi on üles laadinud koodi, mis on hooldaja identiteedi all pahatahtlik, kuid ainult masina ohu tõttu," ütleb Arasaratnam.

Pahatahtlikke pakette on raskem ära tunda

The security of packages on repositories dominated a panel session of open-source security at the Open Source in Finance Forum held in November last year in New York.

“It is like the old days of browsers when they were inherently vulnerable. People would go to a malicious website, get a backdoor dropped, and then go ‘whoa, this isn’t the site,” said Brian Fox, co-founder and chief technology officer at Sonatype, during the panel discussion.

“We’re tracking well over 250,000 components that were intentionally malicious,” Fox said.

IT departments are coming to grips with the malicious code and packages masquerading as open-source code, said Ann Barron-DiCamillo, managing director and global head of cyber operations at Citi, at the OSFF conference a few months ago.

“Talking about malicious packages over the last year, we have seen a twofold increase over previous years. This is becoming a reality associated with our development community,” Barron-DiCamillo said.

• SEO-põhise sisu ja PR-levi. Võimenduge juba täna.
• PlatoData.Network Vertikaalne generatiivne Ai. Jõustage ennast. Juurdepääs siia.
• PlatoAiStream. Web3 luure. Täiustatud teadmised. Juurdepääs siia.
• PlatoESG. Süsinik, CleanTech, Energia, Keskkond päikeseenergia, Jäätmekäitluse. Juurdepääs siia.
• PlatoTervis. Biotehnoloogia ja kliiniliste uuringute luureandmed. Juurdepääs siia.
• Allikas: https://www.darkreading.com/application-security/untitled