#USA #Salt Lake City #Strider Technologies #Geopolitical Risks #Open Source Software

Strider Technologies Unveils Alarming Risks in Open Source Software with New Report

Strider Technologies, a leader in strategic intelligence, has recently released a report detailing the presence of high-risk contributors connected to adversarial nation-states within popular open source software (OSS) ecosystems. This groundbreaking analysis sheds light on how these state-sponsored individuals are introducing vulnerabilities into critical software supply chains through subtle contributions.

A New Perspective on Software Security

The report, titled "Lying in Wait: Understanding the Contributors Behind Open Source Code," provides a thorough examination of the ways in which OSS platforms are being exploited. With examples from well-known platforms like GitHub, the findings underscore the evolving nature of geopolitical risks organizations face today. By examining the backgrounds of various contributors, the report highlights a trend where entities associated with countries like China, Russia, and Iran are actively participating in OSS development, potentially jeopardizing the security of software relied upon by corporations and governments.

"Open source software is foundational to today's digital infrastructure. Yet, often there is little transparency regarding who contributes code," stated Greg Levesque, CEO and co-founder of Strider. "Our research shows how nation-states exploit this lack of visibility to gain footholds, allowing them to introduce malicious code into software supplies. This highlights the necessity for companies and organizations to focus not just on the content of the code but on the identities of its contributors to safeguard their systems."

Real-World Implications of OSS Vulnerabilities

The report discusses how various state-sponsored groups, such as APT41 from China, the Lazarus Group from North Korea, and Cozy Bear from Russia, have manipulated OSS platforms to achieve their government’s strategic goals. These groups have turned into active contributors who leverage the open nature of these platforms to infiltrate software supply chains, as evidenced by recent their cyber espionage operations and high-profile incidents.

Noteworthy examples include attacks on Python's package index (PyPl), the exploitation of the Log4Shell vulnerability, and the insertion of backdoors into critical software components. These occurrences demonstrate the pressing need for increased vigilance and scrutiny in the management of open source contributions.

Strider’s Groundbreaking Analysis

Utilizing its sophisticated open-source software filtering technology, Strider has conducted an in-depth analysis of the contributors to the most popular OSS repositories. Alarmingly, they identified several pseudonyms with direct ties to state actors operating in high-risk nations. Highlights from the report include:

• - Over 21% of contributors to the `openvino-genai` project were flagged for having affiliations that pose security risks to nation-states, with two active contributors linked to multiple high-risk ecosystems. This project is central to modern AI inference workflows.
• - The OpenVINO toolkit has exceeded one million downloads and appears in 62 downstream projects, underscoring its significance in the tech community.
• - One identified contributor had previously worked as a full stack developer for MFI Soft, a U.S.-sanctioned software firm that aided a Russian federal communications intelligence agency.
• - Another contributor was formerly employed by Positive Technologies, a Russian IT company sanctioned since 2021 for facilitating malicious cyber operations associated with the Russian government.

The Need for Increased Vigilance

As the line between public and private sector software development blurs, the findings from Strider's report urge organizations to adopt a proactive approach in assessing the individuals behind the code they utilize. Companies must prioritize contributor identity verification as part of their software risk management strategies to mitigate potential threats from state-sponsored cyber attacks.

To access the complete report and learn more about Strider's innovative open-source software research tool, please visit Strider Technologies' official site.

About Strider Technologies

Strider Technologies empowers organizations globally to secure and develop their technological innovations by applying advanced AI technology and unique methodologies. The company converts publicly accessible data into essential insights, enabling proactive risk management against state-sponsored intellectual property theft and targeted talent acquisition. With operations in 15 countries, Strider's headquarters are located in Salt Lake City, with offices in Washington, D.C., London, and Tokyo.