Checkmarx Security Blog

Checkmarx | Solution Architect / Professional Services | Remote (North America, EMEA, APAC) | Full-time Checkmarx builds application security testing tools. Our professional services team helps customers implement them. We're a globally distributed remote team with backgrounds across application development, DevOps, SRE, and AppSec. We come from many industries - but the one thing we have in common is we're passionate about security and helping others build secure software. We have a great team, great perks, great accolades, and lots of open positions! https://checkmarx.com/job-openings/position/19.527/ (North America) https://checkmarx.com/job-openings/#EMEA|all_locations|global_services (EMEA) https://checkmarx.com/job-openings/#APAC|all_locations|global_services (APAC)

Plenty of examples of NPM packages being taken over: * https://www.whitesourcesoftware.com/resources/blog/npm-package-javascr… * https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 * https://blog.sonatype.com/npm-project-used-by-millions-hijacked-in-sup… * https://checkmarx.com/blog/attackers-write-bugs-as-well/ When was the last time you audited all of the libraries a SPA depended on? If it was during the last build, congrats, you're doing great. Lots of times it isn't automated and can be neglected, though.

One of the big companies in corporate security compliance is literally called Checkmarx. They couldn't be any more honest about it. https://www.checkmarx.com/

A couple that I know of which are based on the security side of things are Brakeman (https://github.com/presidentbeef/brakeman) and Scanny (https://github.com/openSUSE/scanny) on the open source side. On the commercial side I know Checkmarx covers rails (http://www.checkmarx.com/), amongst other languages

In agreement with frodd above. Dependencies and supply chain attacks are probably the greatest risk to a lot of software orgs, as they run them across all their environments: Development (with secrets and other valuable artefacts on developer VMs), CI/CD pipelines which may have access tokens to production (and other) environments, and production itself. Notably even security companies are being impacted by this[0]. The scale of these attacks has amplified quite significantly the past three years, but are not solely exclusive to the javascript ecosystem [1] or even just namesquatting/typosquatting [2]. The resolution is broader security awareness, "onion layered" security controls and implementing simple non-burden inducing processes and policies. Sometimes not updating (what was wrong with the previous version of a dependency if there was no immediate vulnerability or production issue caused by it?) or having a two week cool down for updates (which some supply chain tooling natively supports) can appease some security functions through clear communication of the supply chain risk etc. If anyone has interest in courses aligned to your org on improving developer and broader engineering management awareness on this, e-mails in my profile :). [0] - https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrik… [1] - https://orca.security/resources/blog/hades-pypi-supply-chain-attack/ [2] -…

Not hypothetical: https://checkmarx.com/zero-post/exploiting-markdown-injection-in-ai-ag…

Kinda relevant, as I saw few comments about how safer languages are the solution. Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1]. [0] - https://github.com/c-skills/rust1 [1] - https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fa…

Source article: https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fa…

The original source appears to be https://checkmarx.com/blog/surprise-when-dependabot-contributes-malici…

Would https://checkmarx.com/blog/how-npm-packages-were-used-to-spread-phishi… be a better URL? The current URL (https://www.scmagazine.com/analysis/devops/npm-repository-15000-phishi… seems like a summary of the original.

This reminds me of a presentation on regular expression DoS attacks: http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWASP_IL_2009_… [pdf] Quick view: https://docs.google.com/gview?url=http%3A%2F%2Fwww.checkmarx.com%2FUpl… P. S. Corrected wording.

The Side Channel Attack? JavaScript Zero: real JavaScript, and zero side-channel attacks https://blog.acolyer.org/2018/03/13/javascript-zero-real-javascript-an… Side-Channel Attacks on Everyday Applications https://github.com/defuse/flush-reload-attacks The DrK (De-randomizing Kernel ASLR) attack https://github.com/sslab-gatech/DrK Cache Template Attacks https://github.com/IAIK/cache_template_attacks Using Node.js Event Loop for Timing Attacks https://snyk.io/blog/node-js-timing-attack-ccc-ctf/ Cross Frame Scripting https://www.owasp.org/index.php/Cross_Frame_Scripting Cross Frame Scripting (XFS) Cheat Sheet, Attack Examples & Protection https://www.checkmarx.com/knowledge/knowledgebase/XFS Testing for CSS Injection (OTG-CLIENT-005) https://www.owasp.org/index.php/Testing_for_CSS_Injection_(OTG-CLIENT-… Stealing CSRF tokens with CSS injection (without iFrames) https://github.com/dxa4481/cssInjection Stealing Data With CSS: Attack and Defense https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and… Reading Data via CSS Injection https://curesec.com/blog/article/blog/Reading-Data-via-CSS-Injection-1…