August 2022 Summaries

Docker containerization can benefit both modern .NET applications and legacy ASP.NET applications built on .NET Framework 4.x, with Windows containers providing support for Windows-only workloads that organizations may not yet be ready to migrate. Using Visual Studio 2022 and Docker Desktop, developers can create projects with Docker support enabled or add a Dockerfile to existing Web Forms projects to build and run applications locally. The guidance emphasizes minimizing image size and attack surface by choosing slim base images, such as Windows Server Core or Nano Server for .NET Framework, and lightweight Linux images for newer .NET versions; multistage builds should use SDK images only during compilation and runtime images in production. An example .NET 6 application reduced its image size from 208 MB to 100 MB by adopting slimmer base images. Because outdated base images, libraries, and application code can introduce vulnerabilities, regular updates and image scanning are recommended, with Snyk CLI commands used to test and continuously monitor local container images; a sample image based on .NET Core 2.2 revealed 193 vulnerabilities.

When scanning an image using the Snyk Container test/monitor commands, application vulnerabilities will be scanned for by default, starting in the near future. This change will update the JSON output to include a new "applications" key with an array of all application scan results. The updated CLI version 1.962.0 now includes this feature. Users should expect potentially more vulnerabilities detected if they haven't specified the --app-vulns flag, and can opt out by using the --exclude-app-vulns flag to maintain previous behavior. Users are recommended to update their Snyk CLI to take advantage of this new capability and test with their current configuration as soon as possible.

A Zapier-based JavaScript workflow can automate sharing trending Reddit posts in Slack without hosting a dedicated bot server. The process uses a scheduled Zapier trigger, a Code by Zapier action to retrieve and format subreddit posts, and Slack’s native “Send Channel Message” action to publish the results. Reddit data can be obtained either through OAuth using a registered application’s client credentials, refresh token, and access token, or through a simpler public JSON endpoint for read-only access to subreddit listings. The example retrieves top r/node posts for a selected timeframe, builds Slack-formatted links from post titles and permalinks, and sends the resulting message to a chosen channel. It also notes that Zapier’s Node.js 10 environment is end-of-life, highlights the current Reddit time query parameter, and recommends following Reddit API terms and JavaScript security practices.

Containers provide a predictable, replicable way to run applications by isolating software from its environment, increasing consistency and reliability across development and staging environments. Container isolation is achieved through various mechanisms like control groups, secure computing mode filters, kernel namespaces, sandbox containers, and virtualized containers. Best practices for security and methodology vary depending on the container type, including Linux containers, sandboxed containers, and lightweight virtual machines. Key considerations include performance, security, complexity, and development time when choosing a container isolation approach. Employing best practices such as using dedicated users, limiting capabilities, blocking unneeded network devices, and configuring kernel parameters can help reduce the attack surface of containers. Additionally, developer-first approaches like using code scanners and container scanners to keep content secure are essential for maintaining container security.

The principle of least privilege (PoLP) is a defensive strategy that ensures users can only access the systems, processes, networks, and files required to complete their assigned tasks. This helps safeguard against unauthorized actions and maintain efficient operational performance. Kubernetes uses role-based access control (RBAC) to implement PoLP by defining permissions for individual roles within a cluster. By creating and binding roles, teams can restrict access to specific resources while ensuring only authorized users can perform necessary functions. RBAC helps align with PoLP by limiting exposure to potential bad actors without impeding job functions. Kubernetes provides an extensive native RBAC mechanism that enables configuration of permissions based on user roles, allowing teams to secure their cluster and containerized applications.

Managing Java dependencies effectively is crucial for maintaining a secure and efficient application. By following best practices, developers can avoid common pitfalls such as outdated libraries, compatibility issues, and security vulnerabilities. A well-planned strategy for selecting, updating, and removing dependencies can help prevent these problems and ensure the overall quality of the application. The use of repository managers, dependency scanning tools like Snyk, and plugins in package managers can greatly aid in managing Java dependencies. By adopting a proactive approach to dependency management, developers can create a solid foundation for their Java applications and maintain them securely over time.

gRPC is an open-source RPC framework developed by Google that uses HTTP/2 and Protocol Buffers to let distributed applications invoke remote server functions as though they were local, making it well suited to high-performance, data-intensive, and streaming workloads. The tutorial builds a Node.js event-management application with an in-memory data store, defining CRUD operations and message structures in an `events.proto` file, implementing the gRPC service with `@grpc/grpc-js` and `@grpc/proto-loader`, and exposing an Express-based client API that communicates with the gRPC server. It explains how to initialize the project, install dependencies, load protobuf definitions, run the server and client on separate local ports, and test endpoints through a browser or API tool. The tutorial also secures communication through SSL/TLS by generating certificate authority, server, and client certificates with OpenSSL and configuring mutual TLS credentials on both sides. While gRPC offers speed, strong typing, multilingual support, and security features that benefit internal microservices, it may be less appropriate for simple applications and has limitations including limited browser support, binary rather than human-readable payloads, a learning curve, and weak edge-caching support.

A new container security cheat sheet and report has been announced, outlining 8 best practices for implementing a modern approach to container security that focuses on secure code, runtime scanning, and threat prioritization. The guide emphasizes the need for developers to take control of application security from source code to runtime, with a focus on automation and integration with existing workflows. Key strategies include using source code scanning tools, software composition analysis (SCA) tools, image security, runtime security, network security, Kubernetes and cloud security, vulnerability prioritization using runtime signals, and securing containers from within the development pipeline. The goal is to provide developers with a developer-first approach to container security that scales and aligns with the iterative DevOps model.

Docker provides a solution for managing secrets in distributed containerized systems, even if not using Kubernetes. The built-in Swarm orchestrator offers a secure way to store and transmit sensitive information such as passwords, private keys, tokens, and API keys. Using a secret manager is recommended over hard-coding secrets or environment variables, which are less secure. Docker's secrets management service provides an automated process for keeping sensitive data secure, while also offering fine-grained control over access to the secrets. The CLI commands enable users to input secrets, exercise control over services accessing them, and list available secrets in the Swarm. External secret management alternatives such as Cloud Provider solutions are also worth considering.

This cheat sheet provides best practices for building a production-grade Java container using Docker. The guidelines focus on creating an optimized, secure Java container for applications. Key points include using explicit and deterministic Docker base image tags, only installing necessary components in the Java container image, finding and fixing security vulnerabilities, using multi-stage builds to reduce image size, not running Java apps as root, properly handling events to safely terminate a Java application, gracefully tearing down Java applications, keeping unnecessary files out of container images with .dockerignore, ensuring Java is container-aware, and being cautious when using automatic Docker container generation tools.

The key points of this text revolve around the concept of argument injection when using Version Control System (VCS) tools like git and mercurial. The main goal of this research is to explore how it's possible to execute arbitrary commands even when using a safe API that prevents command injection. This is achieved by exploiting options in these VCS tools, such as aliases and hooks, which allow users to specify custom commands or modify the behavior of existing ones. These vulnerabilities can be exploited by adding the "--" characters before user-controlled values, effectively separating arguments from potentially malicious input. Remediation suggestions include ensuring that user-provided values do not change the behavior of commands by injecting or manipulating options, and documenting the handling of such values to avoid confusion among users. The research highlights the importance of proper sanitization and secure coding practices when working with VCS tools, even in the presence of safe APIs designed to prevent command injection.

Drupal 10 is expected to be released in December 2022, bringing new features such as an automated update system and upgrades to third-party dependencies. To secure this version of Drupal, it's essential to track known vulnerabilities through the Snyk Vulnerability Database and stay up-to-date with the latest security advisories. Implementing a Content Security Policy (CSP) can help detect and neutralize cross-site scripting (XSS) attacks, which are a common type of vulnerability in Drupal. Using HTTPS is also crucial to secure the connection between the website and users, as it encrypts data and makes it difficult for hackers to intercept it. Applying the principle of least privilege can limit access rights to only those resources needed by users, reducing the risk of malicious actors accessing sensitive areas of the site. Finally, using Drupal security modules such as Login Security, Security Review, and Password policy module can help identify vulnerabilities and harden the site against attacks. By following these five security best practices, developers can ensure their Drupal sites are secure and up-to-date with the latest features and fixes.

Snyk’s International Dog Day campaign highlights the origins of its Doberman mascot, Patch, and connects the breed’s protective reputation to the company’s security focus. The post describes how founder Guy Podjarny and the branding team selected a friendly guard-dog concept, refined the recognizable ear-based logo, chose purple to reference security “purple teams,” and eventually adopted the name Patch. Running from August 22 to 27, the 2022 campaign includes a social-media sweepstakes for a custom dog sketch and encourages participation through the #DevelopersBestFriend tag. Snyk Impact also planned a $10,000 donation to Humane Society International and matching donations for eligible employee contributions to eight animal welfare and guide-dog organizations worldwide.

The open source software ecosystem is interconnected, making it challenging for developers to be aware of security issues in dependencies and continuously patch vulnerabilities in time. Open source projects are increasingly targeted due to the complexity of the supply chain and the ease with which attackers can exploit unpatched vulnerabilities. Buffer overflow vulnerabilities, such as those found in the Glibc bug, are pervasive in low-level programming languages like C++ and can be exploited by hackers to compromise systems. To mitigate these risks, developers must identify vulnerabilities in open source dependencies using automated vulnerability scanners like Snyk for C/C++. This can help minimize false-positive reports, reduce white noise, and provide visibility into the open source code being used. By scanning open source C++ projects with such a scanner, developers can protect their software from being compromised by malicious libraries and exploit vulnerabilities in time.

Python assert statements provide a concise way to verify assumptions during debugging and testing, raising an AssertionError with an optional message when a condition evaluates to false. A simple-interest example shows how asserts can identify invalid arguments such as non-positive integers, but it also demonstrates their central limitation: Python disables assertions when run in optimized mode with the -O flag, setting __debug__ to false and skipping all assert statements. Consequently, asserts should not be used for production input validation, normal error handling, control flow, authentication, or authorization, since disabled checks can lead to unexpected errors or serious security vulnerabilities, such as granting administrator access to users without an admin role. Safer alternatives for runtime validation include conditional statements, explicit exceptions, type hints, validators, unit tests, and debuggers, while asserts are best reserved for detecting programmer errors and isolating bugs during development.

The Ruby gem installation process has a vulnerability known as lockfile injection, where a malicious user can modify the Gemfile.lock file to contain different dependencies than those specified in the Gemfile manifest, potentially leading to arbitrary code execution. This attack is made possible by the fact that lockfiles are machine-generated and not often reviewed during code reviews. The vulnerability exists because Ruby does not allow package maintainers to execute arbitrary commands during install time, unlike some other package managers. However, this can be mitigated by using automated tools to manage dependencies, reviewing code changes carefully, and using flags like `--deployment` with `bundle install`.

C++ security requires careful resource and memory management because its low-level capabilities can expose applications to vulnerabilities that compromise reliability, data, or system control. Key risks include buffer overflows caused by unchecked input and unsafe functions, integer overflows or underflows that can produce incorrect allocations and enable memory corruption, and improperly initialized or null pointers that may cause unpredictable reads, writes, crashes, or arbitrary behavior. The discussion also highlights incorrect signed-to-unsigned and narrowing type conversions, which can alter program logic or lose data, and format string vulnerabilities, where unvalidated user input passed to functions such as printf can expose memory contents. Recommended mitigations include bounds and range checking, avoiding unsafe library functions, using protections such as stack canaries, ASLR, and DEP, preferring references, smart pointers, and RAII over raw pointers, minimizing unsigned arithmetic and mixed signedness, and using fixed format strings or modern C++ formatting facilities such as std::format.

Snyk security researchers have identified 12 unique pieces of malware, all belonging to the same actor, that were found in PyPi packages. These malicious packages steal Discord and Roblox credential and payment information by executing malicious executable files downloaded from the Discord content delivery network (CDN) onto Windows machines. The malware targets data stored for everyday user applications, including Google Chrome passwords, cookies, web history, search history, and bookmarks. It also injects a persistent malicious agent into the Discord app to relay alarming amounts of information to attackers. Additionally, it steals Roblox cookies and user data by executing executable files downloaded from the Roblox CDN onto Windows machines. The malware uses PyInstaller to bundle its application and dependencies into one package, attempting to avoid detection by bundling in dependencies instead of downloading them from a remote server. Snyk's security researchers continually monitor open source ecosystems for malicious packages using static analysis techniques to identify and flag suspicious packages.

Snyk’s Kubernetes integration enables organizations to continuously scan running workloads for container-image vulnerabilities and insecure configurations, while allowing separate teams to control monitoring for their own namespaces. The walkthrough demonstrates installing multiple Snyk Monitor controllers in a single Kubernetes cluster, using distinct namespaces such as apples and bananas and optionally separate Snyk organizations and integration IDs for isolation. Each controller is configured through Kubernetes secrets, ConfigMaps, Helm deployments, and Rego policies that determine which workload types in its assigned namespace are automatically imported or removed from monitoring, excluding examples such as CronJobs and Services. After deployment, sample applications in each namespace are automatically discovered, scanned, and added to the corresponding Snyk organization, and controller logs can be inspected to troubleshoot configuration issues. The approach requires a Snyk Business or Enterprise account and is intended to give multi-team Kubernetes environments more granular security-monitoring ownership.

A comprehensive guide to code review tools for Python developers, covering various types of code reviews, the role of static analysis tools, and top 8 Python code review tools, along with a checklist for conducting effective code reviews. The article emphasizes the importance of manual code reviews, the benefits of using code review tools, and provides best practices for conducting code reviews to ensure high-quality code.

Snyk has launched a free online learning platform called Snyk Training to help developers and security teams learn how to implement, configure, and use Snyk effectively. The platform offers courses on implementation, configuring and managing Snyk organizations, and finding and fixing issues with Snyk. Most courses take between 3 and 10 minutes, providing a quick overview for users to get started with the Snyk journey. Additionally, there is a video library available for quick demonstrations or refreshers on key Snyk tasks.

Creating a reverse shell attack is possible through various methods, including exploiting remote code execution vulnerabilities. This can happen when an application is vulnerable to a vulnerability that allows an attacker to execute code on the victim's machine, initiating a shell session and gaining control over the system. To create a reverse shell connection, tools like netcat can be used to listen for incoming connections on a specific port. Additionally, programming languages such as Java, Python, and Node.js provide ways to execute shell commands that initiate the reverse shell. However, creating a reverse shell attack requires leveraging code execution vulnerabilities, such as the Log4Shell vulnerability. To prevent reverse shell attacks, measures can be taken such as removing execution statements, sanitizing and validating input, running applications with limited privileges, and preventing vulnerabilities that enable remote code execution. Tools like Snyk can help identify potential security mistakes in custom code and check transitive dependencies for known vulnerabilities.

Forbes has named Snyk to the Forbes Cloud 100 list for the third consecutive year, ranking #20, recognizing the company's mission to empower developers to build secure applications in a rapidly evolving digital landscape. Snyk's growth and recognition are attributed to its ability to help customers save time with solutions such as Log4Shell, doubling its customer base to over 2,000 globally, and expanding its employee count to over 1,300 worldwide. The company has also made significant acquisitions, including FossID and cloud security firm Fugue, and announced partnerships with Google Cloud and the Linux Foundation, further solidifying its position as a leader in developer-centric cloud security solutions.

AWS re:Inforce 2022 was a conference focused on cloud security, bringing together security practitioners and experts to discuss AWS services, features, and tools. The key takeaways from the conference emphasized the importance of implementing security in the beginning of the cycle, prioritizing least privilege, IAM, data visibility, and security. New features announced included Amazon GuardDuty Malware Protection for EBS volumes, Amazon Detective for Elastic Kubernetes Service (EKS), AWS SSO rebranded as IAM Identity Center, and AWS Config now supporting compliance scores. The conference also highlighted the importance of a layered defense strategy, stronger together approach, and democratizing security ownership within organizations. Additionally, AWS announced new tools such as AWS Wickr, an end-to-end encrypted enterprise communication service, and AWS Marketplace Vendor Insights, which provides real-time security information for third-party software vendors.

ruby The Ruby ecosystem's dependency management is crucial due to the presence of malicious code or backdoors in third-party open source libraries. Bundler and RubyGems are two tools used for managing dependencies, with Bundler being a gem itself that eases the burden of installing gems one-by-one. The Gemfile manifest file describes all dependencies needed by a project, while the Gemfile.lock lockfile pins the entire nested dependency tree to ensure consistency across installations. bundler-audit scans for security vulnerabilities in Ruby gems, and Snyk provides a rich database of security vulnerabilities in the Ruby ecosystem, complementing bundler-audit's checks. Using both tools is recommended to secure dependencies.

Slidev is an open-source, Vue.js-based presentation framework that lets developers create slide decks with Markdown, YAML frontmatter, HTML, CSS, and reusable Vue components, offering a code-centered alternative to tools such as Keynote, Google Slides, and Slides.com. It supports Git-based version control and collaboration, offline-friendly development, customizable themes, hot reloading, speaker notes, syntax-highlighted and click-animated code examples, interactive components, images, footnotes, and per-slide styling. A Slidev project can be initialized with npm, with a primary slides.md file containing the deck’s content and configuration, then run locally in a browser. Additional capabilities include light and dark theme modes, browser-based presenter mode accessible from other devices, and export to PDF or PNG using Playwright, while static deployments and automated exports can be managed through CI workflows and hosting platforms such as Vercel or Netlify.

PHP remains widely used for web applications and is supported by official Docker images, but container isolation alone does not guarantee security, particularly because vulnerable dependencies, misconfigurations, and overly permissive access can expose applications and hosts to attack. Recommended practices include imposing CPU, memory, and other resource limits to reduce denial-of-service risks; running both the container runtime and applications as non-root users under the principle of least privilege; and using trusted, verified, and signed base images from reputable registries. The discussion also emphasizes automated vulnerability scanning of container images, dependencies, infrastructure configuration, and PHP source code, with tools such as Snyk able to identify CVEs, suggest updated images, open remediation pull requests, and monitor for newly discovered issues. Integrating these checks into IDEs, CI/CD pipelines, Git workflows, and Kubernetes environments can help teams maintain security from development through production, while recognizing that developers remain responsible for applying layered protections throughout the container lifecycle.

Terraform is an infrastructure-as-code platform that uses HashiCorp Configuration Language (HCL) to automate deployments of cloud and on-premises resources, and its configurations require testing to prevent deployment, security, and resource-management problems. Testing approaches range from built-in commands such as terraform validate for syntax checks and terraform plan for simulating changes, to drift detection tools such as driftctl and CloudQuery that identify differences between Terraform state and actual environments. Recommended strategies include unit testing individual modules, linting for code quality and insecure patterns, integration testing dependent modules with tools like Terratest, compliance testing against organizational and regulatory policies, and end-to-end testing of complete deployments, though the latter can be time-consuming. Teams can also use the Cloud Development Kit for Terraform (CDKTF) to define infrastructure in languages such as Python, C#, Go, and Java rather than HCL. Security-focused tools including Snyk Infrastructure as Code support policy-based scanning, custom rules through Open Policy Agent and Rego, and drift detection to help incorporate security and compliance checks earlier in DevOps workflows.

Snyk has appointed Manoj Nair as Chief Product Officer to lead its global product organization and define the strategy and roadmap for its developer-focused security platform, which now spans open-source, code, container, infrastructure-as-code, and cloud security. Nair joins from Commvault, where he led cloud and SaaS businesses, and brings prior executive experience from HyperGrid, Hewlett Packard Enterprise, Dell EMC, and RSA Security, along with numerous security and information-management patents. He succeeds Aner Mazur in the product leadership role, while Mazur becomes Senior Vice President of Market Strategy and executive sponsor for Snyk’s expanding cloud security business. The leadership changes support Snyk’s goal of extending its product-led growth approach from application security into the cloud security market while helping developers build and maintain secure applications.

The Snyk Developer Challenge is an event that allows conference attendees to test their security skills by fixing vulnerabilities in open-source projects, with the goal of earning points on a leaderboard and potentially winning a prize. The challenge takes place over several conferences in 2022, including THAT Conference, KCDC, Developer Week Cloud, DevOpsWorld by Cloudbees, NodeConf, and All Things Open. To participate, attendees simply need to register with an email address and alias, submit their chosen open-source projects, and start fixing vulnerabilities, with the option to import up to 10 projects. The challenge is designed to be fun and engaging, with no data collected or stored, and features a virtual "capture the flag" workshop for those who want to learn more about solving capture the flag challenges.