February 2022 Summaries

Managing Go dependencies efficiently can be achieved by setting up a Go Repository, providing a central and reliable location for shared team dependencies. Utilizing JFrog's free cloud subscription services, including Artifactory, Xray, and Pipelines, one can quickly establish local, remote, and virtual Go Registries. The process involves logging into the JFrog environment, creating local and remote repositories for storing custom and third-party dependencies, and setting up a virtual repository to organize these resources. The setup is enhanced by forking a JFrog Maven/Gradle example from GitHub and configuring the JFrog CLI to streamline automation. By completing these steps, users can build and resolve project dependencies using Artifactory, publish packages, and manage build information, ultimately creating an organized environment for Go project dependencies.

JFrog Security's research team is actively monitoring open-source software repositories to identify and report security vulnerabilities and malicious packages, focusing on preventing software supply chain threats. Recently, they discovered 25 malicious packages in the npm repository, which were removed promptly by npm maintainers. These packages often masquerade as popular ones, such as colors.js and discord.js, to deceive users, with some even targeting other malware authors. Notable examples include the "lemaaa" package, which hijacks Discord tokens, and "markedjs" and "crypto-standarts," which are trojan versions of legitimate packages. The research highlights a trend of novice hackers exploiting npm for easy, high-return attacks, and the team anticipates this trend will continue as they detect numerous new malicious packages daily.

JFrog has introduced several enhancements to its Xray security and compliance product, aimed at improving software development lifecycle (SDLC) protection by helping developers fortify software, reduce risk, and streamline compliance. Among the updates are advancements in threat contextual analysis, which prioritize vulnerabilities based on context such as configuration relevancy and patch availability, allowing for faster and more effective remediation. Enhanced vulnerability data now includes enriched CVE information from JFrog’s security research team, providing a deeper understanding of risks. Xray also offers improved Git repository scanning, identifying open-source software dependencies and detecting vulnerabilities and compliance violations, with the ability to trigger automatic responses. Additionally, Xray's Software Bill of Materials (SBOM) capabilities have been strengthened by supporting SPDX and CycloneDX formats, offering comprehensive visibility into software components. The product now integrates with Atlassian's Jira, facilitating automatic ticket creation for security violations, thereby streamlining issue management within developers' existing workflows. These upgrades are part of JFrog's ongoing mission to enhance security and compliance features tailored to the needs of developers, DevOps, and security teams.

JFrog’s Security Research team uncovered a critical remote code execution (RCE) vulnerability in Apache Cassandra, designated as CVE-2021-44521 with a CVSS score of 8.4, which primarily affects non-default configurations. Apache Cassandra, a widely-used distributed NoSQL database, is vulnerable when specific configurations enable user-defined functions (UDFs) without adequate security measures, allowing malicious actors to exploit the Nashorn JavaScript engine to execute arbitrary code. Cassandra's default settings employ a security manager and class filtering to prevent such exploits, but modifying these configurations can lead to security breaches, including denial-of-service attacks and unsafe object deserialization via the cassandra-stressd tool. Mitigations include upgrading to patched versions of Cassandra, disabling UDFs if unused, or ensuring secure configurations by restricting UDF-related permissions. JFrog emphasizes the importance of prompt upgrading and security monitoring through tools like JFrog Xray to address these vulnerabilities.

The JFrog Security research team actively monitors open source software repositories to detect and prevent potential software supply chain security threats, reporting any findings to repository maintainers and the community. Their recent discoveries include three malicious packages in the PyPI repository, which were quickly removed after being identified as threats. These packages, named "hipid," "hpid," and "ecopower," enable attackers to gain full control over infected machines. The "hipid" and "hpid" packages disguise themselves as tools for hiding processes on Linux systems, but actually install a connect-back shell specifically targeting Linux. The "ecopower" package executes the Medusa Python RAT, providing attackers with extensive control over the infected machine, including the ability to download and execute arbitrary code. These findings highlight the advanced techniques malware authors use to evade detection, such as using uncommon encoding methods and memory-based payload execution.

JFrog's transition from a single-instance to a multi-instance cloud deployment system significantly enhanced their software release process, allowing for rapid and reliable updates across various cloud regions. The shift was driven by the need for scalability and resilience, as their previous setup was prone to inefficiencies and potential failures due to its single-point-of-failure nature. By leveraging its own JFrog Platform, the company ensured a seamless and secure flow of software releases, implemented high-availability redundant network architecture, and achieved near-perfect uptime. The use of AWS Route 53 for latency routing improved network utilization, while the implementation of Release Bundles and strict internal controls streamlined the delivery process. This transformation resulted in improved deployment speed, governance, and network efficiency, underscoring the benefits of a distributed, cloud-agnostic infrastructure for large-scale operations.

A critical out-of-bounds vulnerability, identified as CVE-2021-44142, was disclosed in Samba versions prior to 4.13.17, allowing remote code execution through a vulnerable configuration with a CVSS score of 9.9. This vulnerability was highlighted at the Pwn2Own Austin competition, earning STAR Labs $45,000 for exploiting it on a Western Digital NAS device. It involves three flaws in the adouble.c file related to the vfs_fruit module, which enhances compatibility with Apple SMB clients. These vulnerabilities require specific conditions to exploit, such as enabling the vfs_fruit module and shared resources having write permissions. Though not loaded by default, some NAS devices enable this module to support Apple clients. Samba has released patches in versions 4.13.17, 4.14.12, and 4.15.5 to address the issue, and mitigation includes removing the vfs_fruit module from configurations or ensuring stringent access controls.

DevOps Cloud Days, a recently concluded online conference co-sponsored by Amazon Web Services, Microsoft Azure, and Google Cloud, offered participants insights into the latest trends in cloud-native DevOps and SecOps, particularly focusing on binary management and security with JFrog. Despite missing the live event, attendees can access the powerful and inspiring presentations on-demand. The conference featured over 15 expert-led sessions and demos, highlighting the acceleration of software delivery timelines, the evolution of the Software Development Life Cycle (SDLC), enhanced microservices development with Dapr and Java, the synergy between DevOps and Site Reliability Engineering (SRE), and Monster.com's success in automating software release timelines using JFrog and AWS. The event received glowing feedback for its educational value and is followed by hands-on workshops to further leverage the knowledge shared during the sessions.

JFrog's Private Distribution Network (PDN) is designed to address the challenges of distributing software to edge and IoT devices, emphasizing secure, efficient, and reliable delivery. The PDN, part of the JFrog DevOps platform, supports hybrid environments and facilitates large-scale distribution of software artifacts across mixed infrastructures. It integrates features such as release integrity, download optimization, zero-trust security, and local caching to ensure smooth software distribution even in environments with connectivity limitations and high latency. JFrog Distribution differentiates itself from traditional content distribution networks (CDNs) by offering deeper integration with security processes, detailed deployment tracking, and capabilities tailored to the needs of edge computing. With JFrog's recent acquisition of Upswift, now JFrog Connect, the company's capabilities in managing and updating IoT devices are further enhanced, positioning JFrog to support comprehensive delivery from development to deployment across diverse edge nodes, from large manufacturing plants to embedded devices.