Open Source Malware: Everything You Need to Know

1. Introduction to Open Source Malware

What is Open Source Malware?

Open source malware refers to malicious software that is embedded within open source software packages. Since OSS is very diffuse—with collaborative use and maintenance—malware can easily be propagated to applications and systems at scale. Inherent in this trust-based model of OSS is the potential for security compromise. More specifically, malicious actors take advantage of this trust to inject harmful code. The 2023 State of Open Source Report, from OpenLogic and the Open Source Initiative, reveals that 84% of codebases contain at least one known open source vulnerability. That’s a red flag on the pervasiveness of security risks within open source software.

Read more about the problem in our detailed blog post on Open Source Malicious Packages.

The Importance and Growth of OSS

Open source software has truly become the cornerstone of modern software development, changing the way technology designs and fields across every imaginable industry. Consequently, this exponential growth and adoption naturally create room for solid security measures against newly arising threats. To that end, let’s consider a few key aspects of its importance and growth:

• Increased Adoption:

  • More than three-quarters of organizations have increased their use of open-source software in the past year.
  • The popularity of DevOps tooling, data technologies, and AI/ML tooling has contributed to this growth.

• Diverse Technologies:

  • OSS adoption no longer focuses on specific technologies like programming languages or Linux operating systems.
  • Organizations are now using open-source databases, data technologies, operating systems, Git repositories, AI/ML frameworks, and CI/CD tooling.

• Skills Demand:

  • Open-source skills are in high demand.
  • Talent shortages remain a barrier to the wider adoption of OSS.

• Challenges:

  • While OSS growth is positive, challenges persist.
  • Issues include configuration, installation, interoperability, and updates.
  • Organizations also face limitations in internal skills for testing, integration, and support.

2. The Appeal of Open Source Malware to Cybercriminals

Open Source Software (OSS) is a double-edged sword. While it drives innovation and collaboration, its open nature also attracts cybercriminals. Here’s why OSS is particularly appealing to them:

Ease of Access and Distribution

• Open Accessibility: The source code of OSS is publicly available, which makes it easy for cybercriminals to inspect, modify, and repurpose it for malicious activities. In particular, this has provided them with the opportunity to add malware into commonly used projects without much hassle.
• Wide Distribution: Furthermore, Once injected into an OSS project, malicious code can get very wide distribution within a very short time through the popularity of package repositories like npm, PyPI, and Maven Central.  As a result, this broad distribution amplifies the potential impact of the malware.

Exploitation of Trust

• Trust-Based Ecosystem: The OSS ecosystem operates on a high degree of trust. Contributors and maintainers often work collaboratively, with less stringent security checks compared to proprietary software. Cybercriminals exploit this trust by contributing malicious code or compromising maintainers’ accounts to inject malware. 
• Supply Chain Attacks: In this context, a large portion of the downstream applications and services will therefore be affected by attacks against the supply chain, all of which rely on that OSS component. For example, the event-stream incident famously used this technique, where a popular npm package was compromised for cryptocurrency theft.

Low Entry Barriers

• Minimal Verification: Moreover, very few package repositories verify their contributors. As a result, threat actors easily upload malicious packages, since the barrier to entry is low, utilizing disposable email and other fake credentials to carry out widespread attacks.
• Automation Tools:  Similarly, cybercriminals utilize automated tools to make a large number of malicious packages and distribute them, which further reduces the effort needed to execute an attack. Consequently, they can create a lot of malware variations to avoid discovery.

High Impact Potential

• Widespread Use: Given this, many OSS projects serve as base components of a large number of critical applications and services. Therefore, a compromise in such a widely adopted OSS may result in a ripple or cascading effect, impacting a lot of organizations and users across the globe.
• Delayed Detection: In addition, malicious code inside an OSS might stay undetected for a very long time, particularly if it is obfuscated or activated under specific conditions. Consequently, this delay allows attackers time to exploit the vulnerabilities before detection and patching.

3. Common Types of Open Source Malware

Malware in OSS can take various forms, each with unique characteristics and impacts. Here is an overview of the most common types:

Overview of Malware Categories

• Backdoor:

It is a class of malware that allows remote access to a device without detection and bypasses regular authentication. Attackers can take control remotely of the infected device via backdoors.

• Dropper:

Droppers install malware onto the system. They often serve as the initial or first-stage payload and deploy more sophisticated and advanced malware.

• Evader:

Malware developed to bypass the security software, which can involve obfuscation, polymorphism, and encryption.

• Generic Malware:

A broad category that will encompass a number of forms of malicious software like viruses, worms, and Trojans.

• Phishing:

The various techniques to deceive users in order to obtain sensitive information from them. Mostly, such emails or websites are fraudulent.

• Spyware:

The spying software can collect information about a person or organization without their knowledge and send it to another entity.

• Banke:

A range of Trojans set specifically to steal banking data, such as login credentials and account numbers.

• Trojan:

A type of malware that misleads the end-user about its intention. More often than not, it is masqueraded as genuine software.

• Keylogger:

Software that maintains a log of keystrokes made by a user. It is usually used for stealing passwords and other sensitive information.

• Stealer:

The malware is designed to steal sensitive data, such as passwords, personal information, and finance-related data.

• Bot:

A software application that automates certain tasks on the internet. Most botnets utilize it for various attacks, including DDoS.

• Ransomware:

A class of malware that encrypts a user’s data and then demands a ransom in return for the decryption key.

• Worm:

A type of malware that self-replicates in different ways over a network. It usually has destructive intentions. Miner: malware that hijacks system resources to mine cryptocurrency without users’ consent.

These types of malware illustrate the diverse methods and severe impacts of malicious activities within OSS. For an in-depth look at significant malware incidents, explore our detailed case studies on New Threats on the Block: Malware in Open Source Packages.