Version: 2022-08-16
Introduction
anDREa B.V. takes information security very seriously. We recently engaged in the ISO 27001 certification process. Moreover, we are subscribed to several security news feeds. As a result, we will post awareness articles from time to time with relevant and topical information security news. For instance, take a look at the
Awareness - MFA protects but make sure the website is okay article. The topic of today's awareness article is the rising prevalence of malicious code packages in repositories.
How secure are repositories?
Many open source software such as R and Python use repositories as an archive for packages and their dependencies. The most well-known repositories are the Comprehensive R Archive Network (CRAN), Bioconductor, the Python Package Index (PyPI), Anaconda and Github.
At the moment, some of the above-mentioned repositories are reachable via IP-whitelisting in your myDRE workspace (CRAN, Bioconductor, Anaconda). PyPI and Github are not reachable due to dynamic IP address range of these repositories. With the upcoming feature domain whitelisting, it would be possible to reach certain domains. But how secure are these repositories?
Increase in incidents
Daily, a sheer amount of packages and package updates are submitted to repositories. The packages contain code which do not always include the source. For example, R packages are not signed with private keys which makes it difficult to verify the identity of the creator.
Installation of R and Python packages happens on a huge amount of machines every day with just a simple command, which makes it an interesting target for malicious intent. There is a real possibility of submitting malicious code into the repository without it being noticed. For example, PyPI recently removed 10 malicious code packages which contained information-stealing malware (read more here:
https://www.darkreading.com/application-security/10-malicious-packages-slither-pypi-registry). The packages were designed to mimic popular packages on PyPI.
What can you do?
As a developer or researcher, you could be doing everything right security-wise, but a single vulnerability can leave you vulnerable despite your efforts. More and more package managers are starting to include vulnerability checks as part of the workflow, but not all!
Staying up-to-date with all the reported vulnerabilities is almost a fulltime job. These vulnerabilities are registered in the Common Vulnerabilities and Exposures (CVE) feed from the National Vulnerability Database (NVB). However, looking up every package you use and finding out which version is vulnerable might be quite tedious. Something that could be of help is Sonatype’s Open Source Software (OSS) Index.
OSS Index is a free service that lets you check if any repository has known and reported vulnerabilities. However, be aware of two things:
- The OSS Index does not provide remediation advice.
- If the OSS Index does not show any vulnerability then it does not necessarily mean that the package is free from vulnerabilities, it just has not been reported (yet).
Policies of the repositories regarding package security
- Anaconda provides extensive documentation about CVEs on https://server-docs.anaconda.com/en/latest/admin/cve.html.
- Bioconductor does some technical review on packages but it does not specifically target security vulnerabilities (https://support.bioconductor.org/p/132235/).
- CRAN policies mention that code may not have malicious intent or be anti-social, however a more detailed answer can be found in the blog post about R package security on https://support.rstudio.com/hc/en-us/articles/360042593974-R-and-R-Package-Security.
- Github provides extensive documentation about code security and how to report and scan for CVEs on https://docs.github.com/en/code-security.
- PyPI provides some information about the checks that are being performed on new submissions on https://warehouse.pypa.io/development/malware-checks.html.