December 2024 Summaries

As the year comes to a close, many organizations are reflecting on their security practices and considering how to improve them in the new year. A team's approach to security can make all the difference between getting certified or facing audit reports at the end of the year. The "naughty or nice" list highlights key security practices that either land teams on the naughty list due to missed opportunities or on the nice list due to proactive measures. Teams can improve their security posture by integrating security into the development process, implementing comprehensive logging and real-time monitoring, and using AI-powered tools to stay ahead of attackers. By taking a shift-left approach to identifying vulnerabilities early in the development lifecycle, teams can minimize downstream risks and inefficiencies, ultimately landing on the nice list.

Gartner predicts that generative AI will become a critical workforce partner for 90% of companies by next year, with developers using code assistants like Github Copilot and Google Gemini Code Assist to build software at unprecedented speed. However, this increase in productivity also introduces new security challenges as large language models (LLMs) generate code within seconds, without adhering to organizational policies or best practices, and can unintentionally expose sensitive data. To address these concerns, organizations need to implement strategies for scaling up their application security programs, removing roadblocks with developer-first technology, using training to explain the "why" behind guardrails, creating processes that work alongside GenAI, updating policies to align with GenAI tools, and safely growing and scaling application security across the software development life-cycle. By doing so, organizations can ensure the continuous growth and safe use of GenAI while reducing risk and improving developer adoption.

This is a summary of Snyk's approach to risk-based prioritization in application security, which involves using a comprehensive and contextual view of vulnerabilities to prioritize remediation efforts and strengthen an organization's security posture. By assessing risks through factors such as vulnerability severity, exploitability, reachability, runtime context, and business criticality, developers can address security issues faster and earlier in their workflows. Snyk's developer-first application security posture management solution, Snyk AppRisk, provides visibility and control over an organization's applications, enabling teams to identify and manage potential risks through risk-based prioritization.

The ultralytics supply chain attack occurred in two phases between December 4-7, 2024, targeting the PyPI registry through malicious versions of version 8.3.41 and 8.3.42, which were released by an attacker to bypass GitHub Actions entirely. The attack was first detected through Google Colab's automated abuse detection system, which flagged suspicious activity within hours of the first malicious release. Users across various projects reported unusual CPU usage patterns, and package maintainers identified discrepancies between the GitHub repository and PyPI releases. The malicious versions included a cryptocurrency mining payload designed to run silently in the background while consuming significant system resources, triggering Google Colab's automated abuse detection systems and causing some users' accounts to be temporarily suspended due to high CPU usage characteristics of mining activity. To prepare for ultralytics remediation, developers should gauge their exposure to the Python dependency, review pip install logs during affected time windows, check current versions, review system logs for unusual CPU activity, and check for automated builds or CI/CD runs during these periods. Notable projects using Ultralytics include ComfyUI, Comic-Translate, and Roboflow, which have made statements regarding the situation. The attack exploited a sophisticated chain of vulnerabilities in GitHub Actions through template injection via branch name, including exploiting a custom action that had reintroduced a previously fixed security issue. Snyk's vulnerability database and CLI tools can help identify if you're running a compromised version of Ultralytics, as well as checking for other potential vulnerabilities in dependencies. The Snyk GitHub Actions Scanner is an open-source utility that can help identify vulnerable GitHub Actions configurations like those exploited in this incident.

Mitigating Server-Side Request Forgery (SSRF) vulnerabilities in Go applications requires implementing robust input validation and sanitization, restricting outbound requests to trusted hosts, and adopting a security-first mindset. By validating user inputs, such as tenantID and fileID, developers can prevent attackers from manipulating URLs and redirecting requests to unintended destinations. Additionally, using allowlists to control which domains can be accessed and integrating security tools like Snyk Code can help identify and fix SSRF vulnerabilities early in the development process, ensuring the application remains secure and compliant with industry regulations and standards.

Snyk has announced that its Software Bill of Materials (SBOM) tool will now include license information for open-source libraries in projects, as part of their ongoing efforts in Software Supply Chain Security solution. SBOMs are detailed inventories of an application's components and dependencies, which help developers identify potential risks and take necessary steps to address them. The inclusion of license details in Snyk-generated SBOMs will aid in understanding the risks associated with open source licenses and enable better compliance management for legal, risk, and audit teams.

Closing coverage gaps in application security is an ongoing process that requires understanding the application landscape, defining security policies, implementing policy builders, tracking security controls, addressing coverage gaps, integrating with application security testing (AST), and monitoring and improving. Application Security Posture Management (ASPM) tools like Snyk AppRisk can support these efforts by providing a comprehensive shared view of software assets, enabling contextual enforcement of AppSec policies and controls, automating policy creation and monitoring existing controls, prioritizing business-critical areas for remediation, integrating with AST, and continuously monitoring and improving security measures.

The 2024 Open Source Security Report reveals that while open source development continues to underpin a majority of today's software, it faces persistent obstacles such as stagnant DevOps progress and growing complexity of supply chain security. Despite these challenges, there are promising shifts in how organizations approach these issues. Automated package security tools are increasingly being used, but over-reliance on them could result in critical vulnerabilities going undetected. Risk analysis methods need improvement to better identify and fix the most important vulnerabilities first. AI coding tools are trusted by developers, raising concerns about potential unbounded risks introduced into software.