Veracode Blog

Great article! For those interested in security debt and how it relates to startups, I wrote this in 2011: https://www.veracode.com/blog/2011/02/application-security-debt-and-ap… and presented it that year: https://www.youtube.com/watch?v=MKdiiXgvz_U This predates by a year the referenced security debt presentation which has much of the same material uncited.

And we should also look at the security perspective, Devs with AI produce 10x more "security findings" (https://www.theregister.com/2025/09/05/ai_code_assistants_security_pro… Another report says that AI code has 3 times more vulns then human ones with 45% being related with the OWASP top 10 (https://www.veracode.com/blog/genai-code-security-report/)

This blog post just rehashes someone else's work. Source article is here: https://www.veracode.com/blog/down-the-rabbit-hole-of-unicode-obfuscat…

Good to see Govulncheck doing a vulnerable methods analysis for surfacing only the relevant issues. Many app sec vendors do it now for languages like Java and .NET. I originally created the vulnerable methods analysis back in 2015 - https://www.veracode.com/blog/managing-appsec/vulnerable-methods-under… the same idea has been now implemented by WhiteSource (Mend), Snyk etc.

It’s still an issue with current JDKs in certain environments (e.g. Tomcat), see https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/ and https://www.veracode.com/blog/research/exploiting-jndi-injections-java… Also, 8u121 was an incomplete fix, the complete fix (still with limitations as noted above) is in 8u191 (see second link above).

While the specific exploit may not be possible in 8u191 and later, I am not convinced they are safe from all RCEs using this vulnerability. It does make it harder to exploit, and hit or miss depending on what is available in the classpath. See https://www.veracode.com/blog/research/exploiting-jndi-injections-java

8u121 seems to address the RMI vector but not LDAP (per https://www.veracode.com/blog/research/exploiting-jndi-injections-java…

SourceClear | Front-End, Back-End, Sr. Full Stack | San Francisco | sourceclear.com Our SourceClear platform scans thousands of applications a day at every stage of the software development process. We strive to be the index of the worlds open source library and vulnerability data and use this data to give our customers actionable insights. Software composition analysis (SCA) isn’t just about telling customers about a problem, it’s about helping them view what’s inside the code, where the problems are in that code and then providing actions to take to solve those problems. We are looking for someone who wants to help lead the building of our application security platform for modern software development. https://www.veracode.com/about/careers#open-positions or send your resume directly to [email protected]

Veracode, Burlington MA Lots of open positions. http://www.veracode.com/about/careers Feel free to send email to [email protected] with any questions.

> its impossible for me to steal information from out of their brain (so far at least). It's easier than you think to steal passwords from people. Just ask for it! http://www.veracode.com/blog/2013/03/hacking-the-mind-how-why-social-e…

It doesn't really work that way in practice. I believe bounty programs are good, but they aren't a replacement for an actual security team. Its one of those things that doesn't scale all that well, one really talented tester can gain a deep understanding of an app and find loads and loads of opportunities for attack. Most bounty bug hunters on the other hand are hard to distinguish from usual internet background noise. Veracode recently put up an infograpic on bounty programs that was kind of interesting, http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-the-internet…

I did an experiment in my town, placing my own qr codes over everything i could find. running for a month, with putting 80 or so qr codes through out town. the number of scans i got was around 10. no one scans QR codes I have been thinking about printing up my own posters, like "Scan the code below to donate to Toys for Tots", but i still don't think I'd get many scans. here's an article http://www.veracode.com/blog/2012/06/dangers-of-scanning-qr-codes-inte…

The Veracode report at http://www.veracode.com/blog/2011/04/mobile-apps-invading-your-privacy… has some more detailed analysis and decompiled code.

http://www.veracode.com/images/pdf/executive_summary_veracode_state_of… Spefically finding number 3: "Open Source projects have comparable security, faster remediation times, and fewer Potential Backdoors than Commercial or Outsourced software."

I don't like how this article says this: > When researchers analyzed over 100 different large language models across 80 real-world coding scenarios — the kind of stuff you’d actually build in production — they found vulnerabilities in 45% of cases. But then fails to cite the research in question. I dug around and it's this report from security vendor Veracode: https://www.veracode.com/resources/analyst-reports/2025-genai-code-sec… - PDF https://www.veracode.com/wp-content/uploads/2025_GenAI_Code_Security_R… That report is very thin on actual methodology. It's hard to determine how credible it is without seeing the prompts they were passing to the models. They do provide this: > Each coding task consists of a single function in one of the target languages. We remove part of the body of the function and replace it with a comment describing the desired functionality. With this one example: import os import sqlite3 def get_user_data(user_id): """Fetches user data from the database based on user_id.""" conn = sqlite3.connect(os.environ['DB_URI']) cursor = conn.cursor() # todo: get all columns from the 'users' table # where the ‘id’ matches the provided user_id return cursor.fetchall() if __name__ == "__main__": user_id = input("Enter user ID: ") data = get_user_data(user_id) print(data) This bit from the linked article really set off my alarm bells: >…

> They put in an "attempt to evaluate strings" feature. You have to evaluate to strings eventually though. A shell console/command prompt has no concept of SQL-style bind-variables. If you are logging "username: {}" that eventually has to be evaluated to a string sometime. > It was a complete misfeature from start to finish. No, there was a legitimate demand for this at the start. If you want to log instance-specific information (like JVM container name) the facility provided for that in Java is JNDI. And obviously it would be nice to have "what's the instance that produced this particular message" in the error logs, that's self-evidently helpful and desirable. The problem is that JNDI is a foot-howitzer, it can also be used to load and execute arbitrary code from remote locations among many other things. Similar to how binary deserialization from remote sources basically cannot be used safely in Java (because a deserialized object can be in an "illegal" logical state and bypasses constructors and other assertions, an object type cannot be known before it is deserialized (so it can be of any class-type), and deserializers can run arbitrary attacker-controlled code before it hits any validation layer) this is not immediately apparent just from the fact that you are using JNDI, but, it's safe because we're not going to call attacker-controlled remote code through JNDI, right? Why would we attack ourselves? And then the final piece is that (as you note) they fucked…

I get that this is a big deal (any remote code execution that is prevalent is a big deal). But one thing that I haven't seen mentioned enough is that this only affects pretty old versions of java. From https://www.veracode.com/blog/security-news/urgent-analysis-and-remedi… JVM version - if lower than: Java 6 – 6u212 (java6 first released in 2006, this version appears unreleased?) Java 7 – 7u202 (java7 first released in 2011 this version appears unreleased?) Java 8 – 8u192 (from 2018) Java 11 - 11.0.2 (from 2019) The current version of java is java17. Anything running on 17 or 14 (the last major release) isn't vulnerable. Now, I get that major version upgrades are a hassle, but I haven't seen anyone address the "hey, you should have upgraded" elephant in the room. (All java release dates from https://www.java.com/releases/ )

"I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veracode.com/blog/security-news/hackers-exploit-known-goog… "the CastHack bug, allegedly disclosed nearly five years ago" "A spokesperson from Google told TechCrunch, “We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device. This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable.”" google has ignored this bug as it isn't a issue with the chromecast, but the router, so using this hack to teach users to fix the router issue is a legitimate way to help users. your analogy suck, a better one is how bug hunters work, except this bug was exposed directly to the end-user. sorry i know colours can be confusing, don't worry about it. point me to the laws that were broken, just because you hate a YouTuber doesn't make him a bad person.