The Source Code Detectives

15 August 2024

Whether in smartphones, healthcare, the energy sector or other critical infrastructures, open-source software is used everywhere. And it’s the job of the experts at TÜVIT to test such software for security gaps and vulnerabilities.

Shortly before Christmas 2021, the German Federal Office for Information Security (BSI) issued a red alert: A critical vulnerability had been discovered in the open-source application known as “Log4j”. This had been used for many years by large tech companies such as Apple, Amazon, Tesla and Google, but also by many German authorities. “Everyone was really nervous because no manufacturer, hospital or energy supplier knew whether their IT products contained a version with the Log4j vulnerability,” explains Dietmar Rosenthal, an expert in source code analysis at TÜVIT. This concern was not unjustified: Cybercriminals around the world were carrying out attacks and exploiting this vulnerability. Systems and servers around the globe were shut down to install security updates. The attacks rendered some digital services temporarily unavailable.

The Log4j crisis sent shockwaves through in the IT industry. Log4j is by no means the only open-source software (see box) that is found in programs or devices. “In fact, there’s not a single IT product in the world that doesn’t contain open-source software,” says Rosenthal. The programs that control our smartphones, TVs and Wi-Fi routers are often 90 percent made up of open-source software components. “Manufacturers always use them when they’re looking for standard solutions that many others have already used,” explains the expert. This saves time and personnel, which means that it saves money. This is because open-source software is not tied to one particular manufacturer. So, you don’t have to buy it or pay royalties for its use. Instead, coders can use and reproduce it free of charge if they adhere to the terms of use. They can also adapt the software to their own needs.

The source code of open-source software is public and roughly equivalent to the blueprint used in software development. It contains all the details and instructions for a working program. With open-source software, anyone can check and modify the source code. In the best-case scenario, it will be continuously improved by a large developer community. But the downside is that vulnerabilities can arise as the software is developed. And if they are not found and eliminated quickly enough, these can, as in the case of Log4j, be exploited by cybercriminals. Source code analysts like Dietmar Rosenthal and his team at TÜVIT are responsible for detecting such vulnerabilities.

The experts at TÜVIT test highly specialised software and hardware products in which the open-source components are not off-the-shelf, but tailor-made. “It’s often no longer possible to infer from the product which open-source components have been used in it. That’s why we analyse the source code,” Rosenthal says. The key questions concern the components used in the product and whether they are being used securely. “In the past, people used to trust a product because they trusted the manufacturer. This isn’t a viable option anymore. Today, people look to see if the product that’s been developed is secure,” explains Rosenthal. The principle is known as “Security by Design”.

Politicians have also recognised this and included the term in the Cyber Resilience Act (CRA). With the CRA, the European Commission is creating legal cybersecurity standards for connected devices and services in Europe. In Germany, the legislator has so far required evaluations of operators of critical infrastructures and areas with a high interest in data protection, such as the health and energy sectors, for example. Products such as electronic health cards or smart meter gateways may only be used with a certificate. Smart meter gateways shield the home networks of electricity customers, among other things. “Manufacturers should think about source code security right from the product development stage,” says Rosenthal.

TÜVIT has been recognised by the BSI as a testing body for security evaluations according to the international standard of the Common Criteria since 1991. The experts test the software and hardware of routers in hospitals, for example. E-health connectors of this kind connect, for example, a patient’s electronic health card with the telematics infrastructure on which the sensitive patient data is stored. “These routers themselves must be so secure that no security gaps can arise during their use,” says Rosenthal. TÜVIT’s expertise is also in demand when it comes to digitalisation in the energy sector, where smart meter gateways are used to establish the connection between the electricity supplier’s grid and the end customers.