June 2020 Summaries

HTTP request smuggling is a vulnerability type that allows an attacker to bypass security protections, conduct phishing attacks, and obtain sensitive information from requests other than their own. It exploits deviations from the HTTP/1.1 protocol specifications, particularly in how keep-alive, pipelining, content length, and transfer encoding are handled by frontend and backend libraries. The vulnerability can be exploited through two common techniques: CL:CL (Double Content-Length) attack technique and CL:TE (Content-Length Transfer-Encoding) attack technique. Remediation involves prioritizing the transfer-encoding header over content-length, disallowing requests with both headers, and ensuring proper processing of multiple transfer encoding values. The vulnerability affects both frontend and backend projects, requiring a defense-in-depth approach to patch against it.

LGBTQ+ individuals in the tech industry share their experiences, perspectives, and advice on navigating careers and building communities. They highlight the importance of self-acceptance, education, activism, and allyship in promoting diversity and inclusion. Many emphasize the need for LGBTQ+ communities to support one another and provide a platform for sharing experiences and advice. The participants also discuss the benefits of being part of tech industries, where there are no strong opinions around sexual orientation, and how this industry attracts a wide range of people who consider themselves outsiders due to their unique identities. They encourage young LGBTQ+ individuals to pursue careers in tech by following their passion, building support networks, and seeking out role models and organizations that value diversity and inclusion. The participants also highlight the work of organizations like Intertech LGBT+ Diversity Forum, which provides events, networking opportunities, and best practices for promoting LGBT+ diversity and inclusion in the UK technology sector.

The open source security landscape continues to expand, with over 40 million developers on platforms like GitHub, and the majority of vulnerabilities discovered in indirect dependencies such as npm, Ruby, and Java. Despite this growth, new vulnerabilities have decreased by 20% across popular ecosystems, and cross-site scripting (XSS) remains a common issue, yet its impact is relatively low compared to less prevalent but highly impactful vulnerabilities like prototype pollution. Official container images contain significant numbers of known vulnerabilities, and using them is not a replacement for regular security hygiene practices. The remediation timeline for vulnerabilities often does not match expectations from the community, with 47% of respondents expecting fixes within a week and nearly 18% expecting fixes within a day. However, in reality, only 35% of vulnerabilities were fixed within 20 days, and 36% took 70 days or more to be remediated. The report highlights the importance of tracking metrics such as days to remediation, mean time to merging pull requests, and time to fix code, and encourages organizations to establish programs that reinforce shared responsibility for security practices within their organization.

The websocket-extensions package contains a Regular Expression Denial-of-Service (ReDoS) vulnerability that was discovered by Robert McLaughlin, a Ph.D. student in the Computer Science program at the University of California, Santa Barbara. The vulnerability was reported to Snyk by Robert and validated by Sam Sanoop, an analyst on the Snyk Security Team. The vulnerability could allow a malicious user to attack the regular expression algorithm, causing catastrophic backtracking, and was identified using the open source RegexStaticAnalysis tool. After confirming the validity of the vulnerability, Sam investigated the code base for the package and located the actual line of code that introduced the issue, developing guidance on how to remediate it. The maintainer of the websocket-extensions package responded promptly to the information provided by Snyk, releasing a fix within a day of receiving the report, and the vulnerability was published shortly thereafter. This is an example of how Snyk's disclosure process helps researchers report and receive credit for their discoveries while working collaboratively with open source maintainers.

Maintaining npm dependencies in a Node.js project is crucial, as ignoring them can lead to problems such as outdated software, security vulnerabilities, and performance issues. A common scenario is when a project is left unattended for an extended period, causing dependencies to become outdated or unmaintained by a single contributor. This can result in "Node Module Hole" where dependencies contain other dependencies that are not visible. To address this, developers can take steps such as analyzing their needs, using micro-dependencies, conducting market analysis, and utilizing preventive tools like Snyk's Vuln Cost to identify vulnerabilities and find suitable alternatives. By doing so, they can develop a maintainable, high-quality, scalable, and more secure codebase.

The author shares their experience with using the `git rebase -i` command to change commit history, which they found to be an interactive and powerful tool for managing code changes. They explain that this command allows developers to alter individual commits as part of the basic rebase process, making it possible to squash, fixup, reword, or edit commits in various ways. The author provides examples of how to use these options to address common scenarios such as changing an old commit message, squashing multiple commits together, and fixing code conflicts that may arise during the rebase process. They emphasize the importance of understanding each option carefully before applying them to avoid losing work or introducing errors into the repository.

Snyk has integrated with JSDelivr, a leading CDN for open source and npm packages, to provide developers with security badges that highlight package vulnerabilities when searching for specific libraries. This integration allows developers to easily identify potential security issues in their code dependencies and take action to secure their software from the start. The Snyk integration offers a more detailed view of the issue(s) on the Snyk website, enabling developers to react accordingly and keep their open source projects secure.

Our privilege is our responsibility` highlights the importance of recognizing and addressing systemic inequalities that come with having certain privileges, such as those based on race, ethnicity, or socioeconomic status. The author emphasizes that having privilege also brings a sense of responsibility to use it to help others who are not afforded the same opportunities. Companies like Snyk are taking steps to translate their values into concrete actions, including fostering open dialogue, training employees on unconscious bias, and committing to increasing diversity in their candidate pipeline. As individuals and companies, we all have a role to play in fighting against systemic injustice and creating change.

Snyk has enhanced its integration with Bitbucket Cloud, expanding collaboration with Atlassian to simplify DevOps adoption and remove friction for developers. The new enhancements include support for Code Insights, enabling users to gain visibility into security vulnerabilities in their open source dependencies, as well as a simplified setup process via the Snyk Connect App. Additionally, Snyk is offering free unlimited tests for Bitbucket users through the end of June, making it easier for developers to find and fix vulnerabilities throughout their development workflow.

Snyk has introduced a new Kubernetes configuration feature that checks for security misconfigurations in Helm Charts, providing an additional layer of protection against vulnerabilities and potential security issues in the application source code. The feature is now available to users who import their Git repositories into Snyk, allowing them to identify and address potential security concerns directly from their source code. With this new functionality, users can easily review and modify their Helm Chart templates to ensure they are secure, and Snyk plans to expand the feature further with additional configuration formats and CI/CD support in the future.

Our Sales Development team has adapted their approach to prospecting in response to the COVID-19 pandemic, embodying Snyk's core value of caring deeply about every prospect call. They prioritize being genuine and interested in the person they're talking to, taking initiative to customize their messaging, giving back by offering support and resources, and operating under a principle of being ridiculously easy to work with to solve customer problems. By doing so, they aim to build trust and learn about the struggles prospects face day-to-day, while also providing value-driven solutions.