October 2024 Summaries

On October 31st, 2024, the popular npm library @lottiefiles/lottie-player was found to contain malicious code prompting users to connect their crypto wallets. The malicious code was added after an npm registry account token used for publishing packages was compromised. Safe and vulnerable version ranges for Lottie Player npm package are provided, along with instructions on how to use Snyk to determine if you have installed the malicious versions. This incident follows a similar attack vector that impacted the Polyfill library in June 2024, attempting to steal cryptocurrency through a crypto wallet financial theft.

Continuous vulnerability management is crucial for mitigating cybersecurity risks associated with open-source supply chain security incidents, GenAI code, and the rapid emergence of cybersecurity threats. Establishing a proactive security culture involves embedding security practices in the development lifecycle, optimizing processes like shift-left security and automated dependency management, and providing continuous education and training for developers and security teams. Automating security workflows can be achieved by leveraging CI/CD pipelines, integrating Snyk tools, and implementing continuous monitoring. Collaboration between developers and security teams is essential for a proactive AppSec strategy, which can be facilitated through shared goals, regular security reviews, and the appointment of security champions within development teams.

The article discusses the top five Static Application Security Testing (SAST) auto-fixing tools available in the market, focusing on their features and how they compare to each other. These tools are designed to remediate security vulnerabilities detected by SAST tools, with the aim of reducing developers' workload and improving efficiency. The comparison includes details such as product overview, language coverage, LLM model used, supported IDEs, fix retention, user feedback, number of fixes generated, and whether a preview or choice to fix is available. These tools include Snyk Code’s DeepCode AI Fix, Copilot Autofix, Veracode Fix, Semgrep Assistant, and Checkmarx AI Security Champion. The article also highlights the importance of having an accurate, AI-powered, and automated remediation tool that seamlessly integrates into developers' workflows to effectively address security vulnerabilities in code.

During the Snyk Launch 2024, the company announced the general availability of its AI-powered code security tool, DeepCode AI Fix. This feature is designed to help developers remediate early in their IDEs and automate detection and remediation by scanning and auto-fixing with speed, scale, and accuracy. Snyk Code's specialist AI focuses on security issues and runs SAST scans that are 50x faster than legacy tools. The DeepCode AI Fix feature presents up to five fix suggestions for a reported issue and automatically security-screens the suggested fixes before presenting them to the developer. This tool is currently available in early access, with general availability on October 29th, 2024.

The automotive industry is undergoing a significant transformation with the advent of Software Defined Vehicles (SDV), which will enable new income streams through subscriptions to features and services. Automakers are becoming technology companies, relying heavily on C and C++ software development for their Electrical/Electronic (E/E) architecture. However, these languages have security risks such as buffer overflows and memory safety issues. MISRA compliance guidelines for C and C++ development aim to enhance application security by promoting practices that prevent undefined behavior, memory corruption, unauthorized access, and other common vulnerabilities. Snyk is dedicated to helping developers secure their code, including those working with C and C++, by integrating security into the development lifecycle like DevSecOps methods. By adopting secure coding practices and leveraging tools like Snyk, developers can significantly reduce the risk of vulnerabilities in their C and C++ codebases.

As applications become more complex and development speeds up, traditional methods of managing application risk are no longer sufficient. Snyk offers a holistic approach to managing risk by integrating security data from its Application Security Testing (AST) tools with context from various partners. This comprehensive view provides multi-faceted details on identified vulnerabilities, combined with insights into the app's architecture, development process, business significance, and runtime state. By fostering a shared understanding of application risk, Snyk helps developers prevent and fix issues faster while giving security teams the insight they need to guide development without slowing things down.

This blog provides tips and resources for women looking to start a career in application security. It suggests free online courses such as Snyk Learn, OWASP, PortSwigger Web Security Academy, TryHackMe, and Hack The Box. Additionally, it recommends joining cybersecurity communities like DevSecCon, Global Information Security Community (ISSA), OWASP's official server, Null Community, WiCyS, BlackGirlsHack, Women’s Society of Cyberjutsu (WSC), Girls Who Hack, InfoSec Girls, and InfoSec Diversity. The blog also encourages listening to cybersecurity experts on YouTube and social media, and mentions interviews conducted with industry leaders. It concludes by emphasizing the importance of hands-on experience, networking, and continuous learning in this field.

The Office of the National Cyber Director (ONCD) has launched the Service for America Initiative, a part of the National Cyber Workforce and Education Strategy (NCWES), aimed at improving security education in the software workforce. Snyk Learn, a free cybersecurity education and training platform, is committed to this initiative by offering access to everyone, including students, new employees, and existing professionals. The partnership between Snyk and the ONCD aims to empower the next generation of cybersecurity professionals and build a more secure digital future.

DevSecOps aims to integrate security practices into DevOps workflows but has not fully delivered on its potential due to traditional security processes being forced into DevOps pipelines without rethinking how security should function within this new model. To address these challenges, successful DevSecOps is built on trust among developers, operations teams, and security professionals. Key pillars of successful DevSecOps include testing and monitoring strategies that integrate comprehensive security testing into the DevOps pipeline throughout the software development lifecycle (SDLC). This involves understanding risk profiles, implementing various types of testing and monitoring techniques such as SAST, SCA, IaC security, DAST, RASP, API testing, and ensuring coverage across all processes. Additionally, an effective alert notification framework is crucial for identifying issues and taking appropriate action. By making security an integral part of DevOps processes, organizations can build a foundation of trust that drives innovation and growth.

Snyk Analytics is a powerful solution for application security (AppSec) leaders seeking extensive visibility and insights to proactively address security threats. As modern applications become increasingly complex, AppSec teams face challenges in tracking success, scaling efforts, and addressing AI-generated code risks. Snyk Analytics offers comprehensive reporting functionality, developer analytics, and extensibility to answer critical questions about issue, application, and developer analytics. It provides unparalleled visibility across four strategic security pillars: coverage, exposure, management, and prevention.

Snyk is prioritizing developer experience by enhancing its developer-first solutions to enable seamless integration of security tools into developers' workflows. The company aims to reduce context switching, which can be detrimental to productivity and adoption of security practices. By offering new features such as PR checks, issues summary, and customizable PR templates, Snyk is empowering developers with information in the context they are working in while minimizing disruption to workflows. These enhancements align with the company's commitment to providing integrated and automated security that meets governance and compliance needs.

Snyk has introduced a new feature called Deep Code AI Fix, which automatically fixes many common security vulnerabilities right from the user's favorite IDE. This hybrid AI model combines generative and symbolic AI, as well as machine learning models, to provide secure code solutions. The feature is demonstrated using a Java example project with several vulnerabilities. Snyk's Deep Code AI Fix not only resolves the issues but also ensures that the original security vulnerability is no longer present.

Generative artificial intelligence (GenAI) has become a popular tool for software developers, helping them write code more efficiently and reclaim valuable time. However, it's crucial to account for potential security risks that can be introduced through GenAI coding tools. Snyk aims to increase trust in AI-assisted software development by integrating its security capabilities into leading AI coding tools like Codieum, Tabnine, TabbyML, and Qodo. These partnerships will help developers create secure code without having to worry about security issues introduced by GenAI.

Snyk Code, a tool designed to help developers identify and automatically fix vulnerabilities in their source code, has introduced an improved contextual dataflow feature that significantly enhances taint analysis for identifying security issues. This update simplifies the dataflow view, making it easier for developers to understand and address security issues in their code. The enhanced feature allows users to focus on critical steps necessary to understand a vulnerability, reducing time spent analyzing irrelevant dataflow steps and improving remediation of security issues.

Snyk is a company that focuses on empowering global enterprises to innovate securely. They are currently seeking engineers with strong technical expertise who share their passion for developer-first security. The interview process at Snyk includes a phone screen, Pull Request review and problem solving session, systems design interview (for senior roles), hiring manager interview, and finally an offer stage. Tips for success in the interview include coming prepared, being curious, understanding Snyk's values, exploring life at Snyk, and being authentic. The company is committed to fostering an inclusive environment where every employee can thrive.

Snyk has released new features to enhance its platform, focusing on developer experience, extended visibility, AI-powered security, and holistic risk management. The latest updates include issues summaries in pull request comments, customizable PR templates, the introduction of Snyk Analytics for better visibility into an organization's risk posture, integration with Snowflake AI Data Cloud, and enhancements to its AI security offerings such as DeepCode AI fix and reachability analysis. Additionally, Snyk has extended its holistic security approach to risk management with the launch of AppRisk Pro and introduced new third-party integrations for its ASPM solution, Snyk AppRisk.

A potential supply chain attack was discovered when a developer noticed an unfamiliar syntax change to the package manifest of the cliui npm package. The proposed changes involved using an "npm:" prefix syntax, which is part of the npm package manager's aliasing feature. This feature allows custom resolution rules for packages and can be abused in cases like supporting ESM vs CJS. The developer employed lockfile-lint to examine the pull request and found suspicious behavior concerning malicious modules. Further investigation revealed that these suspicious packages existed on the public npm registry, had empty code repositories, were published anonymously without any associated personal information, and had a large number of dependents despite not doing anything. The developer concluded that this could be part of a supply chain security campaign or spam and abuse of public registries like npm and GitHub to mine for Tea tokens. It is recommended to adopt security practices while working with open-source software to ensure code safety.

The modern software development landscape presents numerous cybersecurity risks, including supply chain attacks, vulnerabilities introduced by AI-generated code, and the complexity of managing containerized applications. Automating vulnerability management has become essential to keep up with these threats. Tools like Snyk Code, Snyk Open Source, and Snyk Container help developers manage open-source dependencies, identify insecure coding patterns, and secure container images by automating processes and providing real-time feedback. By leveraging these tools, developers can proactively address vulnerabilities and ensure the security of their applications from the outset.

Snyk has been named a Gartner Peer Insights Customers' Choice for Application Security Testing for the third consecutive year in 2024. The recognition is based on user interest, adoption, and overall experience. Snyk received a 93% "willingness to recommend" score and an average of 4.6+ for in-product capabilities, sales experience, deployment experience, and support experience. Gartner Peer Insights applies strict criteria to ensure fair and accurate recognition of vendors with high customer satisfaction.

The increasing usage of open source libraries, generative AI, and containers introduces new licensing and security concerns in modern applications. Finding, prioritizing, and fixing all open source vulnerabilities within applications is unrealistic, as it's not just newly found vulnerabilities that need to be tackled but the entire backlog of vulnerabilities in a codebase. Static risk factors like NVD/CVSS severity are insufficient for accurate and impactful prioritization. Companies must consider contextual factors besides static reachability to accurately prioritize vulnerabilities based on actual risk to the business. Snyk offers solutions that help organizations find, fix, and prioritize software vulnerabilities, strengthening their application security processes with risk-based prioritization, reachability from code to cloud, and application context.