July 2019 Summaries

Snyk helps open-source maintainers keep their packages safe and up-to-date with security patches, which is crucial in reducing the risk of exploitation when vulnerabilities are discovered but not fixed immediately. Snyk's security patching mechanism applies fixes directly to affected npm packages, even if there's no official release available, and does so seamlessly during the npm installation process, protecting users from potential security threats. The mechanism works by integrating with npm's package.json script support for lifecycle events, such as prepublish, to apply patches before publishing or installing a package, ensuring that users are protected even when maintainers are unable to release new versions with fixes quickly enough. Snyk also provides a free security patching solution for all users, making it an essential tool in staying ahead of un-remediated security vulnerabilities.

The .NET ecosystem is vulnerable to various types of attacks, with remote code execution, cross-site scripting, and denial of service vulnerabilities accounting for 2/3 of known vulnerabilities. High severity vulnerabilities account for 70.7% of total vulnerabilities, while medium severity vulnerabilities make up the next largest share at 26.9%. The majority of vulnerabilities found in the .NET ecosystem are unique to it, with only three vulnerability types making up the majority of vulnerabilities. These vulnerability types include remote code execution, cross-site scripting, and denial of service attacks, which can have significant consequences for users. Fortunately, every vulnerability found by Snyk in a dependency scan has had a remediation available, suggesting that the .NET ecosystem receives strong support from Microsoft. Fixing vulnerabilities typically involves upgrading to a newer version of the affected package or dependency, with direct dependencies being easier to remediate than indirect ones. The .NET ecosystem faces challenges in terms of vulnerability reporting and disclosure, but tools like Snyk can help address this issue by providing a centralized place for vulnerability reporting and CVE number assignment.

Snyk has acquired DevSecCon, a leading conference focused on DevSecOps, with the goal of maintaining its vendor-neutral approach and growing the community through additional resources and events. The acquisition is expected to enhance Snyk's commitment to supporting developers and security professionals in getting them working together effectively. With plans to build an online/virtual experience, develop an official inclusion and diversity program, and grow the community of DevSec speakers, Snyk aims to strengthen the DevSecOps community while maintaining its unique aspects that make DevSecCon valuable for attendees. The conference will continue running as usual, with no changes expected in the short term, and new initiatives are planned to be rolled out gradually over the next 6-12 months.

The Payment Card Industry Security Standards Council has introduced the PCI Software Security Framework (SSF) and the Secure Software Lifecycle (SLC) Standard, which outline security requirements and assessment procedures for software vendors to manage the security of payment software throughout its entire lifecycle. The new framework replaces the current guidelines contained within the PCI Payment Application Data Security Standard [PCI PA-DSS] and is aimed at ensuring the secure use of open source components in software development. The updates require organizations to continuously monitor vulnerabilities and defenses, and adapt if threats change, as well as test application security controls and prove that their controls have not weakened or become ineffective over time. This approach aims to treat security as part of the continuous integration and delivery (CI/CD) process, rather than an afterthought. The new standards also hold security leaders accountable for ensuring the security of products and services, and require developers to participate in the defined steps for meeting compliance, including managing open source components.

To maintain visibility into serverless environments, define strict rules around function deployment, clear guidelines for removal, and use tags to track individual functions. This helps identify long-term production, experimental, or back-office functions and ensures proper maintenance and deletion. Additionally, monitor for security vulnerabilities using tools like Snyk, which scans individual functions for known vulnerabilities, and enforce limits on resource access to prevent financial exhaustion. Logging is also crucial, with a focus on verbose logging, leveraging cloud logging facilities, and implementing a central management system to enable easy debugging and alerting. By following these practices, serverless developers can increase observability, monitoring, and security for their cloud-based projects.

New10, an online lender using the benefits of cutting-edge technology, leverages AWS for loan administration and risk management services, customer information services, and analytical services. They chose Snyk to integrate security best practices directly into their development pipelines, simplifying continuous delivery and speeding up new application and feature deployment. With Snyk's integrations with AWS Lambda, ECR, and Gitlab CI/CD, New10 can quickly identify vulnerabilities in their codebase without slowing down their DevOps processes. This allows them to deliver value to their customers faster and more securely, reducing time spent on vulnerability scanning by 35%. By integrating security seamlessly into their CICD pipelines, New10 is able to streamline their development cycles and improve overall productivity.

The strong_password Ruby gem has been found to have a remote code execution vulnerability, CVE-2019-13354, which allows attackers to publish malicious versions of the gem and compromise account access rights. The vulnerable version was published on Rubygems.org six months after the last release with no source code changes. An attacker exploited this by publishing a malicious 0.0.7 version that triggers when an application is running in production, fetching further payload from pastebin.com to evaluate it, allowing remote command execution and providing the URL of the running application. The Ruby gems community quickly responded and removed the malicious version and assigned a CVE. This incident highlights the risks of supply-chain attacks and the importance of monitoring dependencies and taking swift action when vulnerabilities are discovered.

The Snyk security research team recently discovered a severe prototype pollution security vulnerability (CVE-2019-10744) in all versions of the popular npm library lodash, which is used by over 4.35 million projects on GitHub and downloaded over 80 million times each month. The vulnerability could allow an attacker to inject malicious code into JavaScript applications, potentially leading to property injection, code injection, or denial of service. Snyk has already applied a security patch to protect its users, but no official fix has been published yet. Users are advised to update to the latest version of lodash (4.7.11) or apply a security patch provided by Snyk to remediate the vulnerability. The issue highlights the importance of keeping dependencies up-to-date and using tools like Snyk to monitor and protect against vulnerabilities.

Serverless applications, particularly those deployed on AWS Lambda, are vulnerable to security threats due to their reliance on external dependencies such as libraries and frameworks. These dependencies can contain known vulnerabilities that are not patched by the cloud provider, making them a target for attackers. To mitigate this risk, developers should use tools like Snyk to scan their dependencies for vulnerabilities and automatically remediate issues before deployment. Additionally, integrating security testing into the development lifecycle, such as using plugins in integrated development environments (IDEs), can help identify vulnerabilities early on. It is also essential to enforce secure deployments by subjecting the function's deployment workflow to security review and ceasing deployments when vulnerabilities are found. By taking these steps, developers can protect their serverless applications from security threats and ensure a more secure development lifecycle.