April 2022 Summaries

C++ is a general-purpose programming language used for various applications, including operating systems, databases, browsers, machine learning tools, fintech and banking, game development, AR/VR, embedded systems, IoT devices, GUI-based apps, and cloud and distributed systems. The language's performance, portability, and low-level access make it suitable for resource-intensive or limited hardware applications. However, C++ also has security concerns, such as memory management mistakes, type safety issues, and potential vulnerabilities from open source software. To mitigate these risks, tools like Snyk can be used to detect vulnerabilities in open source dependencies. Overall, C++ is a popular choice for many industries due to its performance, flexibility, and versatility.

The research focuses on detecting C-related vulnerabilities in Python and JavaScript projects, as these languages often rely on native C or C++ extensions for improved performance and other aspects. The study found that approximately 1.7% of the PyPI ecosystem contains vulnerable C files, with some libraries having multiple occurrences of vulnerable code. A specific example was given using the python-libsbml library, which is downloaded around 20K times a month and has over 115 public dependencies, making it a potential target for exploitation. The research aims to encourage developers to check for C files in their non-C projects, as these often lack package managers and may remain outdated and vulnerable.

The 2022 Container Security Trends Report highlights the growing dependence on containers and the need for robust container security solutions that integrate seamlessly into existing development workflows. Developers' priorities for securing cloud environments were gathered through a poll by Techstrong Research, revealing insights into how security considerations impact deployments, the complexities of securing cloud-native and container environments, and the distribution of security work across organizations. The report shows that security is slowly catching up with application teams and DevOps teams as equal stakeholders during deployment, and that many developers feel that security is helping them move faster. However, there is still a need for education on security practices, particularly among application teams, and a recognition that security is often a collaborative effort in organizations. The report also highlights the value of tools that enable teams to incorporate security into their processes, such as Snyk Container.

Snyk has launched the Technology Alliance Partner Program (TAPP) to enable application and developer-focused software companies to quickly build, integrate, and go to market with Snyk solutions. The program offers benefits such as association with a leader in developer security, accelerated adoption of Snyk solutions, creation of new revenue streams, joint marketing messaging, sales and technical training, and exclusive access to new APIs and integration endpoints. Snyk partners are committed to developer security and have invested in the development of their platform, which enables users to shift security left and adopt a DevSecOps model. The program has welcomed 13 inaugural members, including Atlassian, Docker, HashiCorp, StackHawk, and several others, and is designed to accelerate the growth of an ecosystem of technology partners aligned with Snyk's mission and commitment to developer security.

To ensure the security of your application, it's essential to adopt Software Composition Analysis (SCA) best practices. This involves finding a developer-friendly tool that integrates well with existing development workflows and tools, educating developers about the importance of SCA, understanding dependencies including transitive dependencies, automating scans and identifying actionable fixes, integrating SCA into CI/CD pipelines, leveraging reports and SBoM capabilities, and strengthening security policies and improving license compliance. By implementing these best practices, you can maximize the benefits of SCA while minimizing risks and ensure a secure software supply chain.

SDR Series: Meet our APJ team` showcases the experiences of Lea Chng, an Associate SDR Manager in Singapore, and Gabriel Quek, a Senior Manager leading the SDR team in Singapore, as they share insights into their roles and what it's like to be part of the Snyk sales development representative (SDR) team in the APJ region. Both Lea and Gabriel highlight the importance of product value, people, and progression in their careers, emphasizing the company's strengths in these areas. They also discuss the role of SDRs in defining the value proposition for prospects and navigating cultural differences in a diverse market like APJ. The article aims to provide an inside look at the Snyk team and what it takes to be successful as an SDR in this region.

The faker-security Python package allows developers to generate fake security-related data, such as CVSSv3 vectors, CVE identifiers, semver versions, and CWEs, for use in testing and development. It can be used with the factory_boy and Faker packages to simplify test-writing experience during development, reducing lines of code and noise from fields that are not relevant to the test. The package is open-sourced by Snyk and can be installed via pip, with a recommended configuration in conftest.py for pytest users.

The use of open source software (OSS) has become increasingly prevalent in software development, with over 90% of organizations utilizing OSS components in their applications. While OSS offers benefits such as speedier development and access to collaborative efforts, it also introduces security risks due to outdated code, modified or missing licenses, and indirect dependencies. To mitigate these risks, developers can establish policies for automated enforcement, position Software Composition Analysis (SCA) prominently, implement SCA tools into their application security testing toolkit, fork changes to external source code, and leverage tools like Snyk Open Source to scan for vulnerabilities and ensure license compliance. By understanding the benefits and risks of OSS and applying these six tips, developers can create secure code without sacrificing speed or developer time.

WillowTree's Head of Cybersecurity, Adrian Guevara, discussed the challenges hypergrowth organizations face with implementing code security in a rapidly moving space. He shared that his organization prioritizes balancing innovation with security consciousness and has adopted a developer-centric security approach, which involves integrating security into development processes. Guevara emphasized the importance of communication and collaboration between security teams and developers to ensure successful production. He also highlighted the benefits of using a tool like Snyk, which provides an intuitive interface, reduces false positives and noise levels, and offers a partnership that supports the organization's growing needs. By adopting this approach, WillowTree has been able to develop and maintain practices to provide security in the fast-moving world of hypergrowth organizations.

Snyk will be planting a tree for each new Snyker hired in 2022 as part of its Earth Day celebration and commitment to sustainability. The company is partnering with the Jewish National Fund (JNF) and OneTreePlanted to plant trees globally, starting with Israel, where it was founded. This initiative aligns with Snyk's mission to make a positive social impact while operating as a carbon-neutral company. To support this effort, new hires will be invited to participate in tree-planting ceremonies at the JNF Ceremonial Tree Planting Center and have their trees transferred to nature reserves where they are needed most.

Snyk Code modernizes the maintenance of static application security testing (SAST) rules to catch vulnerabilities faster by taking responsibility for building and maintaining these rule sets, using a powerful engine on open source projects as a test and training set. This approach allows customers not to maintain the rules themselves, but instead, Snyk's security experts monitor and oversee the results, ensuring consistent growth in coverage accuracy. By constantly scanning for new issue patterns and implementing them while maintaining existing rules, Snyk Code ensures that its rule sets are up-to-date and effective in detecting vulnerabilities. This approach is particularly beneficial as it allows developers to focus on writing high-quality code more efficiently, rather than worrying about the maintenance of security rules.

C and C++ are considered low-level programming languages due to the machine's memory management process, which is different from high-level languages like JavaScript or Python. In C, memory management is passed to the developer, allowing for performance optimizations but also introducing unique problems such as buffer overflows, use-after-free vulnerabilities, integer overflows, and out-of-bounds reads. These vulnerabilities can be exploited in various ways, including through buffer overflow attacks, where data is written beyond the allocated buffer, or by using a variable reference after it has been freed. The consequences of these vulnerabilities can range from system crashes to disclosure of sensitive information, making it essential for developers to understand and address them. By gaining a deeper understanding of C/C++ vulnerabilities, developers can improve their overall software knowledge and take steps to prevent critical bugs in their code. Snyk's dev-first tooling provides one-click fix PRs for vulnerable open source dependencies, helping developers secure their projects with ease.

SnykCon 2021 highlighted the importance of automation in DevSecOps, showcasing its benefits in increasing efficiency and streamlining workflows. Automation can automate tedious manual tasks, allowing developers to focus on creative solutions for tough problems. The presentations demonstrated how automation can strengthen a development workflow by integrating security into CI/CD pipelines, detecting open source licenses, and providing faster feedback loops. By leveraging Snyk's platform, Citrix engineers created an automated process that reduced their time to resolution and decreased manual review time, enabling security through the pipeline. The "pipeline as a service" model provides three pillars for automation: a working repository, custom action repository, and tool-specific automation, allowing for efficient changes and tracking in one place. This enables a faster feedback loop without asking developers to make changes in multiple places, creating a seamless human-focused workflow.

The GraphQL API query language has several types of misconfigurations that result in data compromise, access control issues, and other high-risk vulnerabilities. Static analysis tools can identify these vulnerabilities using taint analysis and points-to analysis to accurately record program execution. The Snyk Code engine leverages typestate analysis to detect common GraphQL vulnerabilities such as SQL injection and deserialization vulnerabilities through GraphQL frameworks like express-graphql and koa-graphql. Additionally, GraphQL introspection can be used to discover what queries are supported by a GraphQL server, while GraphQL denial of service attacks can occur when the GraphQL server does not have a default depth limit. To prevent these vulnerabilities, developers should validate user input against strict allowlists, disable introspection in production environments, and use vendor-supplied escaping routines if necessary. Snyk Code currently supports several GraphQL frameworks through its static analysis capabilities, with plans to add further support for additional languages and code quality rules.

The discovery of Spring4Shell, a remote code execution (RCE) vulnerability in older versions of the spring-beans package, has led to the creation of exploits for Glassfish and Payara servers, which leverage the same issue. These new exploits demonstrate that the vulnerability is not specific to Tomcat and can be used on different application servers. The most important lesson is that updating the spring-beans package to version 5.3.18 or 5.2.20 or beyond will solve this vulnerability regardless of the application being used. Snyk's Security Research team has identified the available attributes in specific application servers that are writable, and one of these properties can be used to set the root directory for an exploit, allowing access to files normally not available on the system.

React Native security is a critical aspect of building cross-platform mobile apps that interact with remote servers, as it involves protecting user data and preventing common web vulnerabilities such as cross-site scripting (XSS). To secure data transfer, developers can use certificate pinning libraries like react-native-ssl-pinning or react-native-cert-pinner to prevent man-in-the-middle attacks. Authentication protocols like OAuth 2.0 are also essential for establishing trust between the client app and the resource server. Additionally, dependency vulnerabilities can be detected using tools like Snyk, which scans open-source packages for security issues and provides recommendations for fixing them. By implementing these security measures, developers can build more secure React Native apps that protect user data and prevent common web vulnerabilities.

Snyk has made its notification settings flexible, allowing users to customize their experience by overriding default settings for specific projects and organizations. The notification types include issue alerts, weekly reports, usage alerts, report status notifications, and marketing communications. Users can also set preferences for the latter through individual settings. Snyk provides training resources, including a ten-minute course on notifications and an optional Slack integration setup video.

Snyk is excited to be a Strategic Sponsor for Atlassian Team ‘22, aiming to expand conversations around cloud security among the growing Snyk + Atlassian user base, as it previews new Snyk functionality for Bitbucket Cloud and Jira. The company has built a cross-functional team to deliver an optimal developer security experience, focusing on enterprise customers with multiple business units. Developer security is becoming increasingly important, as agile DevOps practices increase design and implementation complexities that can be compromised by vulnerabilities and data breaches. Snyk's native integrations with Atlassian products enhance workflows and pipelines of global DevSecOps teams, empowering engineers to design and develop software with security in mind from the start. The Snyk team will be available during Team ‘22 to connect and chat with attendees, offering in-person sessions and a demo.

Snyk Open Source has added C/C++ security scanning for unmanaged dependencies, enabling development teams to find and fix known security vulnerabilities in their C/C++ open source library dependencies without needing manifests. The solution is developer-first, understanding the context and structure of C and C++ projects, leading to fewer false positives and less time spent correcting identifications manually. A new `--unmanaged` command-line option allows scanning for dependencies in source code without manifests. The vulnerability database is continuously improved by security and open source experts, providing recommended fixes and alerts for new vulnerabilities. To use the solution, install the Snyk CLI, authenticate with your account, and run the `snyk test --unmanaged` command to scan your project for vulnerabilities.

The text discusses directory traversal vulnerabilities, which allow attackers to access folders they shouldn't have access to. The authors of the text, part of the Snyk Security Research team, discovered several high-severity vulnerabilities in C/C++ codebases, including improper pathname limitation (CWE-22), arbitrary file read and write vulnerabilities, and zip slip issues. These vulnerabilities can lead to remote code execution, sensitive data exposure, and other security concerns. The text provides examples of vulnerable code and fixes for these issues, as well as general remediation advice, such as using canonical path resolution and avoiding user-provided file paths. The authors hope that their findings will help C/C++ developers prioritize information security in their work.

The `faxios-complete` package experienced a strange security breach due to nested dependencies, resulting in the distribution of "dad jokes" ransomware that flooded users' hard drives with puns. The attack's origin and inner workings remain unclear, but researchers are working to understand the malicious code, which appears to be tied to recurring phrases such as "Why do melons have weddings?" The breach highlights the importance of maintaining security in open source software development and the need for tools like Snyk to provide comprehensive vulnerability updates and recommended fixes. Thankfully, this was an April Fools' joke, but it serves as a reminder that even seemingly innocuous packages can pose security risks if not properly maintained.

Snyk has launched Snyk Ultimate Security (SUS), a product that aims to make all of a company's data impenetrable in perpetuity, offering a three-tier system for securing the entire software development lifecycle. SUS provides tier one protection by shutting down servers to prevent access to sensitive information, tier two protection by wiping employees' memories to prevent human error-driven breaches, and tier three protection by demolishing physical workspaces to eliminate any remaining data. The program is designed to be cost-effective, requiring only a single run, and leaves nothing but a clean slate for attackers to target, making it incredibly effective in securing applications.

The Spring4Shell vulnerability is a critical remote code execution (RCE) flaw in the Spring Framework, affecting versions of `spring-beans` that use JDK 9 and above. It allows an attacker to execute arbitrary commands on a Tomcat server, potentially leading to reverse shell access or web shell interfaces. To mitigate this issue, users are advised to update to version 5.3.18 or 5.2.20 of the Spring Framework, or downgrade their Java version to Java 8. Additionally, creating an `InitBinder` or using a `RequestMappingHandlerAdapter` can help block malicious requests. The vulnerability highlights the importance of staying up-to-date with the latest versions of libraries and frameworks to prevent zero-day exploits.