In my experience, it's a common mantra that open source tends to be secure due to its availability for open scrutiny. I tend to agree with this. At the same time it's no secret that vulnerabilities are constantly discovered.

Moreover, I feel it's easy to imagine that developers very eagerly obtain libraries and tools and that are available in various repositories. I believe that these resources are regularly grabbed hastily for experimentation, and sometimes adopted into larger projects without much scrutiny (maybe besides a license compatibility check, and some assurance that the feature set matches what's desired)

What comes to mind is PyPI, Dockerhub, etc.

I would like to know if there are many documented cases of things like:

  • Successful malicious contributions to prevalent open source software
  • Smaller projects that popped up that could be considered malware under the guise of providing some simple but appealing functionality
  • Reports of foul play on attempted contributions

I understand that be best FOSS projects have high quality maintainers, but I also see this current world of nonstop spamming, phishing, spearphishing, identity theft and aggressive governments. I personally have a difficult time believing that bad actors would ever take a break from trying to make malitious contributions to these projects, given how they seldem take a break from their other nasty tasks.

  • 1
    Here is an Angular example (from slide 54). – Anders Dec 18 '16 at 22:56

Though your question is well formed and specific, the answers to them do tend to border on the 'generating discussion' side of things. I'm going to try and answer you as directly as possible.

Successful malicious contributions to prevalent open source software

There does not appear to be much at all in the way of documented evidence of this. Surely it has happened, but due to the very nature of OpenSource, where anyone with any amount of knowledge can submit a request to update the codebase there will always be the question of whether something that ends up being malicious was intentional or simply a mistake. The Heartbleed vulnerability in OpenSSL went unnoticed for 2 years, but was ultimately reported as a slip up by the user who uploaded the change and the admin that approved it.

Reports of foul play on attempted contributions

Back in 2003, there was an attempt by an unknown attacker to force a backdoor into the Linux kernel. They exploited the source-control practices at the time to insert the code directly into a secondary code repository rather than attempt to try and submit the code for peer review.

Because absolutely anyone can request a change to OpenSource code, there are going to be a huge amount of foul-play cases - Except all of the drama and reports of this happening will be within the message-boards and other communities for that software. The sort that you are looking for - news-worthy reported cases are much less likely. If the application is big enough to report on, then there tends to be plenty of approval steps in place to review the code first.

The bigger the application becomes the more 'potential' eyes on the code becomes. As a hacker, if you submit malicious code into a peer-review-based source-control such as Github, your going all-in and saying 'I hope you aren't reviewing this thoroughly, because I'm trying to do something nasty'. It would be much safer and less likely for you to be caught out (immediately, anyway) to try and get your malicious code out in other ways that aren't going to be audited such as a Man-in-the-Middle attack deploying a modified version of the application out to someone trying to download it. You would have greater control over the entire code-base and thus be able to hide your intentions all the better and - as you suggested yourself - very eager developers and users are much less likely to compare the digital signatures of what they are downloading than the app rovers who are the party that are the most-invested in the security of the code.

TL;DR - As an attacker, it's more reliable to push malicious code to an over-eager end-user than hoping that the admins who are passionate about their product aren't on the ball.

  • When I see something like this github.com/… -- basically a massive catalog of dependencies, not even most of which are pinned to a commit hash, I really wonder if would be easy for a resourceful attacker to build a graph of supply chain attack opportunities. If you can compromise a contributor of an obscure project many dependencies deep of a reputable project, then you've compromised the reputable project. – andyortlieb Apr 11 '18 at 12:46

Your Answer

