Categories: CyberCrimeSecurity

Open Source Groups Warn Of Ongoing Attacks

Two open source groups have warned of ongoing takeover attempts by malicious actors similar to one that affected a widely used component earlier this month.

Researchers at the OpenJS Foundation, which backs JavaScript-based projects, and the Open Source Security Foundation (OpenSSF) said they had blocked a “credible” hacking attempt affecting a popular JavaScript project and warned that other attacks may follow.

The researchers said a developer “wanted OpenJS to designate them as a new maintainer of the project despite having little prior involvement”, said OpenJS Foundation executive director Robin Bender Ginn and OpenSSF general manager Omkhar Arasaratnam in a joint statement.

The moves recalled a recent infiltration effort by a threat actor going by the name “Jia Tan” that targeted XZ Utils, a compression tool widely used in Linux systems, Ginn and Arasaratnam said.

Open source attacks

The attack on XZ Utils was developed over several years until it was finally uncovered earlier this month.

The researchers said OpenJS did not grant privileged access to the project that was targeted, adding that two other popular JavaScript projects that OpenJS does not host had also seen suspicious patterns.

OpenJS has reported the incident to the Cybersecurity and Infrastructure Security Agency (CISA) and the US Department of Homeland Security.

The researchers warned open source developers to remain alert for further attempts to compromise open source projects via social engineering methods.

Vulnerable ecosystem

Chris Hughes, chief security advisor at open source security company Endor Labs and a Cyber Innovation Fellow at CISA, said about one-quarter of all open source security projects have only one maintainer, with 94 percent having fewer than 10.

He said the open source ecosystem is highly opaque, with projects critical to digital infrastructure being maintained by individuals scattered around the world and often using unknown aliases.

“Many OSS projects are maintained by a single individual or small group of individuals – often in their spare time as a hobby or passion project and typically without any sort of compensation,” he said.

“This makes the entire ecosystem vulnerable to malicious actors preying on these realities and taking advantage of overwhelmed maintainers with a community making demands of them with no actual compensation in exchange for their hard work and commitment to maintaining code the world depends on.”

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

EU Widens Investigations Into Chinese Imports, Subsidies

After the United States imposes 100 percent tariffs on certain Chinese goods, Europe widens its…

23 hours ago

Reddit Deal With OpenAI Gives ChatGPT Access To Content

OpenAI strikes deal with Reddit to train its AI tech on user posts and give…

1 day ago

Microsoft Invests 4 Billion Euros In France For AI, Cloud

Global spending spree from Microsoft continues, with huge investment for new data centre to drive…

1 day ago

Toshiba Axes 4,000 Staff In Post-Delisting Restructuring Operation

Workforce blow. Newly privatised Toshiba has embarked on a 'revitalisation plan' that will entail the…

2 days ago

European Union Opens Child Safety Probe Into Meta

European Commission opens an official child safety investigation into Facebook and Instagram-owner Meta Platforms

2 days ago