Katie Norton of IDC recently posted a great piece on the real risk of the open source software ecosystem following the discovery of XZ Utils Backdoor vulnerability. In her words, "The widespread use of OSS by large organizations maintained by volunteers is a poorly kept secret." In a recent blog post about the incident, security researcher Bruce Schneier put the problem bluntly: "We simply have to stop building our critical national infrastructure on top of random software libraries managed by lone unpaid distracted — or worse — individuals." More than 80% of companies use a majority of OSS in their software development. That's not likely to change. What's needed is for developers and security leaders alike to ensure their entire software supply chain is secure from development to device. Headed to #RSA? Stop by JFrog's booth 455 in the South Hall. We'd love to have a chat. Read the blog on the XZ Utils Backdoor https://lnkd.in/eHcqc3Nc IDC (subscription required): The xz Utils Backdoor and Securing the Open Source Software Supply Chain #JFrogSecurity
Katie Norton
1mo
Thank you so much for your kind words and for sharing, Deborah! Shout out to Michele Rosen who I collaborated with on this document. She is covering the open source ecosystem at IDC and we will be collaborating a lot around open source security!
Patricia Pouncey
1mo
Interesting and insightful article Deborah!
The social engineering aspect related to the XZ backdoor vulnerability combined with the use of data obfuscation techniques to embed the key is the extremely concerning part. These techniques are not new but the relentless frequency of attacks have been intensifying to disrupt software supply chains and erode trust. Someone or some group spent years setting up the situation and waited to create a coordinated attack. Even the back and forth chats between the replacement committer and an open-source user reporting a bug and goading the maintainer to relinquish ownership of the repository and update the code faster is suspect. Unfortunately the whole situation is a major blow to the open-source community, however, software today is so complex that most organizations and individuals don't completely understand how the code they are using works, and use it blindly to provide integrated solutions at a lower cost and faster speed to meet upstream demands. It's the responsibility of larger enterprise companies to fork open-source code, inspect it thoroughly before use in commercial products, and own/support any issues that are related related to derivative products, however, few actually do.