Open source software dependencies have dependencies

It is derived from the wild west of free and open source software packages like Log4j on GitHub and elsewhere. If experts identify the software supply as a key security challenge for 2023, the Log4j phenomenon - not to mention the much-better known Sunburst malware incursion (popularly referred to as the SolarWinds attack) in December, 2020 - shed light on how protecting the process could be difficult: A vast amount of commercial software is not written in-house. SEE: Iranian state-aligned threat actor targets new victims in cyberespionage and kinetic campaigns (TechRepublic) Since then, there have been tens of millions of attempts to compromise the Log4jShell flaw. The weakness was just one recent example of a backdoor in open source software for attackers to sneak malicious code onto developer and end-user systems. It was almost exactly one year ago that experts found the infamous Log4Shell error message vulnerability in the open source Java library Apache Log4j 2. A new study looks at the open source community’s efforts to “credit-rate” the risk.

Open source code for commercial software applications is ubiquitous, but so is the riskĪs the SolarWinds and Log4j hacks show, vulnerabilities in open source software used in application development can open doors for attackers with vast consequences.

Code writing programs