search

ossf / wg-vulnerability-disclosures

The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability reporting and communication.
https://openssf.org
Apache License 2.0
175 stars 40 forks source link

Resources to help protect developers (humans) from attacks similar to the xz backdoor compromise #142

Open SecurityCRob opened 3 months ago

SecurityCRob commented 3 months ago

We discussed today in our call about the need to find, identify, and evangelize resources that are available to developers and maintainers to help detect social engineering, identify and defend against bully behaviours pressuring maintainers into making choices they otherwise would not have, and to help them cope with stress, self-care, and have a network of persons or resources to be able to reach out to in times of crisis.

We will be collaborating together to help assemble these resources and then make plans to help share them with the community.

SecurityCRob commented 3 months ago

for a very good timeline on the incident: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

nathan-menhorn commented 3 months ago

Just want to post a couple of links with decent references to social engineering:

https://www.ibm.com/topics/social-engineering https://www.eset.com/fileadmin/ESET/INT/Landing/2021/Project_progress/ESET-Social_engineering_handbook.pdf

However, it doesn't appear that there's anything open source developer specific resources - training or guides - so we may need to create our own document geared for the OS community based upon all the information that's currently out there.

taladrane commented 3 months ago

I saw this similar example from 2020 in the Software Supply Chain Security newsletter that we may want to reference:

One of the maintainers of the F-Droid project (an open-source Android app store) highlighted a similar incident from 2020 where a new contributor offered up a PR to improve search in the product, combined with heavy pressure from other accounts to merge the PR. In the end, they discovered that the PR introduced a SQL injection, and rejected the patch. Once the PR was rejected, the submitted deleted their account and disappeared…

underkay commented 3 months ago

I've been reviewing and collecting some government created resources around Insider Threat. The organizations and resources I've looked at so far are below.

The main challenge is very few of the behaviors/indicators of potential insider threat are relevant in the OSS community. Same with the mitigations. So, the fun part will be understanding/documenting the "normal" behavior for the OSS community and then extrapolating the indicators where insider threat activity is a possibility. An exciting challenge to say the least.

Resources so far: National Counterintelligence and Security Center https://www.dni.gov/files/NCSC/documents/nittf/20180209-CERT-Common-Sense-Guide-Fifth-Edition.pdf https://www.dni.gov/files/NCSC/documents/products/Insider_Threat_Brochure.pdf

CISA resources https://www.cisa.gov/topics/physical-security/insider-threat-mitigation https://www.cisa.gov/sites/default/files/2022-11/Insider%20Threat%20Mitigation%20Guide_Final_508.pdf

NATO CCDCOE https://ccdcoe.org/uploads/2018/10/Insider_Threat_Study_CCDCOE.pdf

nathan-menhorn commented 3 months ago

Thanks @underkay.

@SecurityCRob could you take an action for our meetings to see if our non-US members have access to the .gov resources? Thanks!

SecurityCRob commented 2 months ago

https://github.com/giuliacassara/awesome-social-engineering https://www.cmu.edu/iso/aware/dont-take-the-bait/social-engineering.html https://www.knowbe4.com/what-is-social-engineering/

SecurityCRob commented 2 months ago

https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks https://www.cmu.edu/iso/aware/dont-take-the-bait/social-engineering.html