June 2023 Summaries

Open source software enhances developer productivity by allowing them to focus on unique application features rather than reinventing standard functionalities, but it also introduces security risks due to vulnerabilities in open source components. Developers increasingly spend time managing these vulnerabilities, and call graphs can be a valuable tool in understanding whether a vulnerable method is reachable and potentially exploitable in a client application. The complexity of real-world call graphs, which consist of numerous functions and invocations, can be mitigated by annotating them with vulnerability information, allowing developers to identify and design countermeasures for problematic invocations. The process involves pruning the call graph to focus on paths leading to specific vulnerabilities, such as CVE-2023-26049, and further refining it to reveal potential invocation paths clearly. This approach helps developers to assess the exploitability of vulnerabilities and to design client-specific mitigations if necessary, especially when dependency updates are not feasible. Through this methodical drill-down, developers gain essential insights into potential invocation and exploitation scenarios, enabling them to implement effective safeguards for their applications.

Different Software Composition Analysis (SCA) tools can yield varying results when scanning the same project due to differences in scanning techniques, data sources, and whether a tool is built in-house or sourced from open-source providers. Scanning techniques such as package manifest scanning, semantic analysis, checksum-based scanning, source code scanning, and dependency graph scanning each offer unique strengths and weaknesses, impacting the detection of vulnerabilities and dependencies. The data and information sources that tools rely on, including timeliness, sources, and quality of vulnerability and license data, play a crucial role in the results. Additionally, the choice between building a custom scanning engine and using an open-source one involves trade-offs in terms of cost, accuracy, and capabilities. Effective use of SCA tools involves understanding the supported programming languages, strategically placing the tool within the software development lifecycle (SDLC), and setting up policies to prioritize actionable results, considering factors like fixability and vulnerability reachability.

In the realm of .NET development, ensuring security and maintaining a consistent development environment is increasingly challenging due to the complexity and reliance on third-party libraries. The introduction of the `packages.lock.json` file in NuGet 4.9 and above has significantly enhanced the ability to maintain secure and consistent package installations. This lock file captures precise information about package versions and dependencies, preventing unintended upgrades that could introduce security vulnerabilities. By integrating `packages.lock.json` into the development workflow, developers can ensure secure version pinning, controlled package updates, and enhanced reproducibility of builds, which are critical for security audits and consistent project behavior across environments. Tools like Endor Labs leverage this file for dependency scanning and vulnerability assessment, further reinforcing the importance of this approach. Overall, the `packages.lock.json` file is a crucial tool for developers aiming to achieve a secure and stable .NET development environment.

Endor Labs is promoting its presence at BlackHat 2026 in Las Vegas, where it will showcase discussions on scaling open-source security through a webinar. The webinar, presented by Varun Badhwar and Chris Hughes, explores the role of open-source software (OSS) in development, the ownership of its selection, and current challenges in application security (AppSec) approaches to OSS. Additionally, related topics include the shortcomings of Software Composition Analysis (SCA) in detecting false positives and negatives, the importance of treating source code as a priority, security measures for AI coding agents in collaboration with Cursor and Google, and a novel approach to improving the identification of OSS dependencies and vulnerabilities in C/C++ with more accuracy than traditional tools.

Endor Labs, a company featured in a webinar titled "State of Dependency Management 2022," focuses on addressing vulnerabilities in Java/Maven packages and managing dependencies effectively. The webinar, updated in 2025, covers essential topics like updating to non-vulnerable versions and project criticality. Endor Labs offers solutions like Static Code Analysis (SCA) for C/C++ projects and integrates with Microsoft Defender for Cloud to enhance security through reachability analysis and attack path visibility. Additionally, People.ai has transitioned from Snyk to Endor Labs to improve application security and streamline compliance, highlighting the company's impact on developer experience and cost efficiency in meeting compliance targets.

Endor Labs has successfully completed a SOC 2 Type II audit, achieving a "clean" audit opinion from SSF, which signifies that their controls meet the relevant trust services criteria for security, availability, processing integrity, confidentiality, and privacy over a specified period. The company specializes in helping security and engineering teams effectively scale the use of open-source software by managing its entire lifecycle, addressing the significant risks associated with open-source dependencies, of which 95% of vulnerabilities are found in transitive dependencies. Endor Labs offers tools that prioritize actionable risks and reduce noise compared to traditional software composition analysis tools, focusing on operational and security risks that impact applications. Additionally, they provide governance solutions for CI/CD pipelines, managing access to source code and ensuring compliance with security benchmarks, while also generating and managing SBOM and VEX documents and open-source licenses.

Large Language Models (LLMs) are evaluated for their ability to assess the risk of potentially malicious code snippets, with a focus on the comparison between OpenAI's models and Google's Vertex AI. The assessment process involves using LLMs to assign a risk score on a scale of 0 to 9, rather than a binary classification, which helps in more nuanced evaluations. Improvements in the LLM-assisted review process include removing comments to reduce the risk of prompt injection and expanding context size. In the comparison, OpenAI's gpt-3.5-turbo and Google's text-bison often agree on risk scores, but diverge in cases where code is obfuscated. OpenAI's gpt-4 model is noted to provide superior explanations and risk evaluations for non-obfuscated code. The blog also discusses the manageable risk of prompt injection in this context, due to the requirement for code to adhere to syntactic rules, which allows for pre-processing steps like removing comments to mitigate risks.