May 2021 Summaries

The text discusses a security vulnerability analysis conducted using Snyk Code, which is an open-source tool for identifying and managing vulnerabilities in software projects. The analysis targeted popular Android apps, including those with tens of millions of downloads worldwide, to identify intent-based security vulnerabilities. These vulnerabilities can be exploited by malicious actors to inject arbitrary code into the app's WebView or access sensitive data stored on the device. The text highlights two specific examples of vulnerable apps: a shopping application and a social network application. In both cases, the vulnerability is caused by an intent redirection mechanism that allows an attacker to bypass security checks and access sensitive data or execute malicious code. To mitigate these vulnerabilities, the authors recommend using Snyk Code to identify potential issues in own projects and following best practices for secure coding, such as validating user input and ensuring proper permissions are set for app components.

Snyk has been named to the ninth annual CNBC Disruptor 50 List, coming in at #15, recognizing the company's alignment with today's rapid technological change and its potential to emerge as a business leader. The COVID-19 pandemic accelerated digital transformation and cybersecurity concerns, leading enterprises to choose Snyk as their developer-first security partner to secure digital initiatives. With over two million developers building securely with Snyk, the company is empowering every one of the world's 27 million developers, and its recognition in the Disruptor List is a testament to the dedication and hard work of its employees, partners, and customers. As Snyk continues to innovate, grow its community, and expand into new markets, it is seeking new talent to join its team and is also hosting SnykCon 2021 to bring together developers and security teams to share best practices and learnings.

VS Code extension security vulnerabilities were discovered, compromising local machines and build/deployment systems through a developer's IDE. The extensions' servers, often used for previewing files or handling IPC, can be exploited to steal sensitive information like private keys or access production servers. The attack vector involves command injection vulnerabilities due to unsanitized input from the WebSocket client flowing to the openExternal VS Code API method. Popular extensions such as LaTeX Workshop and Open In Default Browser were found vulnerable to path traversal and other attacks. Remediation advice includes using secure dependencies, implementing security measures like checking Origin headers, and continuously monitoring for updates with tools like Snyk. The discovery highlights the risks of blindly installing IDE plugins and emphasizes the importance of continuous testing and fixing security issues in extensions.

Snyk has taken over responsibility for the Node.js ecosystem's vulnerability disclosure program, which was previously managed by the OpenJS Foundation. As a company that has been involved in this program since its inception and has created its own multi-ecosystem disclosure program, Snyk is honored to have been entrusted with this new role. The program aims to promote responsible vulnerability disclosure, helping researchers disclose vulnerabilities safely while reducing noise for maintainers. The handover process involves reporters resubmitting their disclosures to Snyk, which will then verify and triage the reports before publishing them in its public database and issuing a CVE. Due to privacy concerns, the Node.js project will not pass on contact details of reporters to Snyk directly, making this an opt-in only process. Snyk plans to continue investing in the disclosure program to make it more efficient and helpful for both reporters and maintainers.

This is a story of bringing the pain forward, begging forgiveness, and continuous improvement. The company Manifold was struggling with keeping their dependencies up to date, which was causing significant work and stress for the team. To address this issue, they implemented automated dependency updates across all their repositories, which initially caused more problems than solutions, such as a backlog in their continuous deployment pipeline. However, through continuous improvement and iteration, they were able to overcome these challenges and create a fully automated path from pull request to production, resulting in faster deploy times and improved test efficacy. The key takeaway is that by bringing the pain of dependency updates forward and continuously improving processes, companies can overcome seemingly insurmountable challenges and achieve significant benefits.

This is Jeff Yoshimura's personal story about his grandfather, who immigrated to the United States from Japan in the 1910s and faced significant challenges, including internment during World War II. Despite these hardships, his grandfather persevered and achieved the "American Dream" through hard work and determination. The experience has influenced Jeff's appreciation for Asian Pacific American Heritage Month and his advocacy for understanding and combating racism and xenophobia against Asian Americans. As a leader in marketing and customer experience at Snyk, he emphasizes the importance of humility, kindness, and helping others, particularly during times of social unrest.

Researchers from Snyk Security Team have discovered intent-based Android security vulnerabilities within applications uploaded to Google Play store. These vulnerabilities involve intents, objects used for launching operations by components of an app. Intents are utilized for internal and external communication between apps, which can lead to injection and redirection attacks resulting in leaking private data stored by the app. The team analyzed top applications across 50 categories on Google Play store and found vulnerabilities in various popular apps including a shopping app, a social network app, and more. These intent-based security issues are similar to SQL injections or cross-site scripting (XSS) attacks in web applications.

Snyk has partnered with AWS Marketplace to provide customers with flexibility when purchasing Snyk software, allowing them to procure it directly from Snyk or through their preferred consulting or solution provider partners in the AWS Marketplace. This partnership enables customers to use their allocated security budget or funds committed to spending with AWS to secure their cloud-native environment while also consolidating billing mechanisms and leveraging industry expertise. By purchasing Snyk software in the AWS Marketplace, customers can enjoy a streamlined procurement experience, reduced operational burden, and leverage committed spend with AWS to burn down their EDP budgets. This partnership aims to optimize efficiency in procurement workflows and accelerate secure development for developers and security teams.

Trend Micro has launched a new security solution, Cloud One Open Source Security powered by Snyk, which provides continuous insight into open source vulnerabilities to enhance risk management and drive data-driven remediation decisions. This co-developed solution leverages Snyk's proprietary vulnerability database to offer a single platform for managing open source risk, minimizing the need to manage multiple vendors and tools. With this new offering, security teams can gain visibility into their dependency trees, prioritize remediation of open source risks, and detect issues faster using Snyk's comprehensive security intelligence coverage. The solution is available through Trend Micro channel partners and the AWS Marketplace, providing a proactive approach to application security and bridging the gap between DevOps and SecOps.

Static code analysis is a valuable tool in the DevOps process that offers several benefits to development teams. It helps identify code errors without running the code, saving time and costs associated with fixing issues later on. Additionally, it improves code security by detecting potential vulnerabilities early in the development cycle, reducing the defect rate, streamlining processes, managing complex codebases, and enabling continuous improvement. By incorporating static code analysis into automated CI/CD workflows, developers can enhance code quality, application security, and overall efficiency.

The SuiteCRM vulnerability is a PHAR (PHP Archive) deserialization vulnerability that allows an authenticated administrator to execute commands on the underlying operating system. The vulnerability exists due to the use of serialized metadata in PHAR files, which can be unserialized using PHP object injection. An attacker can exploit this by uploading a malicious PHAR file with a .phar, .zip, or .jpeg extension and triggering the phar:// URI check. SuiteCRM maintainers have taken precautions to prevent exploitation, but an attacker can bypass these checks using capital characters. The vulnerability also exists in the zend-gdata library used as a transitive dependency, which can be leveraged for arbitrary file deletion. An attacker can exploit this by uploading a ZIP PHAR archive and triggering the phar:// URI check. Once triggered, the PHAR deserialization allows an attacker to delete files and execute arbitrary code execution on the system. The vulnerability is mitigated in release 7.11.19 of SuiteCRM.

Snyk has announced that its new tool, Snyk Code, is now available for free as part of its security mission to empower developers and DevOps teams to secure their applications. Snyk Code provides a static application security testing (SAST) solution that scans proprietary source code, addressing common issues in traditional SAST solutions by being developer-friendly, fast, and accurate. It uses a unique approach to achieve unparalleled accuracy while growing its knowledge base exponentially, and provides clear explanations for developers to understand and fix issues easily. The tool is available for free, with individual developers granted up to 100 scans per month, and existing Free plan users can simply enable Snyk Code by going to the Settings page. Additionally, Snyk Code supports popular development tools such as Visual Studio Code and IntelliJ, and allows users to scan open-source projects for free.

Snyk has integrated its security data into GitHub Security Code Scanning, enabling developers to automatically scan their open source dependencies for security vulnerabilities and license issues within GitHub's Security tab. This integration uses Snyk's GitHub Actions to integrate Snyk natively with GitHub Security Code Scanning, allowing developers to view results directly from within the platform. To get started, developers can set up authentication with Snyk and configure a workflow in their repository using Snyk's GitHub Actions, which can be triggered by new code pushes. The integration provides context around vulnerabilities, including severity levels, CVEs, CWEs, descriptions, exploitability examples, disclosure timelines, and remediation advice, making it easier for developers to prioritize fixing issues. This integration aims to reduce friction associated with integrating security into development workflows, allowing developers to take more ownership of security.

Snyk recently held a roundtable discussion with Reddit to discuss application security in 2021, highlighting how organization size impacts AppSec implementation, focusing on smaller teams needing quick and centralized solutions, while larger organizations can invest in more comprehensive tools that better align with business requirements. A fragmented tech stack is also a challenge, requiring companies to balance developer freedom with the need for consistency and commonality of processes to maintain security and reduce overhead. Developer-friendly application security tooling is crucial for adoption, with security teams focusing on enablers of quality instead of blockers, and AppSec evolving to include areas such as infrastructure and cloud security, with separate teams or bundled capabilities depending on organizational structure and assets.