October 2022 Summaries

The OpenSSL project has announced a critical security vulnerability in version 3.0 that could impact Linux operating systems, including Ubuntu 22.04 LTS and RHEL 9, as well as container images built using affected versions of Linux. The vulnerable versions of OpenSSL are currently used by Node.js 18.x and 19.x, which will likely receive upgrades soon. To prepare for this vulnerability, developers can use Snyk to scan their projects for affected dependencies, including the OpenSSL library, and take steps to update vulnerable installations on November 1, 2022. The OpenSSL project has a long track record of responsibly handling security incidents and providing timely fixes, and staying on top of critical vulnerabilities is a solid strategy for reducing risk and avoiding breaches.

The top five scary AWS misconfigurations are the Cloud Trail misconfiguration, IAM misconfiguration, S3 bucket misconfiguration, EC2 misconfiguration, and RDS misconfiguration. These misconfigurations can lead to security breaches and potential data loss due to inadequate access controls, exposed credentials, and unsecured resources. Enabling Cloud Trail provides critical visibility into AWS account activities, while proper IAM configuration is essential for preventing unauthorized access. S3 bucket misconfigurations can allow attackers to delete logs and sensitive data, while EC2 misconfigurations can expose applications to the internet, creating a vulnerability for malicious users. RDS misconfigurations can put sensitive information at risk if not properly secured. To prevent these security gaps, it is essential to follow best practices for each of these services and stay informed about publicly known vulnerabilities.

A Docker vulnerability is a weakness within an image, container, or host that could potentially be exploited, and is often added to the Common Vulnerabilities and Exposures (CVE) list. The top 5 Docker vulnerabilities include CVE-2019-5736, where a malicious actor can obtain root access on the host; CVE-2022-0847, known as the "dirty pipe" vulnerability, which enables a malicious actor to change the content of files they don't have permission to change and escalate their privileges; CVE-2021-21285, where pulling a malformed Docker image manifest crashes the Docker daemon running on the host system; CVE-2014-9356, a directory traversal vulnerability affecting Docker version 1.3.3; and CVE-2019-14271, an improper initialization vulnerability that allows a malicious actor to execute unauthorized code from within a container. To reduce Docker vulnerabilities, development teams can leverage automated tools for securing the container image, everything inside the container, and the runtime environment, as well as using container scanning and monitoring tools like Snyk to detect and remediate security issues.

Fuzzing is a software security testing technique that automatically provides invalid and random input to an application to expose bugs, helping developers understand the behavior and vulnerability of applications more comprehensively. Fuzzing tools, referred to as fuzzers, are used to perform this kind of testing, which can stress an application to cause unexpected behavior, crashes, or resource leaks. This technique offers several benefits, including preventing zero-day exploits, identifying bugs that hackers can exploit, having a low overhead cost in time and money, and uncovering edge cases that manual testing would be unable to find. Fuzzing use cases include web application fuzzing, API fuzzing, URL fuzzing, protocol fuzzing, and file format fuzzing, each of which helps identify vulnerabilities in different aspects of an application's security posture. While fuzzing tools have limitations, such as not being effective at detecting threats that don't cause application crashes and requiring significant time to complete a testing exercise, they can be combined with other security tools, like Snyk vulnerability scanners, to provide comprehensive security for an application.

"Testing code is the first step to making it secure, and using unit tests ensures that each smaller function within an app behaves as it should." The primary purposes of unit tests include verifying functionality, preventing code regression, documenting code, securing apps, and scoping and writing unit tests. To write a unit test, one should keep tests short and simple, consider both positive and negative test cases, break apart long and complex functions, avoid network and database connections, and use mocking to simulate real-world interactions. The Mocha Framework is used in this tutorial, which guides the reader through creating a new project, implementing a class, configuring and adding unit tests, and running the tests. With unit tests, developers can catch bugs early, prevent code regression, document their code, secure their apps, and refactor and optimize their code without worrying about behavior."

The Domain Name System (DNS) is a fundamental component of the internet infrastructure, translating domain names into IP addresses that other devices and websites use to communicate with them. DNS attacks target the stability and security of the DNS infrastructure, aiming to render it unavailable or intercept and alter the answers provided by the DNS, directing unsuspecting users to malicious websites. There are several types of DNS attacks, including spoofing, cache poisoning, DNS flooding, NXDomain, amplification, hijacking, rebinding, tunneling, phantom domain, and others. Each type of attack requires a different set of countermeasures to mitigate it, but generally, keeping the DNS server software up to date, using a dedicated DNS server, increasing the number of recursive DNS servers, and checking for vulnerabilities are effective measures to prevent DNS attacks. These attacks can be executed by threat actors who use techniques such as intercepting communications between devices and DNS servers, manipulating DNS response queries, infecting routers with malware, routing user traffic to attacker's servers, setting up phantom domain names, and others. To prevent these attacks, organizations should conduct regular DNS audits, blocklist suspicious domain names and servers, temporarily block client's IP address if it sends too many NXDomain requests, increase the Time to Live (TTL) on current DNS records, enforce source IP verifications on all network devices, prevent DNS authoritative name servers from functioning as recursive servers, enforce response rate limiting settings on all DNS servers, configure open DNS resolvers to only respond to queries from a trusted source, protect routers with strong passwords, keep the DNS server and all client operating systems and installed applications up to date, use advanced security solutions including next-generation firewalls, network detection and response (NDR), and monitor all interactions within IT environment.

Node.js provides a single-threaded JavaScript run-time surface that prevents code from running multiple operations in parallel, but it uses a separate pool of threads for I/O operations. The `worker_threads` module allows developers to create independent threads within their Node.js application, enabling parallelism and potential performance improvements. Worker threads are not true threads, but rather distinct processes that can communicate with the main thread using an event-based messaging system. They can be used for CPU-bound operations such as image resizing, video compression, and file encryption, while I/O-bound tasks should be handled by Node.js's built-in async utilities. The `worker_threads` module provides a convenient mechanism for running code in parallel, making it suitable for applications that require intensive work outside the main loop.

Snyk has announced a new native integration with Atlassian's Bitbucket Cloud, providing a seamless security experience within the existing workflow. This integration enables users to access high vulnerability counts and rich contextual information right from their native Bitbucket interface, making it easier to implement and manage open source risk. With this update, Snyk brings its best-in-class open source dependency and container image vulnerability scanning to Bitbucket Cloud users, empowering them to mitigate risks within their existing workflows. The integration is designed for developers, security analysts, and managers alike, facilitating a DevSecOps approach and shared responsibility for security. This partnership with Atlassian aims to bring security best practices to millions of CI/CD pipelines worldwide, providing a streamlined solution that is one-of-a-kind in the industry.

Cloud security fundamentals are shifting from a siloed approach, where security teams focus on compliance and scanning running environments, to an integrated DevSecOps model that empowers developers to build security engineering into their development workflows. This involves using infrastructure as code to enable early security checks, prioritizing developer tool integrations to thread security into the development workflow, and providing useful guidance for remediation through close collaboration between security teams and developers. By adopting these principles, cloud leaders can capture a 10x improvement in time to remediate issues, leading to stronger, less expensive security postures.

A mock API server is a simulated API server that provides realistic responses to the requests it receives from a client, typically used to stand in for a backend server that's still in development. Mock API servers can be used for development, testing, and external components, providing benefits such as removing dependency between frontend and backend teams, facilitating testing, and mocking out external dependencies. When creating a mock API server, best practices include supporting the same schema and interfaces as the actual API, mocking external dependencies, and simulating unexpected errors and slow performance. Various tools can be used to create mock API servers, including Mock Service Worker, Postman, and Mirage JS.

The Snyk Customer Value Study highlights the impact of developer-first security, providing insights into the value that customers are seeing in their security programs. Nearly 350 customers from over 220 organizations shared their experience through an online survey, with top benefits including increased visibility and ease of use. The study found that Snyk's intuitive interface makes code security less overwhelming, and automation and informative reporting keep developers informed about potential security incidents. Customers reported a significant reduction in mean time to fix (MTTF) by 44%, coverage of their codebase increased by 249%, and scanning capabilities were 3.2x faster than other solutions. Additionally, the study found that Snyk's ease of use and scalability resulted in an average ROI of $2.1mm for risk reduction, $327k for developer productivity gains, and a 62% reduction in critical vulnerabilities.

The AWS shared responsibility model divides security responsibilities between AWS and its customers, with AWS responsible for the infrastructure's security and customers responsible for securing everything within that infrastructure. Building an AWS cloud security strategy is crucial to ensure data, code, and cloud workloads are protected. The strategy should include elements like visibility across cloud environments, zero trust policies, cloud native security tools, DevSecOps strategies, regular patches and updates, security automation, defense in depth layering, and implementing eight best practices such as access controls, threat and incident response planning, detection monitoring and alerting, data encryption, backing up data, keeping AWS up to date, planning for regulatory compliance, and scaling security across the development workflow. By adopting these best practices, organizations can protect their applications and organization from various threats.

The TLS/SSL protocol is a crucial safeguard for user information on websites and web applications, protecting data using encryption. To implement TLS/SSL in Python, one must install a valid TLS/SSL certificate, which upgrades the website from HTTP to HTTPS, a more secure transfer protocol. A valid SSL certificate must be issued by a credible certificate authority and have an active issuance date and expiration date. Websites without a valid SSL certificate often lack visible indicators, such as the URL prefix "http://" instead of "https://", and no lock icon in the address bar. Python can be used to verify the validity of a website's SSL certificate using the requests library, which stores the received value in the response variable. The Python SSL library is also used to provide TLS encryption in socket-based communication between Python clients and servers. A self-signed SSL certificate can be generated for local development, but purchasing an SSL certificate from a trusted domain registrar is necessary for deploying a site or app on the internet. Creating a self-signed SSL certificate involves generating a private key, creating a certificate signing request (CSR), and signing the CSR to create the certificate. The process of generating a self-signed SSL certificate can be followed by wrapping the socket with SSL using the Python ssl library.

The text discusses adding Playwright tests to a GitHub Actions CI workflow, which allows developers to run end-to-end tests and ensure cross-browser compatibility. The process involves installing the Playwright npm package, setting up a new test file, and configuring the GitHub Actions workflow to run the tests. Additionally, the article covers how to run Playwright tests for deployed Netlify preview URLs and how to enable Playwright debug features to capture test results and debugging information. The text also compares Playwright with Cypress and provides resources for further learning about Playwright test automation.

The Snyk Code team has removed a Ruby email rule from its platform, citing that it produced more noise than useful findings and was often ignored or not addressed by users. This change aims to reduce low-priority issues related to hardcoded emails in Ruby code, but the tool still offers other security features, such as identifying misused credentials or passwords. The Snyk Code team balances soundness and completeness in its rules, using machine learning and usage data from the app to optimize and adapt to changing environments, new issue types, and varying best practices. This change is part of the ongoing effort to continuously improve the product based on user feedback and suggestions.

This demo showcases how Snyk can be integrated with Argo CD to provide application security in a GitOps framework, ensuring that deployed applications have as few vulnerabilities as possible. By using a declarative, Kubernetes-native continuous delivery tool like Argo CD and an automated pipeline that includes IaC scanning, developers can automate the process of identifying and addressing potential security issues before they reach production. The integration allows Snyk to monitor deployed workloads across different namespaces in Kubernetes, providing real-time visibility into vulnerabilities and prioritizing security issues for prompt attention. By leveraging this workflow, organizations can ensure that their software development life cycle is more secure and compliant with industry standards.

Improving code quality with linting in Python` is a comprehensive guide that explores the benefits and practical applications of using linting tools, specifically Pylint, to improve code quality and adherence to coding standards. By incorporating linting into their development workflow, developers can catch errors and potential issues early on, ensuring more maintainable and reliable codebases. The guide covers setting up a virtual environment, installing Pylint, and running it on individual files and directories to identify and address various types of errors and warnings. It also discusses the importance of customizing and suppressing warnings to suit specific project needs. Throughout the article, the authors demonstrate how linting can be used to ensure better code quality, adhere to coding standards, and improve overall development efficiency.

Security incidents can occur even when companies follow protocols, as seen in the recent Uber breach where an 18-year-old used social engineering to bypass multi-factor authentication. To protect code from vulnerabilities, developers can use tools like Snyk's Code Checker to scan code before copying it into production environments. Snyk provides insights and advice on fixing vulnerabilities, categorizing them by severity, and offers a report card for teams to prioritize fixes based on resources and personnel. The tool also supports creating a pull request with a fix, allowing developers to learn more about the vulnerability and share details if necessary. Additionally, Snyk offers interactive lessons and a YouTube channel for expanding security expertise, as well as connecting with Snyk Ambassadors for security advice.

Ko is a single binary, command line tool designed for building container images without Dockerfiles, SBOMs, and integrating with Kubernetes. It aims to address common issues in container image construction such as base image selection, layer bloat minimization, and security concerns. Ko simplifies the process of creating container images by providing smart defaults, deterministic specializations, and automatic generation of software bill of materials (SBOMs). The tool also supports custom base images, Go compiler flags, Docker labels, and Kubernetes integration through the `ko apply` command. However, using Ko may pose challenges such as cross-platform concerns, skillset atrophy, and security complacency, highlighting the importance of understanding container technologies and maintaining a secure development lifecycle.

SnykWeek New York: In the cloud` is a developer security event that took place at the Public hotel on the Lower East Side in October 2022. The event focused on cloud security practices and featured talks from industry experts, including Snyk Field CTO Simon Maple and Snyk VP Josh Stella. They discussed the future of security, decentralized security practices, and the importance of cloud adoption for security. The event also included a presentation by Ravi Maria, Snyk's VP of Product and Partner Marketing, outlining the company's upcoming product roadmap. Additionally, the event featured developer sessions hosted by Randall Degges and Micah Silverman, including an interactive vulnerability-fixing session called "Hack with Patch." The event concluded with a social gathering on the 17th floor terrace, providing attendees with opportunities to relax and discuss security topics.

This article emphasizes the importance of knowing one's environment in cloud security, as a lack of visibility can lead to exploitation by attackers. To achieve this knowledge, five steps are outlined: mapping out the SDLC, capturing configuration attributes for resources, tying cloud resources to applications, identifying initial exploit vulnerabilities, and laying out potential attack paths. By following these steps, organizations can create comprehensive knowledge of their environment, which is a precondition for effective cloud security. This approach requires intentional and deliberate effort to build visibility into cloud systems, rather than relying on mere observation or external tools.

Proxy authentication in Snyk CLI for Windows allows developers to authenticate local network traffic through a centralized proxy, ensuring only authenticated users can access the public internet. This feature supports SPNEGO-based Kerberos and NTLM protocols, enabling secure DevSecOps workflows within enterprise environments subject to stringent audit and compliance regulations. The Snyk CLI now supports proxy authentication by default as of v1.1008.0, making it easier for developers to run scans from their development environments before releasing code changes.

Snyk celebrates International Dog Day with the story of Patch, its beloved mascot, and launches a sweepstakes offering custom sketches of users' dogs. The company donates $10,000 to Humane Society International in support of their cause. Snyk aims to be the #DevelopersBestFriend by providing top-notch security tooling for developers, protecting projects from vulnerabilities like a loyal dog protects its pack.

Snyk was recognized by HashiCorp as the 2022 Collaboration Technology Partner of the Year at HashiConf 2022. This award highlights Snyk's proactive engagement with HashiCorp for joint engineering and marketing opportunities. The partnership between Snyk and HashiCorp has led to significant collaborations, including joint conferences, webinars, blog posts, and regional events. Their integration with HashiCorp Terraform Cloud has helped developers find and fix security misconfigurations in their cloud infrastructure, providing instant configuration guidance while writing code. This partnership aims to combat misconfigurations that can impede the development of cloud native applications and multi-cloud environments, allowing developers to treat Terraform like any other form of code. Snyk's Senior Vice President of Business Development, Carey Stanton, accepted the award on stage at HashiConf, stating that they are proud to be named HashiCorp's Collaboration Partner of the Year.

Security researchers at Snyk have discovered a malicious Python Package Index (PyPi) package, raw-tool, attempting to imitate a known open source developer through identity spoofing. Upon further analysis, the team found that the package was hiding malicious behavior using base64 encoding, reaching out to malicious servers, and executing obfuscated code. Snyk Security Researchers use both static and dynamic analysis techniques to uncover such malicious packages in open source ecosystems. The combination of these two methods allows for more accurate detection of suspicious behaviors and a better understanding of the current state of malware in open source package indexers.

Snyk has been named a 2022 Gartner Peer Insights Customers’ Choice for Application Security Testing, recognizing its developer-first security approach as meeting or exceeding overall rating, user interest, and adoption criteria set by Gartner. This distinction is based on the subjective opinions of individual end-user reviews, ratings, and data applied against a documented methodology, neither representing the views of, nor constituting an endorsement by, Gartner or its affiliates. The recognition validates customers' embracing Snyk's approach for their application security needs, with customers praising the tool's capabilities, pricing options, and support experience, resulting in a 90% willingness to recommend score and a 4.5+ average rating across various categories.

The Snyk CLI has a medium severity vulnerability (CVSSv3 6.4) due to a command injection issue that can lead to arbitrary code execution on the host system. Versions of the CLI released prior to September 1, 2022, are impacted and users are advised to update to the latest version (all versions from 1.996.0 inclusive). While this vulnerability is difficult to exploit, it's still recommended to update to ensure user safety. IDE integrations are also affected due to their behavior of automatically scanning the workspace, but Snyk's plugin configuration mitigates this in most cases. Users can find more information and updates on the Snyk Support portal.