February 2022 Summaries

The Node.js ecosystem, specifically yarn and npm package managers, are vulnerable to attacks using niche configurations and hidden characters in code snippets. Attackers can create malicious packages with seemingly innocent names but execute a binary from the `.rc` file, which is not downloaded when running `npm install`. This attack vector exploits the way package managers search for configuration files hierarchically, allowing attackers to hide malicious code in plain sight. Developers may miss red flags, such as unusual file permissions or hidden files, and need to be cautious of third-party code, run it inside a sandboxed environment, and monitor their systems for suspicious behavior. The attack highlights the importance of increasing awareness among developers about these vulnerability vectors to prevent exploitation and improve overall security.

A critical vulnerability was discovered in Magento Ecommerce, Magento Open Source, and Adobe Commerce versions, allowing an unauthenticated user to utilize SQL injection or PHP object injection at the checkout process. A patch was initially released, but further testing revealed it wasn't sufficient to mitigate the issue, leading to a new patch being rolled out to address the vulnerability. The new patch adds a reusable framework function to sanitize user input and provides additional security measures to prevent exploitation of the vulnerability. It is essential to apply both patches and run secure backups before deployment to ensure the security of the platform. Security researchers recommend monitoring public repositories, such as those on GitHub, for potential issues using tools like Snyk, which can alert developers to vulnerabilities and suggest possible fixes.

Snyk has launched a new Global Service Provider program designed to support leading solution providers in bringing its developer-first tools and methodologies into their services, with the goal of helping customers on their DevSecOps journey. The program aims to address security in the fast-paced DevOps world, where every company is becoming a software company, and customers are looking to embrace developer security as an important step of development. Snyk partners play a crucial role in making this shift a reality by providing flexibility and choice for customers, allowing them to add the optimum services for their business vision and customers. The program enables service delivery partners to offer a wide range of services to help customers across the DevSecOps journey, including security assessment, implementation, and integration services. With Snyk's platform, service delivery partners can secure code, elevate quality, and protect customers from risk, addressing emerging vulnerabilities such as Log4Shell and ensuring compliance with regulations like the Federal Trade Commission's Executive Order on global cybersecurity.

The developer-centric approach to software development has become a fundamental shift in the industry, with developers now holding a bigger audience and voice. This shift is driven by the growing importance of tooling and company culture in affecting productivity and approach. Developers need tools that simplify their job, integrate seamlessly with other tools and workflows, and empower them to take ownership of their work. A servant leadership approach prioritizes getting work done over legwork and gives developers more choice in tools and team structures. This shift also applies to the partnership between security and development, where decentralization and empowerment are key to protecting new pipelines and establishing secure coding practices. Ultimately, building empowered and autonomous development teams requires listening to what the team is trying to achieve and helping them solve problems themselves.

Snyk has partnered with Sysdig to provide a comprehensive security solution for developers working with containerized applications and Kubernetes environments. The partnership aims to deliver end-to-end security from code development to runtime, reducing the noise of vulnerabilities and providing feedback and visibility from production back to developers. By combining Snyk's early feedback on containers during development and Sysdig's runtime intelligence, developers can prioritize critical issues and fix them faster, while security and ops teams can focus on real-time threats and incident response. The integration of the full Snyk and Sysdig platforms secures everything from code to infrastructure running in Kubernetes clusters.

The Snyk Business trial is now available as a free trial for organizations to test their security across the entire Software Development Life Cycle (SDLC). The trial offers unlimited scanning in all Snyk products, scanning capabilities across the SDLC, and easy roll-out process. It also includes unlimited testing in various Snyk products, priority scoring, security fixes, dynamic monitoring, extensive reporting, intuitive management, and automation capabilities to support a quality security culture. This trial is designed to empower developers and security professionals to take control of their organization's security posture, reducing the risk of security incidents and improving overall application security knowledge.

The Argo CD team discovered a high-severity vulnerability, CVE-2022-24348, which allows attackers to steal sensitive information from deployments by exploiting a directory/path traversal vulnerability in the Helm chart repository. The vulnerability affects versions 0.5.0 through 2.1.12, 2.2.7, and 2.3.1 of Argo CD. To fix this issue, users are advised to upgrade immediately to the latest versions, specifically 2.3.2, 2.2.8, or 2.1.14. The vulnerability highlights the importance of securing software supply chains against supply chain attacks, where attackers try to infiltrate software as it's being constructed rather than after its release. To mitigate this risk, developers can implement practices such as small, easy-to-review commits, treating all SDLC systems like production, not using shared credentials, and knowing their supply chain. Implementing a secure supply chain is critical, including private, managed repositories with vetted and signed artifacts, software bill of materials (SBoM), and tools like Snyk to automate security testing and compliance.

Microservice security is a strategy that aims to minimize the risks associated with microservices application architecture, which involves building secure microservices and ensuring they communicate securely with each other. Microservices offer agility and flexibility in deployment and scaling, but also introduce security risks if not implemented properly. To address these risks, development teams should adopt a DevSecOps culture, integrate application security tools into their CI/CD pipelines, implement dependency scanning to detect vulnerabilities in open source components, use secure containers, build API gateways to protect APIs from abuse, and design the architecture with security in mind from the start. By following these best practices, organizations can ensure a more secure microservices-based application.

Pulumi is an open-source tool that enables developers to build code in multiple languages, such as JavaScript, Python, Go, TypeScript, and .NET, to create infrastructure as code (IaC). It supports Google Cloud, where a Pulumi stack can be created for automating the Snyk Kubernetes integration for containers. The process involves setting up a Kubernetes integration ID from the Snyk app, cloning a sample repository, authenticating to Google Cloud, creating a new Pulumi stack and configuring required settings, deploying everything with `pulumi up`, and retrieving the Kubernetes config. Once set up, the Snyk controller is installed in the snyk-monitor namespace, along with a config map and secret managed by Pulumi. The integration enables importing and testing running workloads and identifying vulnerabilities in their associated images and configurations that might make those workloads less secure.

The Big Fix is a month-long event where developers, DevOps, and security practitioners come together to find and fix security vulnerabilities in software, open-source dependencies, Docker container images, or infrastructure as code policies. The event aims to make the digital world more secure by bringing together individuals of all skill levels and backgrounds. Participants will have access to Snyk's tools and expertise to help them identify and fix security issues in their projects. Those who participate will receive free Snyk swag, including a t-shirt, and be recognized for their efforts. The event culminates with a live 24-hour Big Fix-a-Thon streaming on Twitch, where experts will provide guidance and support to help participants overcome the biggest headaches. By joining The Big Fix, individuals can level up their security knowledge and developer expertise while making the software world more secure.

The Payment Card Industry Data Security Standard (PCI DSS) is a thorough process that reviews companies' systems and policies for handling and storing sensitive consumer cardholder data, ensuring end users' data is kept safe and secure. PCI compliance is crucial in the payments industry, with MasterCard and Visa mandating merchants and service providers to be compliant, imposing penalties for non-compliance. The compliance process involves a series of checks by accredited third-party auditors to ensure secure data handling processes are in place. Static application security testing (SAST) and software composition analysis (SCA) tools can help meet PCI DSS requirements, with Snyk providing a platform to handle both needs. By using Snyk, developers can streamline the PCI compliance process, automate scanning into CI/CD pipelines, and document ongoing issues, making it easier to stay compliant.

Karyn Smith has joined Snyk as the new Chief Legal Officer, bringing her extensive experience from Twilio and Zynga to the role. She will provide indispensable legal counsel and business advice to support Snyk's growth journey. Karyn previously served as General Counsel and Corporate Secretary at Twilio, where she successfully built a team of over 140 attorneys and supported the company's global expansion. Prior to that, she was Vice President and Deputy General Counsel at Zynga and a partner at Cooley LLP. She currently serves on the Board of Halcyon and is a founding member of Chief. As part of her transition, Stephanie Dominy will take on a new role as Vice President of Legal Operations and Special Projects. Karyn's appointment aims to continue Snyk's growth and help recruit more talented female leaders in 2022 and beyond.

As enterprises undergo digital transformation, they need to rapidly deliver secure software with the ability to measure and manage application risk across multiple projects and development teams. Application risk profiling is a crucial aspect of this goal, involving a three-level approach to assessing risk: static categorization, dynamic quantification, and real-time assessment. By using tools like Snyk, enterprises can gain real-time visibility into application risk and prioritize efforts on high-risk applications. Key Risk Indicators (KRIs) also play a vital role in driving healthy vulnerability management, enabling teams to track application security metrics and surface vulnerabilities for remediation. By leveraging these approaches, enterprises can improve their security posture and deliver secure enterprise software.

At Snyk, researchers spend time studying vulnerabilities to anticipate malicious hackers' actions. The author of the original Wordle game was acquired by the NY Times, leading to numerous copycat versions in app and web-app form. A custom Wordle site was discovered with a query string parameter that looked like gibberish but was actually ciphertext. The author attempted to solve it using Atbash ciphers, then Caesar ciphers, and ultimately found a key that could be used to decode any custom Wordle. This key revealed a pattern of letter shifts that can be applied to any custom Wordle, allowing the author to create their own puzzle with the same solution.