#OpenSourceSecurity

[centizen]

Open Source Applications & Security?

Open Source Applications & Security as much controversial as it may sound, Open source applications have been around forever. However, their requirements have skyrocketed only in the past decade. The reason for this is no mystery — lower Development Costs. This has suddenly increased the needs for data. Software development organisations regardless of its size has become dependent on Open Source Applications.

Almost 70–80 percentage of the applications today are comprised of reusable components. The irony would be the times when this open source software was considered too risky for commercial use. Albeit enterprises have gotten very good at using open source to fast-track the development cycle.

Although companies have figured out how to reuse the code effectively, they haven’t figured out how to use them securely without introducing inadvertent vulnerabilities.

The facts would point companies growing reliance towards such data without required security. Consequently, with the reliance towards such data also increases the likelihood of applications inheriting much more risks and vulnerabilities than ever before.

Now that we have established the major consumption rate and the problems, they cause let’s see how to handle this vulnerability. A popular way to track open source elements is through Software Composition Analysis (SCA)

As scary as it may sound, SCA tools are not new to the industry. SCA tools provides an insight of what they are doing with their open source platforms. SCA tools were originally born of the need to keep track of open source tools. There is no definite limit on what SCA encompasses. SCA tools offers different facilities from spreadsheets to tax deduction. Although SCA tools were on the escalator to glory they failed miserably.

The short — lived glory

In the early 2000’s firms matched codes by scanning them to data from open source elements by identifying snippets of code. However, this required professional help to remove falsified data. Fast forward a decade, companies required elements that met with their agile needs. By this time, the real-time detection of vulnerabilities and other issues at earliest started surfacing by then.

Almost a decade later now, the tools provide insights that delve a little deeper of how each element is being used. Before investing on the SCA an organization has to make sure if the SCA of their choice can cover all their coding languages. Companies new to this field may not be great at identifying unrecorded vulnerabilities, resulting in complications. On the other hand, SCA tools must work seamlessly with the build tools, databases and repositories.

DevOps — The replacement of SCA

SCA tools like I said before have been around for some time and follows native designs. Hence it lacks when used alongside of a system’s security lacked agility which became a demanding need by organizations. DevOps handles implementing new changes on infrastructure, embarking changes easier for Developers.

No matter what, SCA still is in practise. However, with almost every organisation switching to DevOps, reasons it is because of the seamless security intertwine to their workflow that redefines transparency for its developers.

Wrap up

I don’t want to turn this article into a debate, all statements here are facts learned and collected to the best of my understanding. I want you to be your own judge. If you think SCA tools might be the best option for your organisation’s needs, go for it. Or if DevOps suits your needs better go for it.

[jpmellojr]

RoguePuppet software supply chain exposure: Lessons learned

A flaw in Puppet Forge on GitHub could have led to a supply chain disaster matching the scope of the attack on SolarWinds. Here are the key takeaways. https://www.reversinglabs.com/blog/roguepuppet-software-supply-chain-exposure-lessons-learned

[osintelligence]

https://bit.ly/3tkCG80 - 🔒 Encrypted npm packages were found targeting a major financial institution, raising concerns about the intent behind these publications. Phylum's analysis revealed sophisticated malware-like behavior, with the packages containing an encrypted blob targeted at a specific organization's domain. The situation highlights the complexities in determining the true nature of such cybersecurity threats. #Cybersecurity #MalwareDetection #FinancialInstitutionTargeted 🔎 In early November 2023, Phylum began tracking suspicious npm package publications. These packages executed encrypted payloads using local machine information, suggesting a highly targeted attack. The decrypted payload revealed an embedded binary designed to exfiltrate user credentials to an internal Microsoft Teams webhook of the targeted financial institution. This indicated either an inside job, a red team simulation, or external threat actors with substantial network access. #TargetedCyberAttack #DataExfiltration #CyberThreatAnalysis 🕵️ The attack mechanism was sophisticated, starting with a postinstall hook in the package.json. The code was designed to collect system-related information and use it for AES encryption. The attacker's focus on specific strings and environment variables suggested a detailed knowledge of the target's internal systems. #CyberAttackTactics #EncryptionMethods #SystemVulnerability 👥 After decrypting the payload, Phylum contacted the targeted organization. They discovered that the packages were part of an advanced adversary simulation exercise by the company's red team. While the intent was benign, this incident underscores the importance of vigilance against software supply chain attacks. #RedTeamSimulation #SupplyChainSecurity #CyberDefense 📊 The attack methodology revealed that developers are high-value targets and software libraries are rarely vetted for malicious modifications. This incident shows the effectiveness of software supply chain attacks, even against well-prepared organizations. It emphasizes the need for comprehensive security measures to protect against such sophisticated threats. #DeveloperSecurity #SoftwareSupplyChain #CyberSecurityAwareness 💡 Phylum's analysis of this case highlights the challenges in open source security. Their automatic analysis of packages in open source registries underscores the importance of identifying risks in using these packages. The incident serves as a reminder that today's red team exercise could be tomorrow's genuine threat, urging organizations to be adequately prepared.

[virtualizationhowto]

Wazuh Open Source SIEM: XDR for Enterprise and Home Lab

Wazuh Open Source SIEM: XDR for Enterprise and Home Lab @wazuh #homelab #selfhosted #WazuhSIEM #OpenSourceSecurity #IntrusionDetection #WazuhFileIntegrity #SecurityAnalytics #VulnerabilityDetection #WazuhComplianceStandards #CloudSecurity #WazuhInstall

The cybersecurity landscape is evolving. Many commercial security platforms offer value, including SIEMs and others. However, an open-source solution called Wazuh stands out as a powerful open-source security platform, offering tools for threat detection, regulatory compliance, and much more. Let’s look at Wazuh and better understand its components and features that help everyone, from a chief…

[mayank84ya]

Bootstrap is also known as #Twitter Bootstrap is the open-source CSS framework. It aimed at responsive, mobile-first front-end web development. It holds the design templates based on CSS and JavaScript for typography, forms, buttons, navigation, and other interface components. (via Bootstrap Interview Questions | Courseya)

[osintelligence]

https://bit.ly/3SAO3mn - 🔎 Aqua Nautilus researchers uncovered flaws in the vulnerability disclosure process for open-source projects. Their study showed how vulnerabilities could be harvested before being patched, increasing the risk of exploitation. The research involved analyzing GitHub commits, pull requests, and issues, along with data from the National Vulnerabilities Database (NVD). This work highlights the need for standardized responsible disclosure processes in open-source communities. #OpenSourceSecurity #VulnerabilityDisclosure #CybersecurityResearch 🛑 The vulnerability disclosure process is more complex than the binary distinction of '0-day' and '1-day'. Aqua Nautilus introduces two more stages: 'Half-Day' (where vulnerability information is publicly exposed but not officially released) and '0.75-Day' (an official patch is available, but no CVE or CPE is assigned). These stages present significant risks as attackers can exploit vulnerabilities during these windows. #CybersecurityAwareness #VulnerabilityManagement #InfoSec 📈 Case studies, including the analysis of the Log4Shell (CVE-2021-44228) disclosure process, revealed inherent discrepancies in reporting. The 'Half-Day' and '0.75-Day' windows allowed attackers to potentially exploit vulnerabilities before the general public was alerted and scanning tools could detect the issues. #Log4Shell #CyberAttackPrevention #SecurityAnalysis 🔍 Aqua Nautilus developed methods to identify vulnerabilities at scale using GitHub and NVD. Their approach involved searching for trigger words in GitHub projects and monitoring NVD for early exposure of CVEs. These methods help in detecting security issues before they become widely known. #GitHubSecurity #NVDAnalysis #CyberThreatIntelligence 🛡️ To mitigate the risks of early vulnerability exposure, the researchers suggest responsible disclosure practices, proactive scanning of open-source commits/issues/PRs, and implementing runtime protection strategies. These measures aim to minimize the gap between vulnerability discovery and patch release, reducing the opportunity window for attackers.