January 2022 Summaries

The PwnKit vulnerability is a high-severity bug in Polkit, a component used to control privileges in Unix-like operating systems, which has existed since 2009 and was recently discovered by a security researcher. The vulnerability allows an attacker to corrupt memory through a buffer overflow, leading to full root privileges on the target host. It is caused by a flaw in command line argument handling and can be exploited when the `pkexec` command is run without arguments, resulting in corrupted memory. Patches have been made available quickly, and it is recommended to install operating system updates immediately or remove the SUID bit from `pkexec` manually. The vulnerability affects many major Linux distributions, including Red Hat, Ubuntu, and SUSE, and highlights the importance of keeping up-to-date with security patches.

A developer-focused application security program is a journey, not a destination, requiring guiding principles to navigate stages, milestones, and challenges. To build an effective AppSec program from scratch, start small, focusing on individuals and shared secure coding practices, while releasing control and embracing transparency and cross-collaboration. As the program matures, refine it through continuous improvement, defining success metrics that serve the program's message, such as tracking design requirements, operational metrics, and security maturity assessments. Ultimately, AppSec should support developers, empowering them to take ownership of their secure coding practices with integrated and automated security tools like Snyk.

A new Chief Information Security Officer (CISO) must establish a security-focused ecosystem in an organization by gaining a thorough understanding of the business and its industry, developing trust with leadership, recognizing the company culture, making security a team sport, and thinking and acting strategically. To build trust with the board, the CISO needs to align with current strategies, deliver on promised projects, and understand the business's goals. Understanding the organization's culture is also crucial for security practices to be adopted, and it requires shifting existing cultural norms towards openness and collaboration. The CISO must communicate clearly with employees at all levels, regardless of their position, and advocate for security as a benefit to the bottom line, not an operating expense.

The PHP security support in Snyk Code is now Generally Available, bringing the ability to identify potential vulnerabilities at the code level. This feature adds to existing PHP scanning functionality that scans composer manifests for open source library and dependency vulnerabilities. The Snyk Visual Studio Code extension also supports code and composer scanning for PHP, highlighting insecure code as it's written and identifying vulnerabilities in open source libraries or dependencies. With this GA release, developers can delve into the issue and track down potential security threats through the codebase. A demo app, called a "goof app", has been added to test Snyk Code's capabilities, and users can try it out with a free Snyk account. The scan identifies issues such as SQL injection and use of hard-coded credentials, and provides fix analysis and remediation advice.

I’m excited to announce that both Kathleen Murphy and Zach Nelson have joined the Snyk Board of Directors effective as of January 1, 2022, bringing valuable experience from their respective careers in finance and technology leadership, with Kathy having a deep understanding of the financial services industry and Zach having successfully led NetSuite to its successful IPO and acquisition by Oracle. These new additions join other recent board members, solidifying Snyk's mission to make every developer secure as they embark on this journey. The company is grateful for their expertise and looks forward to benefiting from their wisdom and experience. With these new board members, Snyk continues to grow its presence in the financial services realm and beyond, offering global opportunities for developers seeking to join the leader in developer security.

Shifting security left is a crucial aspect of building a cloud native bank, allowing Lunar to prioritize security earlier in the software development lifecycle and empower its developers through security tooling. By adopting a microservices architecture and using tools like Snyk, Lunar has improved the security of its services without slowing down development. The company's shift left approach enables transparent ownership over each microservice, ensuring that every team member is responsible for the entire service, from design to deployment. This approach has allowed Lunar to meet compliance requirements as a licensed bank while releasing 25 production builds per day.

The Open Policy Agent (OPA) is a general-purpose policy engine that enables organizations to define policies in code, leveraging a high-level declarative language called Rego. OPA allows for uniform policy definitions and enforcement across disparate services and environments, reducing the need for duplicated logic and improving compliance governance. By implementing policies and enforcing them in the developer's workflow, organizations can stop violations as they are created, rather than relying on late-stage auditing or manual reviews.

The article highlights the importance of integrating security into the Software Development Lifecycle (SDLC) to protect applications from complex security threats and ensure efficient development. It emphasizes the need for a Secure Software Development Lifecycle (SSDLC) to address vulnerabilities early in the coding process, thereby reducing time and resources spent on post-release fixes. Key strategies include adopting a DevSecOps mindset, keeping security requirements up-to-date, utilizing threat modeling, and standardizing secure design requirements. The use of open-source components should be managed securely with tools like software composition analysis, while code reviews and penetration testing are essential for identifying vulnerabilities. Effective vulnerability management and incident response preparation are crucial for maintaining application security, and establishing a security champions program can foster collaboration between security and development teams. Overall, the article advocates for a proactive approach to security that integrates seamlessly with development processes to strengthen application security without compromising development speed.

This article discusses the importance of manual code reviews in software development and provides eight proven best practices for conducting effective code reviews. The first practice is to add comments during source code creation to explain the intent of a code block, while the second practice involves not assuming something works without testing it. The third practice is to run test suites on proposed code to validate its functionality. Additionally, the article emphasizes the importance of ensuring pull requests are small and focused on a singular purpose, always running automated code checkers, reviewing all code and PRs, setting limits for review time and code lines checked, and conducting security code reviews. By implementing these best practices, development teams can ensure their software is properly tested before pushing it to production and deliver high-quality, secure code quickly.

The demand for powerful Java review tools is driven by the need to ensure secure and high-quality software development, particularly in the face of increasing security threats. The top 7 Java code review tools include JArchitect, PMD, FindBugs/SpotBugs, Checkstyle, SonarLint, Graudit, and Snyk, each offering unique features such as static analysis, code querying, and security vulnerability detection. These tools can help automate code reviews, detect common mistakes and security threats, and provide actionable suggestions for improvement. By leveraging a comprehensive database of known flaws and using smart approaches to optimize the review process, developers can significantly reduce review time and improve overall code quality.

I traditionally start the new year with resolutions, this time focusing on not exposing confidential information while hacking my demo application during presentations or demos. This resolution stems from a security horror story where I accidentally exposed my GitHub token and other sensitive information during a presentation at J-Fall 2021. The incident occurred when I used a deserialization gadget chain to demonstrate a Java Security-related topic, inadvertently showing the environment variables on stage, which included API tokens like my GitHub token. A participant, Nils Breunese, pointed out the mistake, and I was both embarrassed and relieved. To prevent similar incidents in the future, I've decided to practice what I preach by being more mindful of my actions and ensuring that sensitive information remains confidential during demos or presentations.

Snyk has announced that Samantha Wessels has joined the company as its new Vice President of EMEA Sales, marking the most significant year in Snyk's history. Samantha brings an impressive sales track record and a customer-first approach to her new role, having previously worked at Elastic and Dimension Data. She is well respected within the global technology industry for her ability to rally teams and embrace transformation, as well as her passion for mentoring and volunteering. With her infectious ambition and energy, Samantha is expected to bring innovative ways to incorporate Snyk Impact initiatives into the sales organization, with a focus on bringing more women into sales across the tech industry.

The npm package `colors` was intentionally introduced with an infinite loop that causes a Denial of Service (DoS) vulnerability, and its version `1.4.1` has been flagged by Snyk as a security vulnerability, prompting users to revert to the stable version `1.4.0`. The maintainer of the package has also taken down the GitHub repository for another popular npm package, `faker`, which was previously used by thousands of developers. This incident highlights the importance of open source governance and funding models, as well as the need for maintainers to be transparent about their intentions and actions. To mitigate this issue, users are advised to pin their dependencies and consider using alternative packages.

The article highlights the DevSecOps leaders recognized at SnykCon 2021, a virtual event that brought together thousands of developers and security practitioners from around the world. These leaders were honored for their innovative approaches to securing application development, bridging the gap between development and security teams, and promoting social or environmental impact. The article also mentions SnykCon 2022 and encourages those who missed the previous event to watch the engaging sessions online.

The challenge, "Fetch the Flag" from SnykCon 2021, was a web-based challenge involving an oracle attack using blind SQL injection. The team approached this problem by first investigating the available pages and identifying potential attack vectors. They then tested the vulnerability of the order query string and determined that it was susceptible to a blind SQL injection attack. Using an oracle attack, they were able to extract the login information from the database, including table names, column names, and data. The team then used this information to manipulate the admin panel's cookies and gain access to the admin page, ultimately retrieving the Snyk CTF flag.

Atlassian's Bitbucket Cloud, a Git-based source code repository service, streamlines software development for collaborative teams while ensuring speed and efficiency. The integration of Snyk with Bitbucket allows developers to find, fix, and monitor vulnerabilities in their open source dependencies and container images, simplifying securing the DevSecOps pipeline. Through these integrations, security analysts gain visibility into existing vulnerabilities and open-source license issues, enabling better prioritization of resolutions. Snyk's integration with AWS services across the application lifecycle automates security controls, providing real-time visibility into any security issues in code and containers. This collaboration empowers organizations using Bitbucket to adopt a DevSecOps approach to software delivery, improving the security posture of their applications throughout the development lifecycle.