August 2022 Summaries

When scanning an image using the Snyk Container test/monitor commands, application vulnerabilities will be scanned for by default, starting in the near future. This change will update the JSON output to include a new "applications" key with an array of all application scan results. The updated CLI version 1.962.0 now includes this feature. Users should expect potentially more vulnerabilities detected if they haven't specified the --app-vulns flag, and can opt out by using the --exclude-app-vulns flag to maintain previous behavior. Users are recommended to update their Snyk CLI to take advantage of this new capability and test with their current configuration as soon as possible.

Containers provide a predictable, replicable way to run applications by isolating software from its environment, increasing consistency and reliability across development and staging environments. Container isolation is achieved through various mechanisms like control groups, secure computing mode filters, kernel namespaces, sandbox containers, and virtualized containers. Best practices for security and methodology vary depending on the container type, including Linux containers, sandboxed containers, and lightweight virtual machines. Key considerations include performance, security, complexity, and development time when choosing a container isolation approach. Employing best practices such as using dedicated users, limiting capabilities, blocking unneeded network devices, and configuring kernel parameters can help reduce the attack surface of containers. Additionally, developer-first approaches like using code scanners and container scanners to keep content secure are essential for maintaining container security.

The principle of least privilege (PoLP) is a defensive strategy that ensures users can only access the systems, processes, networks, and files required to complete their assigned tasks. This helps safeguard against unauthorized actions and maintain efficient operational performance. Kubernetes uses role-based access control (RBAC) to implement PoLP by defining permissions for individual roles within a cluster. By creating and binding roles, teams can restrict access to specific resources while ensuring only authorized users can perform necessary functions. RBAC helps align with PoLP by limiting exposure to potential bad actors without impeding job functions. Kubernetes provides an extensive native RBAC mechanism that enables configuration of permissions based on user roles, allowing teams to secure their cluster and containerized applications.

Managing Java dependencies effectively is crucial for maintaining a secure and efficient application. By following best practices, developers can avoid common pitfalls such as outdated libraries, compatibility issues, and security vulnerabilities. A well-planned strategy for selecting, updating, and removing dependencies can help prevent these problems and ensure the overall quality of the application. The use of repository managers, dependency scanning tools like Snyk, and plugins in package managers can greatly aid in managing Java dependencies. By adopting a proactive approach to dependency management, developers can create a solid foundation for their Java applications and maintain them securely over time.

A new container security cheat sheet and report has been announced, outlining 8 best practices for implementing a modern approach to container security that focuses on secure code, runtime scanning, and threat prioritization. The guide emphasizes the need for developers to take control of application security from source code to runtime, with a focus on automation and integration with existing workflows. Key strategies include using source code scanning tools, software composition analysis (SCA) tools, image security, runtime security, network security, Kubernetes and cloud security, vulnerability prioritization using runtime signals, and securing containers from within the development pipeline. The goal is to provide developers with a developer-first approach to container security that scales and aligns with the iterative DevOps model.

Docker provides a solution for managing secrets in distributed containerized systems, even if not using Kubernetes. The built-in Swarm orchestrator offers a secure way to store and transmit sensitive information such as passwords, private keys, tokens, and API keys. Using a secret manager is recommended over hard-coding secrets or environment variables, which are less secure. Docker's secrets management service provides an automated process for keeping sensitive data secure, while also offering fine-grained control over access to the secrets. The CLI commands enable users to input secrets, exercise control over services accessing them, and list available secrets in the Swarm. External secret management alternatives such as Cloud Provider solutions are also worth considering.

This cheat sheet provides best practices for building a production-grade Java container using Docker. The guidelines focus on creating an optimized, secure Java container for applications. Key points include using explicit and deterministic Docker base image tags, only installing necessary components in the Java container image, finding and fixing security vulnerabilities, using multi-stage builds to reduce image size, not running Java apps as root, properly handling events to safely terminate a Java application, gracefully tearing down Java applications, keeping unnecessary files out of container images with .dockerignore, ensuring Java is container-aware, and being cautious when using automatic Docker container generation tools.

The key points of this text revolve around the concept of argument injection when using Version Control System (VCS) tools like git and mercurial. The main goal of this research is to explore how it's possible to execute arbitrary commands even when using a safe API that prevents command injection. This is achieved by exploiting options in these VCS tools, such as aliases and hooks, which allow users to specify custom commands or modify the behavior of existing ones. These vulnerabilities can be exploited by adding the "--" characters before user-controlled values, effectively separating arguments from potentially malicious input. Remediation suggestions include ensuring that user-provided values do not change the behavior of commands by injecting or manipulating options, and documenting the handling of such values to avoid confusion among users. The research highlights the importance of proper sanitization and secure coding practices when working with VCS tools, even in the presence of safe APIs designed to prevent command injection.

Drupal 10 is expected to be released in December 2022, bringing new features such as an automated update system and upgrades to third-party dependencies. To secure this version of Drupal, it's essential to track known vulnerabilities through the Snyk Vulnerability Database and stay up-to-date with the latest security advisories. Implementing a Content Security Policy (CSP) can help detect and neutralize cross-site scripting (XSS) attacks, which are a common type of vulnerability in Drupal. Using HTTPS is also crucial to secure the connection between the website and users, as it encrypts data and makes it difficult for hackers to intercept it. Applying the principle of least privilege can limit access rights to only those resources needed by users, reducing the risk of malicious actors accessing sensitive areas of the site. Finally, using Drupal security modules such as Login Security, Security Review, and Password policy module can help identify vulnerabilities and harden the site against attacks. By following these five security best practices, developers can ensure their Drupal sites are secure and up-to-date with the latest features and fixes.

The open source software ecosystem is interconnected, making it challenging for developers to be aware of security issues in dependencies and continuously patch vulnerabilities in time. Open source projects are increasingly targeted due to the complexity of the supply chain and the ease with which attackers can exploit unpatched vulnerabilities. Buffer overflow vulnerabilities, such as those found in the Glibc bug, are pervasive in low-level programming languages like C++ and can be exploited by hackers to compromise systems. To mitigate these risks, developers must identify vulnerabilities in open source dependencies using automated vulnerability scanners like Snyk for C/C++. This can help minimize false-positive reports, reduce white noise, and provide visibility into the open source code being used. By scanning open source C++ projects with such a scanner, developers can protect their software from being compromised by malicious libraries and exploit vulnerabilities in time.

The Ruby gem installation process has a vulnerability known as lockfile injection, where a malicious user can modify the Gemfile.lock file to contain different dependencies than those specified in the Gemfile manifest, potentially leading to arbitrary code execution. This attack is made possible by the fact that lockfiles are machine-generated and not often reviewed during code reviews. The vulnerability exists because Ruby does not allow package maintainers to execute arbitrary commands during install time, unlike some other package managers. However, this can be mitigated by using automated tools to manage dependencies, reviewing code changes carefully, and using flags like `--deployment` with `bundle install`.

Snyk security researchers have identified 12 unique pieces of malware, all belonging to the same actor, that were found in PyPi packages. These malicious packages steal Discord and Roblox credential and payment information by executing malicious executable files downloaded from the Discord content delivery network (CDN) onto Windows machines. The malware targets data stored for everyday user applications, including Google Chrome passwords, cookies, web history, search history, and bookmarks. It also injects a persistent malicious agent into the Discord app to relay alarming amounts of information to attackers. Additionally, it steals Roblox cookies and user data by executing executable files downloaded from the Roblox CDN onto Windows machines. The malware uses PyInstaller to bundle its application and dependencies into one package, attempting to avoid detection by bundling in dependencies instead of downloading them from a remote server. Snyk's security researchers continually monitor open source ecosystems for malicious packages using static analysis techniques to identify and flag suspicious packages.

A comprehensive guide to code review tools for Python developers, covering various types of code reviews, the role of static analysis tools, and top 8 Python code review tools, along with a checklist for conducting effective code reviews. The article emphasizes the importance of manual code reviews, the benefits of using code review tools, and provides best practices for conducting code reviews to ensure high-quality code.

Snyk has launched a free online learning platform called Snyk Training to help developers and security teams learn how to implement, configure, and use Snyk effectively. The platform offers courses on implementation, configuring and managing Snyk organizations, and finding and fixing issues with Snyk. Most courses take between 3 and 10 minutes, providing a quick overview for users to get started with the Snyk journey. Additionally, there is a video library available for quick demonstrations or refreshers on key Snyk tasks.

Creating a reverse shell attack is possible through various methods, including exploiting remote code execution vulnerabilities. This can happen when an application is vulnerable to a vulnerability that allows an attacker to execute code on the victim's machine, initiating a shell session and gaining control over the system. To create a reverse shell connection, tools like netcat can be used to listen for incoming connections on a specific port. Additionally, programming languages such as Java, Python, and Node.js provide ways to execute shell commands that initiate the reverse shell. However, creating a reverse shell attack requires leveraging code execution vulnerabilities, such as the Log4Shell vulnerability. To prevent reverse shell attacks, measures can be taken such as removing execution statements, sanitizing and validating input, running applications with limited privileges, and preventing vulnerabilities that enable remote code execution. Tools like Snyk can help identify potential security mistakes in custom code and check transitive dependencies for known vulnerabilities.

Forbes has named Snyk to the Forbes Cloud 100 list for the third consecutive year, ranking #20, recognizing the company's mission to empower developers to build secure applications in a rapidly evolving digital landscape. Snyk's growth and recognition are attributed to its ability to help customers save time with solutions such as Log4Shell, doubling its customer base to over 2,000 globally, and expanding its employee count to over 1,300 worldwide. The company has also made significant acquisitions, including FossID and cloud security firm Fugue, and announced partnerships with Google Cloud and the Linux Foundation, further solidifying its position as a leader in developer-centric cloud security solutions.

AWS re:Inforce 2022 was a conference focused on cloud security, bringing together security practitioners and experts to discuss AWS services, features, and tools. The key takeaways from the conference emphasized the importance of implementing security in the beginning of the cycle, prioritizing least privilege, IAM, data visibility, and security. New features announced included Amazon GuardDuty Malware Protection for EBS volumes, Amazon Detective for Elastic Kubernetes Service (EKS), AWS SSO rebranded as IAM Identity Center, and AWS Config now supporting compliance scores. The conference also highlighted the importance of a layered defense strategy, stronger together approach, and democratizing security ownership within organizations. Additionally, AWS announced new tools such as AWS Wickr, an end-to-end encrypted enterprise communication service, and AWS Marketplace Vendor Insights, which provides real-time security information for third-party software vendors.

ruby The Ruby ecosystem's dependency management is crucial due to the presence of malicious code or backdoors in third-party open source libraries. Bundler and RubyGems are two tools used for managing dependencies, with Bundler being a gem itself that eases the burden of installing gems one-by-one. The Gemfile manifest file describes all dependencies needed by a project, while the Gemfile.lock lockfile pins the entire nested dependency tree to ensure consistency across installations. bundler-audit scans for security vulnerabilities in Ruby gems, and Snyk provides a rich database of security vulnerabilities in the Ruby ecosystem, complementing bundler-audit's checks. Using both tools is recommended to secure dependencies.

The Snyk Developer Challenge is an event that allows conference attendees to test their security skills by fixing vulnerabilities in open-source projects, with the goal of earning points on a leaderboard and potentially winning a prize. The challenge takes place over several conferences in 2022, including THAT Conference, KCDC, Developer Week Cloud, DevOpsWorld by Cloudbees, NodeConf, and All Things Open. To participate, attendees simply need to register with an email address and alias, submit their chosen open-source projects, and start fixing vulnerabilities, with the option to import up to 10 projects. The challenge is designed to be fun and engaging, with no data collected or stored, and features a virtual "capture the flag" workshop for those who want to learn more about solving capture the flag challenges.