seen from United States
seen from United States
seen from United States
seen from Taiwan
seen from Canada
seen from United States
seen from Japan
seen from United States
seen from Malaysia
seen from United States
seen from Greece
seen from United States
seen from Canada
seen from China
seen from United States
seen from Malaysia
seen from United States
seen from China
seen from Canada
seen from Taiwan
The "lotusbail" Supply Chain Attack: How a Working WhatsApp API Library Hijacked 56K Dev Environments
Read the full report on -
CyberDudeBivash News delivers daily cybersecurity threat intel, CVE alerts, malware trends, and crypto security briefings.
$X MILLION QUESTION: The True, Hidden Cost of an Open Source Supply Chain Attack
Read the full report on -
CyberDudeBivash offers real-time cybersecurity news, threat intelligence, zero-day vulnerabilities, malware reports, and security tools.
Mitigation Checklist: 7 Steps Engineering Leaders Must Take to Prevent Open Source Exploits
Read the full report on -
CyberDudeBivash offers real-time cybersecurity news, threat intelligence, zero-day vulnerabilities, malware reports, and security tools.
Secure Development & Dependency Hardening in Open-Source Projects: How to Avoid Supply-Chain Attacks and Backdoors — critical given open-source supply chain risks.
Read the full report on -
CyberDudeBivash offers real-time cybersecurity news, threat intelligence, zero-day vulnerabilities, malware reports, and security tools.
OPEN-SOURCE IS BROKEN: 43,000 Hidden Malware Packages Rotted in npm for TWO YEARS—You Are Exposed
Read the full report on -
CyberDudeBivash offers real-time cybersecurity news, threat intelligence, zero-day vulnerabilities, malware reports, and security tools.
Open Source Applications & Security?
Open Source Applications & Security as much controversial as it may sound, Open source applications have been around forever. However, their requirements have skyrocketed only in the past decade. The reason for this is no mystery — lower Development Costs. This has suddenly increased the needs for data. Software development organisations regardless of its size has become dependent on Open Source Applications.
Almost 70–80 percentage of the applications today are comprised of reusable components. The irony would be the times when this open source software was considered too risky for commercial use. Albeit enterprises have gotten very good at using open source to fast-track the development cycle.
Although companies have figured out how to reuse the code effectively, they haven’t figured out how to use them securely without introducing inadvertent vulnerabilities.
The facts would point companies growing reliance towards such data without required security. Consequently, with the reliance towards such data also increases the likelihood of applications inheriting much more risks and vulnerabilities than ever before.
Now that we have established the major consumption rate and the problems, they cause let’s see how to handle this vulnerability. A popular way to track open source elements is through Software Composition Analysis (SCA)
As scary as it may sound, SCA tools are not new to the industry. SCA tools provides an insight of what they are doing with their open source platforms. SCA tools were originally born of the need to keep track of open source tools. There is no definite limit on what SCA encompasses. SCA tools offers different facilities from spreadsheets to tax deduction. Although SCA tools were on the escalator to glory they failed miserably.
The short — lived glory
In the early 2000’s firms matched codes by scanning them to data from open source elements by identifying snippets of code. However, this required professional help to remove falsified data. Fast forward a decade, companies required elements that met with their agile needs. By this time, the real-time detection of vulnerabilities and other issues at earliest started surfacing by then.
Almost a decade later now, the tools provide insights that delve a little deeper of how each element is being used. Before investing on the SCA an organization has to make sure if the SCA of their choice can cover all their coding languages. Companies new to this field may not be great at identifying unrecorded vulnerabilities, resulting in complications. On the other hand, SCA tools must work seamlessly with the build tools, databases and repositories.
DevOps — The replacement of SCA
SCA tools like I said before have been around for some time and follows native designs. Hence it lacks when used alongside of a system’s security lacked agility which became a demanding need by organizations. DevOps handles implementing new changes on infrastructure, embarking changes easier for Developers.
No matter what, SCA still is in practise. However, with almost every organisation switching to DevOps, reasons it is because of the seamless security intertwine to their workflow that redefines transparency for its developers.
Wrap up
I don’t want to turn this article into a debate, all statements here are facts learned and collected to the best of my understanding. I want you to be your own judge. If you think SCA tools might be the best option for your organisation’s needs, go for it. Or if DevOps suits your needs better go for it.
RoguePuppet software supply chain exposure: Lessons learned
A flaw in Puppet Forge on GitHub could have led to a supply chain disaster matching the scope of the attack on SolarWinds. Here are the key takeaways. https://www.reversinglabs.com/blog/roguepuppet-software-supply-chain-exposure-lessons-learned
https://bit.ly/3SAO3mn - 🔎 Aqua Nautilus researchers uncovered flaws in the vulnerability disclosure process for open-source projects. Their study showed how vulnerabilities could be harvested before being patched, increasing the risk of exploitation. The research involved analyzing GitHub commits, pull requests, and issues, along with data from the National Vulnerabilities Database (NVD). This work highlights the need for standardized responsible disclosure processes in open-source communities. #OpenSourceSecurity #VulnerabilityDisclosure #CybersecurityResearch 🛑 The vulnerability disclosure process is more complex than the binary distinction of '0-day' and '1-day'. Aqua Nautilus introduces two more stages: 'Half-Day' (where vulnerability information is publicly exposed but not officially released) and '0.75-Day' (an official patch is available, but no CVE or CPE is assigned). These stages present significant risks as attackers can exploit vulnerabilities during these windows. #CybersecurityAwareness #VulnerabilityManagement #InfoSec 📈 Case studies, including the analysis of the Log4Shell (CVE-2021-44228) disclosure process, revealed inherent discrepancies in reporting. The 'Half-Day' and '0.75-Day' windows allowed attackers to potentially exploit vulnerabilities before the general public was alerted and scanning tools could detect the issues. #Log4Shell #CyberAttackPrevention #SecurityAnalysis 🔍 Aqua Nautilus developed methods to identify vulnerabilities at scale using GitHub and NVD. Their approach involved searching for trigger words in GitHub projects and monitoring NVD for early exposure of CVEs. These methods help in detecting security issues before they become widely known. #GitHubSecurity #NVDAnalysis #CyberThreatIntelligence 🛡️ To mitigate the risks of early vulnerability exposure, the researchers suggest responsible disclosure practices, proactive scanning of open-source commits/issues/PRs, and implementing runtime protection strategies. These measures aim to minimize the gap between vulnerability discovery and patch release, reducing the opportunity window for attackers.
