Does open source "protestware" represent a security risk?

Question

Since the beginning of the Ukraine-Russian war, a new kind of software was created, which is called "protestware".

In the best case, the devs only add some (personal) statements about the war or uncensored information to the repositories or when starting the application. Since Github and other platforms are not banned in Russia, this could help to reach users and provide them with news.

The open source initiative wrote in a blog post, that's ok to add a personal statement or add some commit messages with information about the war to reach users with uncensored information.

But there are also projects which add malicious behavior. One example is the "node-ipc package", which deletes files depending on the geolocation. The affected versions also have their own CVE (CVE-2022-23812) which was rated with a CVSS of 9.8.

From a security perspective, it's best practice to install the latest version, which should fix security issues but not introduce new ones as a "feature".

But the node-ipc module showed that each maintainer/developer can add bad behavior to the software as a political statement.

Question:

• New software versions can be used as a political statement. As a user, should I be concerned about political messages in software?
• What should I do to mitigate malicious behavior?
  • I can't review the code of all used libraries and applications.
  • A lot of users do not have the knowledge to understand the code.

Answer 1

Political statements in software can be a concern for a few reasons:

• The may result in the software being banned in your country, so you should plan for that eventuality.
• They may result in the software being targeted (for example, the Notepad++ GitHub has been repeatedly spammed by Chinese accounts over its various version names). And this may turn into more dangerous attacks which could compromise the software.
• It may indicate that the author is more likely to make actual changes to the software down the line.
• It suggests that the software is probably developed by an individual, which can make it more fragile and susceptible various issues.

But if the software actively does something malicious, then it's not "protestware". It's just malware. So you should treat it the same as if the software decided to bundle a password stealer/cryptominer/ransomware/etc - using your existing supply chain and dependency management processes.

The author(s) should also be blacklisted in your internal processes so that you don't use anything they have written (or anything that depends on them) again.

It's also worth nothing that this isn't really anything to do with "open source". Adding political messages to software is just as easy with closed source projects, and adding malicious code is much easier, because it's harder to detect. Because of this, a lot of organisations are advising against using software from unfriendly countries (such as the FCC recently stating that Kaspersky is considered an "unacceptable risk to national security").

Answer 2

What should I do to mitigate malicious behavior?

I can't review the code of all used libraries and applications.

Agreed. Very, very few shops can afford to review all dependencies in depth.

But that is, IMHO, no excuse to (automatically) pull untested and unverified dependencies:

• When you get a new dependency, you at least smoke test it.
• When you upgrade your package-lock.json, you check what packages changed: In most situations, you can't verify them all in detail, but you can run an internal test of your software for any obvious malicious behavior.

Answer 3

Obviously yes

... but not because it is protestware.

Here's the bottom line: open-source software is something your org doesn't control. The people who wrote it have no legal obligations to your org for the simple and obvious reason that neither they nor your org have undertaken to form a relationship by which you could hold each other accountable. That is true whether or not the software in question is "protestware."

The truth is that anybody who uses software they didn't write is putting their fate in someone else's hands. The only thing that sets protestware apart is that we think we know the reason the software doesn't do what it says it does -- that reason being that the actual authors have deliberately broken their software as an act of political protest. But significant breakage can happen even when everyone is trying to do a good job: I remember back in 2016 there was an innocent problem with some widely-used library that ended up breaking everyone's webpack builds for something like 24 hours.

A person doesn't need a war to justify that kind of action. They don't even need a reasonable belief: there are plenty of very smart programmers out there who are also tin-foil-hat crazy. And the other side of that coin is that there are some organizations that a sane person would be justified in subverting. None of this changes the fact that every organization is 100% responsible for taking appropriate safeguards to prevent outsiders from interfering, deliberately or otherwise, with the pursuit of that org's objectives.

The onus is, and always has been, on consumers of third-party software to take precautions against the possibility that the software they consume may change in a way they don't like. That's true whether or not their goals diverge from the goals of the random outsiders whose software they consume. The "advent" of protestware does not change that fact whatsoever.