Senate Intel Chair Warns of Open-Source Security Risks

The chairman of the Senate Intelligence Committee is pressing the White House to confront what he describes as a growing national security blind spot inside the open-source software ecosystem.

See Also: Merging Without Mayhem: PAM Strategies that Work

In a Wednesday letter to National Cyber Director Sean Cairncross, Sen. Tom Cotton, R-Ark., warned that foreign adversaries – particularly China and Russia – are exploiting the trust-based nature of open-source development to insert malicious code into widely used software projects relied on across federal networks.

“OSS is the backbone of U.S. government systems, including mission-critical defense systems, where we reap the numerous benefits of OSS to innovate, develop and deploy technology quickly,” Cotton wrote. “However, leaving our reliance on OSS unmonitored is exposing America to increasingly dangerous risks.”

The senator pointed to last year’s discovery of a backdoor planted in XZ Utils, a core compression library used across Linux distributions. A developer using the name Jia Tan succeeded in manipulating the utility’s maintainer into including code that contained a backdoor in a scam that unfolded across two years. The backdoor was discovered shortly after it went into production, likely averting a major crisis – but it was an example of how a threat actor can spend years building trust before executing a compromise that impacts entire software supply chains (see: Backdoor Found and Defused in Widely Used Linux Utility XZ).

Cotton said he was concerned about foreign operators maintaining deep, undetected access within software stacks approved for Department of Defense use, including a Russia-based developer overseeing fast-glob, an open-source component integrated into numerous DoD packages. He also noted how “Chinese giants like Alibaba and Huawei are ranked in the top 20 contributors worldwide” for open-source.

Cotton urged the Office of the National Cyber Director to take on a central coordinating role, arguing that the office is best positioned to lead a government wide effort to monitor foreign influence across open-source projects and maintain visibility into who is building and maintaining the code the federal government depends on. He also called for enhanced federal capabilities to track the origin of open-source contributions and assess risk associated with developers operating in adversary nations, describing the issue as a major vulnerability spanning across civilian agencies, defense systems and critical infrastructure.

The federal government continues to struggle with balancing the speed and cost advantages of open-source software with security risks. Cotton pointed to recent Defense Department actions as evidence that the national security community is already shifting its posture, citing Pentagon guidance directing officials to avoid software susceptible to adversarial foreign influence and to prevent hostile actors from introducing malicious capabilities into defense systems.

The U.S. government “doesn’t understand what OSS they have or IT coming over the transom in any meaningful way to assess risk,” John Scott, senior vice president of Rivada Select Services and longtime champion of military adoption of open-source technology. “It gets worse when patches and updates come in weekly, with little vetting beyond known software vulnerabilities, so all the unknowns come in with unknown provenance,” he told Information Security Media Group.