Risks of Software Dependencies AKA Toxic Dependencies

7 min readMar 28, 2024

Hello folks, today’s blog is all about how software dependencies can make your work simple but sometimes lead to trouble. In today’s fast-paced software development world, most projects don’t begin from scratch. Developers rely on existing libraries, frameworks, and tools to speed up the process. While this teamwork has its perks, it also brings a hidden danger: the risk of harmful dependencies.

Understanding the Dangers

Programming languages make the installation of third-party code very easy. Package management tools like pip(for python), gems(for Ruby), npm(for Javascript) make importing code simple. Yet, development teams often overlook code reviews for third-party dependencies, which can harbor vulnerabilities or, worse, code intentionally crafted for malicious purposes!

Imagine this: You’re working hard on a project and decide to use a popular library to save time. Things are going well until news comes out about a serious problem with that library like a vulnerabilty that can be exploited . Suddenly, your project is in big trouble.

Popular software packages are prime targets for hackers because they can potentially impact numerous sites or organizations, making them highly appealing targets.

Real-world examples vividly highlight how serious this threat can be:

Log4j —

Take Log4j for instance. It’s a crucial logging tool for Java developers. But in 2021, it was hit hard by the “Log4Shell” exploit. This vulnerability let attackers run code remotely, putting many Java applications at risk. Even unexpected targets like the Minecraft gaming platform were affected.

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

public class Log4jExample {

    // Define a logger using Log4j
    private static final Logger logger = LogManager.getLogger(Log4jExample.class);

    public static void main(String[] args) {
        // Log messages at different levels
        logger.trace("This is a TRACE message");
        logger.debug("This is a DEBUG message");
        logger.info("This is an INFO message");
        logger.warn("This is a WARN message");
        logger.error("This is an ERROR message");
        logger.fatal("This is a FATAL message");
    }
}

The code provided demonstrates the usage of Log4j, which is a popular logging framework in the Java ecosystem. Logging frameworks like Log4j are used to record events or messages that occur during the execution of a program. These messages can be useful for monitoring, debugging, and troubleshooting applications.

Ruby on Rails —

Rails smartly translates query parameters into model state, reducing the need for repetitive code. However, in Rails version 3.0, there was a vulnerability to arbitrary mass assignment. This meant that attackers could manipulate HTTP requests to overwrite protected data-model states.

Even big names like GitHub were affected, led to gaining unauthorized access through this flaw by hackers.

def _assign_attributes(attributes)
  multi_parameter_attributes = nested_parameter_attributes = nil

  attributes.each do |k, v|
    key = k.to_s

    if key.include?("(")
      (multi_parameter_attributes ||= {})[key] = v
    elsif v.is_a?(Hash)
      (nested_parameter_attributes ||= {})[key] = v
    else
      _assign_attribute(key, v)
    end
  end

  assign_nested_parameter_attributes(nested_parameter_attributes) if nested_parameter_attributes
  assign_multiparameter_attributes(multi_parameter_attributes) if multi_parameter_attributes
end

This Ruby code snippet make you understand how assigns attributes to an object, handling multi-parameter and nested attributes, commonly used in frameworks like Rails for processing incoming data from forms.

A mass assignment attack occurs when an attacker exploits a vulnerability in an application that allows them to manipulate and assign unintended or unauthorized attributes to an object in bulk. This often happens in web applications where user input is directly used to populate object attributes without proper validation or sanitization.

XCodeGhost —

Even our everyday development tools aren’t safe from threats. In 2015, security experts found a maliciously altered version of Xcode, the top OSX development tool, being used by hundreds of Chinese developers. Known as “XCodeGhost,” it aimed to swipe system data and inject harmful code into any apps made with Xcode. As Xcode is widely used for iPhone app development, this resulted in infected apps making their way into the iTunes store!

SolarWinds —

In 2020, SolarWinds, known for its network management tool Orion, fell victim to a “supply-chain attack.” Hackers seized control of the build system, allowing them to insert a backdoor into a security update. This update was downloaded by over 18,000 users, including US government agencies and Fortune 500 companies.

This is maybe how this attack took place explained by the microsoft.

Heartbleed(CVE-2014–0160) —

In 2014, the “Heartbleed” flaw was found in OpenSSL, a widely-used cryptographic library. A lack of proper bounds-checking enabled attackers to read significant portions of server memory. This vulnerability affected 1% of the world’s websites. If an attacker obtains a memory dump, they could potentially extract login credentials from it.

$ ./heartbleed.sh https://www.minkedin.com
 
Connecting...
Sending Client Hello...
Waiting for Server Hello...
  ... received message: type = 22, length = 66 
  ... received message: type = 22, length = 4  
Sending heartbeat request...
  ... received message: type = 22, length = 16384 
Received heart beat response:                          
  0010: 69 65 6E 5F 67 6C  .@./config/pwtoken_get?src= 
  0020: 73 3D 63 3D 31 33  illmap&ts=13912223139&utm_s 
  0030: 39 32 35 38 26 65  =dinVzQKfBzIw4zIzdLXzpwfleY 
  0040: 68 95 9A 53 6E 6E  &login=stoatlover@gmail.com 
  0050: 65 26 62 3D 39 26  &password=ilovestoats....Ca 
  0060: 20 73 38 31 2E 32  che-Control:privdate,.max-a 
  0050: 73 2D 2D 20 98 79  ge=0;Connection:Keep-Alive; 
  0070: OD 6F 6D 59 61 68  Content-language:en;Content 
  0080: 20 73 38 31 2E 32  -Type:text/html;.charset=UT

Risks

As a site owner, it’s crucial to recognize that development teams often skip code reviews for third-party dependencies. However, these libraries and toolkits can introduce vulnerabilities into your software. It’s essential to take proactive steps to ensure that code written by others doesn’t compromise the security of your system.

Risks abound when integrating commonly used software libraries into your systems:

SQL Injection vulnerabilities enable attackers to execute arbitrary SQL statements, risking data theft.
Cross-Site Scripting vulnerabilities empower attackers to execute harmful JavaScript in users’ browsers, potentially leading to malware infections.
Command Injection vulnerabilities allow execution of arbitrary scripts on servers, posing a risk of system takeover.

These vulnerabilities expose you and your users to data theft, malware infections, and potential system compromise.

Moreover, dependencies serve as a vector for “supply-chain attacks,” where attackers inject malicious code into third-party software. Researchers have demonstrated how easily this can occur via poorly configured build processes.

Defend

1. Automate Build and Deployment Processes

Set up automated processes to see what’s happening in your code and make deployment smoother. Keep detailed records of deployments and make sure all dependencies are clearly listed in your build scripts.

2. Deploy Known-Good Versions

Be careful when choosing dependency versions. Don’t just go for the latest one blindly. Instead, prioritize versions that you know are reliable, based on thorough review and testing.

3. Handle Private Dependencies with Care

When combining public and private dependencies, be cautious to reduce the risk of misconfigurations. Thoughtfully configure repository priorities to avoid confusion and potential security breaches.

4. Utilize Security Scanning Tools

Utilize specialized tools to scan your dependency tree for security risks. Many programming languages and utilities can detect compromised dependencies. Consider using one or more of these options:

Qwiet.ai
GitHub security alerts
GitLab security scanning
npm audit and retire.js for Node.js
bundler audit for Ruby
OWASP dependency-check for Java and .NET

5. Stay Informed with Security Bulletins

Ensure your team stays vigilant for security announcements regarding the software you utilize. Encourage them to subscribe to mailing lists, participate in forums, or follow library developers on social media. The development community is often the first to identify security issues.

6. Perform regular code reviews

Regularly conduct code reviews to ensure your entire development team is aware of the third-party libraries being utilized and which parts of your codebase rely on them.

7. Penetration Testing

Incorporate penetration testing into your development lifecycle. These tools will try to exploit known vulnerabilities, helping you identify any weaknesses in your technology stack.

Gain more

If you don’t yet use dependency management, you probably should start. Here are the most popular dependency management systems for some major programming languages:

Bundler for Ruby Gems.
Pip for Python Packages.
NPM for Node Modules.
Maven and Gradle for Java jars.
NuGet for .NET.
Composer for PHP.

Thats all for today’s blog see yall in next post.

keep the bytes …..