Tzachi Zornstain Head of CxDustico at Checkmarx Presentation Outline 1. Refresher on recent OSS attack, establishing: - A quick baseline of terminology and concepts, plus a focus on recent major attack found (PHP, Dependency confusion, etc) 2. Lack of visibility The Python Package Index (PyPI) deals with this issue by simply removing the malicious packages without publishing its code or metadata to a central point where the package could be found and researched. Quite similarly, NPM removes all Code and Metadata and place a generic “security holding package” label on the package webpage, although it does publish a security advisory with varying levels of specificity. Researchers are unable to learn from detected malicious packages. no IOC/contributor data = no hunting for more code packages. 3. Lack of validation One example is the process of publishing a python package to PyPi allows the publisher to link a GitHub repository to the package, then, PyPi pulls the repository statistics straight from GitHub and presents it on the package web page. The problem is, there is no validation of the connection between the package and the repository. We will demonstrate this technique we came to call StarJacking . 4. Lack of awareness The entire ecosystem is focused on detecting known Vulnerabilities, many security teams believe this risk Is cover under SCA products. This is not the case, Vulnerabilities ≠ Malware. We need a mindset shift and new technology stack to detect attackers in code packages. Reactive Vs Proactive, Static signature Vs Dynamic execution 5. Looking ahead Most of what we do today in the field of malicious open-source software can best be described as patch management. The “cyber” point of view has yet to enter this game. In this spirit, some thoughts of where we should be heading: • Malware zoo - code package hatchery • Sandbox for files - detonation chambers for dynamic analysis of code • Cross language detection • TTP’s • Bonus – contributors' reputation Other talks at this conference 🚀🪐 https://www.conf42.com​/python2022 — 0:00 Intro 0:24 Talk