Have there been any case studies on intentional vulnerabilities or malware in open source projects?

Question

In my experience, it's a common mantra that open source tends to be secure due to its availability for open scrutiny. I tend to agree with this. At the same time it's no secret that vulnerabilities are constantly discovered.

Moreover, I feel it's easy to imagine that developers very eagerly obtain libraries and tools and that are available in various repositories. I believe that these resources are regularly grabbed hastily for experimentation, and sometimes adopted into larger projects without much scrutiny (maybe besides a license compatibility check, and some assurance that the feature set matches what's desired)

What comes to mind is PyPI, Dockerhub, etc.

I would like to know if there are many documented cases of things like:

• Successful malicious contributions to prevalent open source software
• Smaller projects that popped up that could be considered malware under the guise of providing some simple but appealing functionality
• Reports of foul play on attempted contributions

I understand that be best FOSS projects have high quality maintainers, but I also see this current world of nonstop spamming, phishing, spearphishing, identity theft and aggressive governments. I personally have a difficult time believing that bad actors would ever take a break from trying to make malitious contributions to these projects, given how they seldem take a break from their other nasty tasks.

Answer 1

Though your question is well formed and specific, the answers to them do tend to border on the 'generating discussion' side of things. I'm going to try and answer you as directly as possible.

Successful malicious contributions to prevalent open source software

There does not appear to be much at all in the way of documented evidence of this. Surely it has happened, but due to the very nature of OpenSource, where anyone with any amount of knowledge can submit a request to update the codebase there will always be the question of whether something that ends up being malicious was intentional or simply a mistake. The Heartbleed vulnerability in OpenSSL went unnoticed for 2 years, but was ultimately reported as a slip up by the user who uploaded the change and the admin that approved it.

Reports of foul play on attempted contributions

Back in 2003, there was an attempt by an unknown attacker to force a backdoor into the Linux kernel. They exploited the source-control practices at the time to insert the code directly into a secondary code repository rather than attempt to try and submit the code for peer review.

Because absolutely anyone can request a change to OpenSource code, there are going to be a huge amount of foul-play cases - Except all of the drama and reports of this happening will be within the message-boards and other communities for that software. The sort that you are looking for - news-worthy reported cases are much less likely. If the application is big enough to report on, then there tends to be plenty of approval steps in place to review the code first.

The bigger the application becomes the more 'potential' eyes on the code becomes. As a hacker, if you submit malicious code into a peer-review-based source-control such as Github, your going all-in and saying 'I hope you aren't reviewing this thoroughly, because I'm trying to do something nasty'. It would be much safer and less likely for you to be caught out (immediately, anyway) to try and get your malicious code out in other ways that aren't going to be audited such as a Man-in-the-Middle attack deploying a modified version of the application out to someone trying to download it. You would have greater control over the entire code-base and thus be able to hide your intentions all the better and - as you suggested yourself - very eager developers and users are much less likely to compare the digital signatures of what they are downloading than the app rovers who are the party that are the most-invested in the security of the code.

TL;DR - As an attacker, it's more reliable to push malicious code to an over-eager end-user than hoping that the admins who are passionate about their product aren't on the ball.

Answer 2

This article from June 2020 gives a more recent view on this problem: https://www.cpomagazine.com/cyber-security/malware-attack-on-github-repositories-a-disturbing-development-for-open-source-projects/

Quoting a security researcher at Github, .. that a total of 26 open source projects had been detected to have been serving the malware.

I guess we would need some anti-malware scanner for source code ...