December 17, 2019

Open Source: Democratizing Cyberattacks.

The dark side of open source

Perception Point

Open source refers to any software that is freely available to modify and share. The core of open source is that it is accessible to a wide community which collaborates to constantly improve it, provide more features, and expand functionality. When we talk about open source software, we are simply referring to applications that exclusively use code and functions that are considered open source. However, there are countless applications today, even proprietary ones that have sole access to their code, which use open source functions and tools.

Open source has quietly become a staple of software development, offering fast and free solutions that developers often don’t have the time or resources to build themselves. Instead of generating entirely new applications, teams can take open source libraries and modify them to suit their broader needs. The idea of open source comes from the early 1990s tenet of the hacker community that information should always be free.

Instead of using “big box” applications and solutions produced by corporations, communities of independent developers built their own tools for free, often constructing applications that have become staples of the corporate world (Linux, is perhaps, the best example). Today, it’s hard to find a code repository that doesn’t include at least some open source code, which is both a good thing and a bad thing.

Open source has streamlined innovation in a significant way while paving the way for amazing apps to be crafted, but it doesn’t come without drawbacks, chief among them being security. The same concepts of shared access and information can—and have been—inverted on the darker side of the web. Hackers are democratizing cyberattacks with massive open source repositories of destructive malware. Whereas hacking was once the purview of those with extensive coding and social engineering skills, these dark repositories offer even the most amateur aspiring hackers tools that can cripple entire networks with a few keystrokes.

“Hacking is big business and very well organized today,” noted one expert, adding that “Organized crime syndicates and terrorist organizations are all trying to scam and steal bank account or credit card information, and other personal data while foreign governments are mainly interested in stealing intellectual property or industrial secrets for profit or technical gain.”

This growing community of black-hat hackers has warped the founding principles of open source to harm users and avail themselves of private and sensitive data. What’s worse, they can do so using live malware that carries the very same General Public Use (GNU) licenses that legitimate open source applications do.

The ease of access to this malware has opened the floodgates, and it may be at least partly responsible for the shocking spike in cyberattacks over the past few years. Breaching a secure network no longer requires technical skills or know-how; you simply need to know which tools to search for and look up a tutorial online.

To see this play out in the real world, look no further than the Social Engineering Toolkit. This clever Linux-based application was originally built as a penetration tester to strengthen cyber defenses, but today you can find a tutorial on Google on how to use it to break into Windows step-by-step. The Toolkit itself does most of the heavy lifting, though, tricking users into sharing credentials and baiting them to click on phishing links. Even a beginner could simply choose which attack module to run, modify a few configurations, choose the appropriate malware, and deploy a “test”.

The Social Engineering Toolkit may be an educational and positive tool, but it’s only the tip of the iceberg when it comes to the tools available to enterprising hackers today. Indeed, you could find a tool to steal WiFi credentials (AirCrack-NG), an application to brute-force passwords (Hydra), or simply go for an all-around penetration tool (the widely popular Metasploit). In most cases, you won’t need more than a few details and the ability to install programs onto Linux to get started.

For organizations that must contend with the rising frequency of cyberattacks, this newfound access means uncovering novel ways to prevent becoming prey for hackers. Education and research should be priorities, as well as toughening defenses. In an ironic twist, many of the tools in use today are derived from (or in the case of the Social Engineering Toolkit, for instance, are) testing and security apps themselves. Moreover, organizations should constantly audit their own defenses, strengthening weak points, maintaining updated tools, and preventing attacks in the first place. More importantly, however, they must be capable of adapting to an ever-changing threat landscape.

Despite the threats posed by open source, its value to the developer community and even the corporate world means it isn’t going anywhere. This newly democratized tech world indicates that we must take the good with the bad, and for organizations, it implies being prepared. By staying alert and vigilant, you can harden your defenses and avoid falling prey to an attack.

Contact Us

Connect with our team to:
* Learn more
* Get a live demo
* Get a quote
* Set up a free 30 day trial

We will respond to your enquiry within 24 hours.

info@perception-point.io
Link has been copied to your clipboard!