As background, over the last couple of weeks I re-watched an old-favorite, Austin Powers (I was once Dr. Evil for Halloween) and I read A.I. Apocalypse (http://aiapocalypse.com/) by William Hertling, which involves malicious viruses taking over millions of computers and them becoming self-aware.
This got me thinking about how an evil genius (or government agency) might try and infect or control millions of machines for nefarious purposes which led me to wonder about all the software that auto-updates or auto-fetches whether through yum, maven, npm, cpan or even chrome and firefox.
So my question is, how secure are those mechanisms? Would it be possible to install malicious versions of popular open source libraries? I understand there is signing and such, but what about getting something in the build before signing happens (e.g., alter the checked out code). Like, say blackmailing a build engineer or hijacking a build system?
I'm asking because I've been using these systems for years and never really considered how to know if library X is actually 'clean'. I suspect many software developers are like this - just running 'apt get' or 'npm install' or 'yum update' or 'mvn' or 'brew install' or ... what have you.
Have other developers wondered about this? Do the security heads at these repositories lose sleep over this?
P.S. I'm not an evil genius or government agency.
P.P.S. Of course, who would admit to being an evil genius or from a government agency?
This got me thinking about how an evil genius (or government agency) might try and infect or control millions of machines for nefarious purposes which led me to wonder about all the software that auto-updates or auto-fetches whether through yum, maven, npm, cpan or even chrome and firefox.
So my question is, how secure are those mechanisms? Would it be possible to install malicious versions of popular open source libraries? I understand there is signing and such, but what about getting something in the build before signing happens (e.g., alter the checked out code). Like, say blackmailing a build engineer or hijacking a build system?
I'm asking because I've been using these systems for years and never really considered how to know if library X is actually 'clean'. I suspect many software developers are like this - just running 'apt get' or 'npm install' or 'yum update' or 'mvn' or 'brew install' or ... what have you.
Have other developers wondered about this? Do the security heads at these repositories lose sleep over this?
P.S. I'm not an evil genius or government agency.
P.P.S. Of course, who would admit to being an evil genius or from a government agency?