Exploring the True Threat of Malicious Code vs. Vulnerabilities

In this episode of Open Source Open Mic, Andrew Garrett and Sonatype Senior Product Manager Dariush Griffin discuss the critical differences between vulnerabilities and malware, including how exploitability, reachability, and malicious code impact software supply chain security. They explore why malware requires immediate response, how teams should prioritize vulnerabilities, and how automation can help developers cut through security noise and focus on the risks that matter most.

Transcript

0:03: So your security tools are screaming about vulnerabilities, and in the headlines, we keep hearing about malware.

0:10: But here's the real question, do you know the difference between the two and which one matters more?

0:16: Let's break it all down today on this episode of Open Source, Open Mic.

0:22: This is Open Source Open Mic, the podcast where we talk about everything happening in the world of open source security.

0:29: So pull up a chair, it's time for an open conversation.

0:35: Hello everyone, and welcome to another episode of Open Source Open Mic, the podcast where we discuss all things in the world of open source security.

0:43: My name is Andrew Garrett, and I'm a product marketing manager here at Sonatype, and I am pleased to be joined today by Dariush Griffin.

0:52: Dariush is a senior product manager over the software composition analysis products at Sonatype, and he is based in Austin, Texas.

1:00: And I'm very glad to have him joining us today on this episode.

1:05: Dariush, is there anything you would like to add about your background before we get started?

1:10: Yeah, thanks, Andrew.

1:11: It's a pleasure to be here and, yeah, so I've been in this industry now 19 years. I've been working specifically in open source software security now for the last 12 years.

1:21: I’ve seen quite a growth, especially with the rise in AI recently.

1:27: It's a really exciting time to be in the industry.

1:30: So yeah, happy to be here to talk about this topic.

1:33: Absolutely.

1:35: Yeah, well, our topic today is one that I think will be of interest to our listeners.

1:41: It's all about the difference between a vulnerability and exploitability.

1:45: So, let's set the stage, let's just start with the basics and get everybody on the same baseline here.

1:53: First off, what is a vulnerability?

1:56: And then let's talk about malware as well.

1:59: So what's a vulnerability? What is malware?

2:01: So there's a common misconception that a vulnerability and malware are the same thing, but they're not.

2:10: A vulnerability is a bug in your code or an open source product.

2:20: A vulnerability might be something like this application doesn't sanitize its inputs.

2:41: So there's some bug that allows an attacker to exploit the software and gain access to restricted data or elevate their permissions.

2:57: Malware is more like a traditional virus.

3:02: Like when you download a trojan off the internet or get a spam bot on your machine, these are instances of malware.

3:10: So this isn't necessarily a bug in the open source code.

3:17: This is literally a virus that is included with whatever it is that you are downloading and consuming.

3:25: The way in which these manifest are also distinct.

3:31: A vulnerability will manifest because there is a bug in the code; malware is typically introduced because someone gains committer credentials and hijacks the application to be a virus or to do something malicious.

4:20: The intent behind the two is important: a vulnerability can be an accident, while malware involves malicious intent.

5:41: OK, so let's talk about vulnerabilities a bit more.

6:01: Because they are bugs or oversights in the code, attackers can find these bugs and leverage them to gain additional access to things they shouldn't have access to.

7:07: Vulnerabilities can become a problem for applications when attackers exploit them.

8:18: Leaving a window open is like leaving a vulnerability unremedied.

9:04: As we said, malware is intentional; the bad actors actively look for windows to exploit.

9:23: Malware typically enters through compromised open source packages.

12:04: For malware, there’s no instance where malware is ever acceptable. If you have malware in your systems, it’s a serious situation that requires immediate damage control.

12:57: Vulnerabilities require someone to attempt to exploit them.

13:18: Reachability is analyzing the code of the application to see if there’s a path from the application to exploitable code.

19:58: Many teams struggle due to alert fatigue; the tooling doesn't distinguish between malware and vulnerabilities.

23:05: You want absolute prevention of malware throughout your entire network.

24:14: Policies and automation are critical to help teams understand the application context.

28:31: Well, thanks Dariush. This has been great speaking with you today and learning more about vulnerabilities and malware.