July 2022 Summaries

A buffer overflow occurs when a program writes beyond a buffer’s allocated memory, potentially corrupting adjacent data and enabling attackers to bypass restrictions or access sensitive information. A C++ password-check example demonstrates how unbounded input read through `std::cin` can overwrite a nearby password array on the stack, allowing a crafted long input to alter the stored value and pass a limited character comparison. C++ is particularly exposed because many APIs use raw pointers and fixed-size arrays without automatic bounds checking. Mitigation includes favoring managed types such as `std::string` and `std::vector`, using bounds-checked C-style API variants where necessary, and avoiding unsafe functions that do not accept buffer sizes. AddressSanitizer, supported by major compilers, provides an additional detection mechanism by surrounding memory objects with protected regions and reporting invalid accesses at runtime, helping developers identify stack and heap buffer overflows during testing.

Disability Pride Month is celebrated every July to commemorate the passing of the Americans with Disabilities Act (ADA) on July 26, 1990, aiming to amplify the experiences of the Disabled community through education, action, and support. Ashley Ladd sat down with Alex Fallon, a disabled person, to discuss what Disability Pride means to them, how able-bodied people can be better allies and advocates for the Disabled community, inspirational figures, helpful resources, and more. Alex emphasizes the importance of Disability Justice and its motto "nothing about us, without us" highlighting that disabled individuals know best what they need and should make decisions impacting their lives. Key misconceptions about disabilities include assuming laziness or childlike behavior in those with disabilities, being able to easily identify someone's disability, and not providing accommodations. Alex suggests resources such as books, podcasts, TV shows, movies, and documentaries created by or featuring disabled individuals for learning more about the disability community. Allies can generate impact by joining disability groups, supporting organizations like The Arc, diversifying media consumption, and being aware of how disabilities are presented in media.

The Cloud Security Podcast has grown from humble beginnings into a leading source for cloud security knowledge and a top 100 technology podcast globally, with over 200 insightful episodes featuring cloud security experts and advocates from around the world. The podcast is now powered by Snyk, allowing it to focus on creating more valuable content and bringing cloud security expertise together through meetups and other initiatives. This partnership aligns with Snyk's community-first and vendor-neutral approach, and will enable the Cloud Security Podcast to scale up its efforts without compromising on its core mission of making cloud security knowledge accessible to all. The new partnership is seen as a win-win for both parties, with the podcast benefiting from increased resources and the audience gaining access to more valuable content and expert insights.

Snyk recommends that Business and Enterprise customers prepare for a successful initial rollout by defining an account structure, implementing single sign-on, and configuring their first organization before inviting users or importing projects. Account and organization design determines project access and feature behavior, particularly when multiple development teams work on shared applications. Setting up SSO early through an identity provider can streamline user provisioning, limit access to relevant projects, and prevent duplicate accounts created through alternative login methods. Organizations should also establish default notification settings and review automations before importing projects, disabling automations that teams are not yet prepared to use. Customers can seek technical support and use kickoff sessions, office hours, and training resources to support adoption during the first 30 days.

Snyk’s webinar, presented by Senior Product Marketing Manager Frank Fischer, argues that cloud-first architectures and DevOps have shifted more security responsibility from operations teams to developers, making security an integrated responsibility across the software development lifecycle. The post promotes DevSecOps as an approach that avoids security bottlenecks created by late-stage reviews while helping address the shortage of cybersecurity professionals by enabling developers to resolve routine vulnerabilities within their existing workflows. Snyk positions its cloud-native platform as developer-focused tooling for identifying and remediating issues in proprietary code, open-source dependencies, containers, Kubernetes applications, and infrastructure as code, including automated fix suggestions and CI/CD integrations. It also highlights Snyk’s security intelligence database, which combines public information, community contributions, proprietary research, and machine learning to keep users informed about emerging threats and prioritize remediation actions.

The Linux Foundation recently partnered with Snyk to produce a report on the state of security in open source software (OSS). The report, based on 550+ survey responses and 15 interviews, highlights the growing complexity of software supply chains and the need for better OSS security. Experts discuss the importance of creating Software Bill of Materials (SBOMs) and implementing OSS security policies to manage risk and improve transparency. The report also reveals that 49% of organizations have no security policy addressing open source security, and that time to fix vulnerabilities has increased from 49 days in 2018 to 110 days in 2021. Snyk's Director of Developer Relations notes that tools like static application security testing (SAST) and software composition analysis (SCA) can help automate the detection and remediation of open source vulnerabilities, but resourcing challenges remain a major issue.

Snyk Chief Architect Josh Stella describes how cloud computing has transformed security from protecting isolated, hardware-based data centers to managing highly dynamic, software-defined environments configured largely through infrastructure as code. He argues that attackers now use automation to rapidly scan public-facing assets and exploit weaknesses, while many major cloud breaches stem not from one isolated flaw but from insecure system design and insufficient protection of the control plane, enabling lateral movement after entry. Stella outlines five connected cloud security fundamentals: understanding the environment, preventing misconfigurations through secure design, equipping developers with automated guidance, enforcing policy as code throughout the software development lifecycle, and measuring organization-specific security outcomes. Following its acquisition of Fugue, Snyk aims to integrate cloud security posture management into DevSecOps workflows to help teams build, deploy, and operate cloud infrastructure more securely.

C++ is widely used in system programming, embedded development, desktop and server applications, gaming, virtual reality, IoT firmware, and language runtimes, but its close interaction with memory and operating systems requires careful security practices. Key recommendations include validating and sanitizing all user input, correctly clearing failed input streams, checking input lengths, formats, types, and ranges, and preventing arithmetic overflow or underflow through explicit boundary checks and compiler sanitizers. Developers should avoid unsafe string functions such as `strcpy()` and `strcat()`, securely manage file streams to reduce path traversal and file-handling risks, and limit use of `system()` and other process-execution functions because they can enable command injection or expose sensitive operating-system functionality. The material also emphasizes scanning dependencies and project libraries with static code analysis tools, using Snyk’s CLI as an example for identifying known vulnerabilities in unmanaged C++ projects, and argues that incorporating security throughout development helps protect applications, users, and their data.

Container security is vital as vulnerabilities can impact production environments. To create secure container images, developers should follow these five best practices: 1) Secure code and dependencies using integrated scanning tools; 2) Start with a minimal base image from a trusted source like Docker Hub; 3) Manage all layers between the base image and your code by prioritizing necessary tools and removing extras; 4) Use access management to limit user operations over container resources, following the principle of least privilege; and 5) Secure container infrastructure, including registries and orchestration platforms like Kubernetes.

The article provides 10 React security best practices to help developers secure their applications against common vulnerabilities such as cross-site scripting (XSS), URL-based script injection, and JSON injection attacks. It emphasizes the importance of using default XSS protection with data binding, sanitizing HTML, avoiding direct DOM access, and securing server-side rendering. The article also highlights the need to check for known vulnerabilities in dependencies, avoid using vulnerable versions of React, and use linter configurations to detect security issues in code. Additionally, it provides tools such as Snyk and dompurify to help developers identify and fix security issues in their applications.

At Pinterest, integrating security tools into the developer workflow is crucial for protecting against open-source vulnerabilities in their code repositories. They prioritize visibility, scanning, and triaging of vulnerabilities to ensure prompt fixes are applied without overwhelming developers. To achieve this, they use Snyk's developer-friendly features, language-specific repos, and a centralized system for getting visibility across all open source libraries in use. The team automates scans throughout the pipeline, making it transparent to developers and reducing manual efforts into self-service. By providing educational resources and triaging efficiently, Pinterest ensures that developers can stay within their workflows while knowing everything they need to know about vulnerabilities, ultimately achieving a developer-friendly workflow with an emphasis on security.

The field of computer science is often overlooked in higher education, with many programs lacking a dedicated course on computer security. This omission creates a significant problem, as the cybersecurity workforce gap continues to grow, and companies need qualified professionals to defend against cyber attacks. The lack of computer security courses in programs across Canada and the United States means that students may not be adequately prepared for the industry, despite graduating with broad knowledge across many areas. While some universities offer security courses, they are often elective or required only in a limited number of programs, leaving many graduates unprepared for the workforce. To address this issue, organizations like Snyk Learn are providing free and high-quality developer education on computer security, offering lessons that cover vulnerabilities and mitigation techniques to help developers learn more about secure coding practices.

Apache Commons Configuration versions 2.4 through 2.7 may allow arbitrary code execution when attacker-controlled configuration values are processed through its default variable interpolation feature, particularly via enabled URL, DNS, and script lookup prefixes. Although the issue is characterized as configuration manipulation rather than a Log4Shell-scale vulnerability, malicious configurations or compromised dynamic resources could load remote content, execute scripts, and potentially enable lateral movement across a network. Java 8 through 15 installations are especially relevant because they commonly included the Nashorn scripting engine, which could execute JavaScript or Java-based commands through interpolation, while later Java versions require a separately supplied script engine. Version 2.8 and later mitigates the risk by disabling URL, DNS, and script prefixes by default, and organizations are advised to sanitize configuration inputs, monitor ownership and expiration of referenced domains, upgrade affected dependencies, use supported Java releases, and scan applications for vulnerable versions.

Webhooks offer a simple and effective way to transfer information about occasional events between systems, but they also introduce security risks due to their public nature. To secure webhooks, it's essential to implement multiple security measures, such as encryption, two-way authentication, signing messages with hash-based message authentication codes (HMAC), authenticating connections, adding timestamps to prevent replay attacks, using certificate pinning, and logging all webhook messages sent out. Additionally, webhooks should not be used for sensitive data, and implementing a subscription model with expiration dates can further enhance security by limiting the time privileges are provided. By combining these measures, developers can establish a comprehensive security approach that protects their code and client data from various vulnerabilities.

To build a secure WebSocket server in Python, you need to implement several features such as CORS, authentication, and rate limiting. The python-socketio library provides many built-in features for implementing these measures, including automatic HTTP compression, cross-origin resource sharing (CORS), user authentication, and payload size restriction. To enable CORS, you can set the cors_allowed_origins parameter when initializing the WebSocket server instance. This allows or blocks domains from making cross-origin requests. Additionally, you should authenticate WebSocket clients before connecting using a username and password system. The server verifies the credentials and checks if they exist in a database before authenticating the user. To prevent denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks, you can enforce rate limiting on your server by limiting the frequency of API requests each user can make. You should also restrict payload size to protect your WebSocket server from crashes caused by oversized messages. Finally, use TLS/SSL encryption to secure socket communication and ensure that sensitive information is not stolen via man-in-the-middle attacks.