December 2018 Summaries

Snyk’s 2018 retrospective highlights major open-source security incidents, including the Zip Slip arbitrary file overwrite vulnerability, the targeted event-stream cryptocurrency attack, a compromised eslint-scope package, and critical flaws affecting Kubernetes, Spring Boot, FTP clients, and email servers. It also promotes Snyk research, ecosystem reports, and security best-practice cheat sheets for Spring Boot, GitHub, Java, and Maven. Product updates included Docker image vulnerability scanning and remediation guidance, runtime monitoring for Java and Node.js in closed beta, expanded APIs, integrations with Lighthouse, Sonar, IntelliJ, and source-control platforms, and automated pull requests for dependency fixes. Snyk reported substantial growth during the year, citing nearly $30 million in investment, more than 200,000 developers using its platform, over 500,000 monthly CLI downloads, and more than 10,000 security-related pull requests opened each month.

A critical arbitrary code execution vulnerability was discovered in Kubernetes, allowing an attacker to gain remote access to backend services and execute arbitrary commands, potentially resulting in privilege escalation. The vulnerability exists due to a flaw in the kubelet API service, which allows proxied requests to internal backend servers, creating a direct tunnel between the backend servers and the user. This is exacerbated by insecure defaults, such as allowing both authenticated and unauthenticated users to query the Kubernetes API, and insufficient logging that fails to capture malicious activities. To protect against this vulnerability, it is recommended to upgrade to patched versions of Kubernetes, use workarounds or mitigation options, and consider using a developer-friendly solution like Snyk's Docker image scanning solution to detect and remediate vulnerabilities in container images.

Guy Podjarny, CEO of Snyk, a developer-first solution for automating vulnerability finding and fixing in dependencies, recently discussed his journey to building a successful freemium product on the SaaStr podcast. He shares insights on navigating the balance between market expansion and product depth, feature prioritization, and the importance of giving away "secret sauce" in freemium models. Guy also addresses challenges such as agency with developers versus CIOs, pricing transparency, and scaling team communication across locations. Additionally, he offers advice on hiring sales personnel, letting go of control, and lessons learned from his early days as a founder.

A 14-month U.S. House Oversight Committee investigation concluded that the 2017 Equifax breach, which exposed data affecting more than 148 million consumers, was preventable through more effective cybersecurity practices. Equifax failed to patch a known Apache Struts vulnerability and did not detect the resulting data exfiltration because a network-monitoring device had been inactive for 19 months after its security certificate expired; suspicious traffic became visible shortly after the certificate was renewed. The report identified broader organizational problems, including unclear IT accountability, a gap between security policy and operations, complex legacy systems, and hundreds of expired certificates, rather than attributing the incident solely to one employee. It also found that Equifax was insufficiently prepared to assist affected consumers after disclosure. The account presents DevSecOps practices—such as automated dependency scanning during development and CI, continuous production monitoring, and runtime detection—as ways organizations could identify and remediate vulnerabilities earlier while distributing security responsibility across development, operations, and security teams.

ThoughtWorks’ Technology Radar is a twice-yearly industry report that categorizes software technologies by recommended adoption levels, ranging from Adopt to Hold, based on observed trends and experience among ThoughtWorks and its clients. Snyk’s open-source security tooling, which helps developers identify, remediate, prevent, and monitor vulnerabilities in open-source code, was placed in the Trial ring under Tools, indicating that it is considered ready for appropriate use cases. Other Trial-ring tools highlighted include git-secrets for detecting sensitive information in commits, Cypress for end-to-end JavaScript testing, and Visual Studio Code as a widely adopted and rapidly evolving development environment. Snyk describes its inclusion as external validation of its goal to help organizations use open source securely.

Modern development workflows should test changes early, before they enter CI/CD pipelines, which should act as final release gates rather than first testing environments. The walkthrough demonstrates how to use Codefresh and Snyk, both available with free plans, to build a Node.js application into a Docker image, scan its application dependencies and container operating-system dependencies for high-severity vulnerabilities, and push approved images to Docker Hub for later Kubernetes deployment. It describes configuring repository triggers, encrypted Snyk and registry credentials, Docker Hub integration, and a Codefresh YAML pipeline with build, scan, and promotion stages. Snyk scans can halt the pipeline when issues are found, as illustrated by remediating a vulnerable qs package and updating the base image from Node 8 Alpine to Node 10 Alpine. Once scans pass, the pipeline publishes the container automatically, while optional Snyk monitoring records dependency snapshots and alerts teams when newly disclosed vulnerabilities affect the application or image.

We have improved our lockfile support for JavaScript projects, allowing for faster and more accurate test results. Our new functionality uses a node-lockfile-parser lib to traverse the lockfile itself and the package.json file instead of the entire node_modules folder, resulting in better performance and accuracy. For projects with yarn.lock or package-lock.json files, we will automatically detect these and process them as lockfile-based, while for projects without lockfiles, our previous support is still available. This change affects how Snyk tests work, providing more accurate results but also requiring manual intervention to update lockfiles before merging Pull Requests.

A malicious package, flatmap-stream, was published to npm and later added as a dependency to the widely used event-stream package by user right9ctrl. The event-stream package is a toolkit that provides utilities to creating and managing streams. Some time, and 8 million downloads later, applications all over the web were unwittingly running malicious code in production. This incident highlights the fragility of the open-source model if not respected and the need for responsible disclosure and security research as part of the development process.