Why You MUST Audit Open Source Tools Before Use

Last week, a counterfeit version of the widely used open-source script LinPEAS was found to contain a hidden remote logging feature. This discovery highlights a critical lesson for developers and organizations alike: always verify open-source tools and scripts, ensuring they come from trusted, original sources.

In this short, Andrew Bellini dives into the technical details behind this incident and shares actionable insights to help your team stay secure when using open-source software.

Stay informed and safeguard your workflows-watch now!

#linpeas #infosec #hacking #opensource #shorts

Our Linux courses in the TCM Security Academy include:

📱Social Media📱
___________________________________________

💸Donate💸
___________________________________________
Like the channel? Please consider supporting me on Patreon:

Hacker Books:

My Build:

My Recording Equipment:

[mohammadkamrul]

How do i verify or Audit open source softwares?

[smreha]

First video I saw from you and subbed.
Very rare for me. Masterfully explained.

[datasilouk]

Very interesting, thanks. Although I found the background music is too loud and distracting.

[xbazka]

His keyboard sounds are really soothing

[KDSBestGameDev]

The companies I work for require me todo that. If I use a open source library in code or a plugin in an ide or so. I have to sign with my blood and soul that this is trusted.

We also fork open source code so that no random new stuff might get injected and so on.

Pain in the ass but secure.

[naesone]

This short cured my depression literally it motivates me to keep going

[redcrafterlppa]

On scripts I also glance over them. But open source software is too much. Most opensource tools are too big to check all lines of code.

[deano_sk]

What's the point in collecting that data specifically? Username and hostname etc. like what value does that really have?

[duarteribeiro]

Why would you click that one though when the github one is right under

[sale]

Exactly why linux is not a good desktop for regular users but power users / servers only.

[respise]

so what's wrong with it? there no any sensitive data it. why this example shows i need to to audit open source?

[sharathkumark]

Can anybody explain how this information is useful for the one who receives it?

[DanielKreimendahl]

Nothing "sketchy" about it. They've built automatic reporting into an audit tool. It is smart. Instead of crying foul you should modify it to send the reporting to an in-house repository so that you will automatically have it for inclusion in your final report or to be used in a follow-up tool.
Often I will break down the work required to produce an intended result into a series of tasks. I'll script each task separately and save the output as input for the next task. I do this because many solutions break down to tasks that are common to other solutions. I then have what I need to chain calls to these scripts into various solutions.
To claim that an open source tool provider is surreptitously gathering data for nefarious purpose is absurd. It is open source. Their user base can cat the script and easily recognize http transacts as it flies by on the console, if they can't they're probably in the wrong profession. I'm not sorry to call this out as a false alarm intended to generate views.

[ProtoType]

i am a simple user i vm everything i do not trust if it performs fine in a vm then its life will be in a vm