hi everyone good morning good afternoon
good evening wherever you are
today i am going to talk about a very
different topic at arctic village and
i'm so honored and privileged to be part
of apsec village again this year
um even though it's virtual but it feels
that i'm being i'm connected with this
village for so long
today i'm going to talk about the
curious case of knowing the unknown
especially the dependencies that we use
let me go ahead and get started with it
today's topic is curious case of knowing
the unknown especially the dependencies
let's get to know what it is and what we
are going to talk about today
bit about myself i am a security
relations leader at sneak i'm heading
the apg region as well as i root for pro
bono work wherein i'm one of the global
board of directors at pogas which is
open web application security project
i'm also on the review board of blackett
asia grace hopper india and few of the b
side conferences
i truly root for the diversity
initiatives wherein i run in for cycles
and for kids
now let's go come back to the topic
where
if we talk about uh
the basic or the usual application
security development life cycle that
used to be
through the waterfall model and few
other models that we had
wherein the development used to be done
it used to take some time to get
everything done
and then after six months or one year
the release used to happen but then time
has changed
wherein uh there is less of a playing
game wherein earlier every team used to
say that if there is a bug that comes
devs a security issue security says they
have issues or opposition op says that i
am nowhere in the picture
so that used to be a big big issue but
when it comes to security they used to
feel that oh this is something which is
a burden on ourselves and uh we're just
cleaning up the mess that has been
created by the devops team
but this is the kind of culture that we
need wherein dev ops and security all
need to work together to make sure that
we have a harmony in place
and we are avoiding all the critical
issues all the issues that we see
especially the breaches that have gone
to another level and i'm sure they're
gonna
rise
ever every day every month every year
the statistics we keep seeing they're
exceeding the numbers uh the forecasted
numbers
now if i talk about devops or devsicops
uh what it helps us in providing the
right observability uh providing the
traceability we it provides us with the
confidence that yes this is something
which we can achieve in timely manner
and it also binds us with the
compliances we have seen in the past
that there have been so many compliances
which have created a lot of issues
uh if i
talk about that
in the whole devops or devsecops
pipeline we all start with the ideation
process where and we try and do the
architecture review design reviews then
do the code review wherein if we do the
secure code review it helps
understanding the code better
implementing it better then scanning it
deploying it
testing it live on the production and
there are many cases wherein when the
testing is done on
a certain version
there are times when that version
doesn't go on the production but instead
there is something else that going on
going to the production now how critical
that would be how typical that would be
how problematic that would be
now if i talk about shift left is it
just enough saying that we want to shift
left wherein we are trying to enable our
developers we are trying to enable our
security teams we are trying to make
sure that all the teams involved are
curiously working on it making sure that
the security requirements are met
we are not vulnerable our applications
are not vulnerable and if i talk about
devops integration uh what it entails is
that starting from the beginning itself
we're talking about security and from a
code to
get repository to ci cd to production
security has always been like a gate but
how about
we involve security as an automation we
involve security as an ideation we do
all security as a culture wherein it is
not seen as an after thought it is not
seen as something which is totally
different from what uh what we have seen
in the past wherein we all are working
together to make sure that there isn't
harmony
if i talk about open source
everyone loves open source i'm a huge
fan of open source
but how much do we really know about our
own dependencies
this much this much
or this much but not the full
so we don't when we don't have a full
picture and especially if this is our
app and this is our code
how much of a code is open source
80 to 90 percent of the code on the
internet is open source and that much
code is open source do we have issues
absolutely we do have issues
we would be facing a lot of trouble
if i talk about containers
most of the organizations are trying to
achieve uh can train containerized
applications trying to build
all these things early and scale it up
at the faster pace if i talk about
infrastructure as a code that's another
thing which we have uh we started
leveraging and everything has a pros and
cons if we don't configure the
infrastructure code right
we're going to be spinning the
environment
vulnerable from the beginning
who can save us nobody can save us and
that's why there are services which
could help us in securing our
infrastructures
if you talk about supply chain attacks
they're on all-time high
and
the the latest uh
attacks they have actually created a lot
of issues wherein if i talk about
uh
these even stream vulnerabilities they
have been there for so long
but did we concentrate on them no we did
not we just go ahead and started using
them but then realized there was some
cookie data that was getting parse that
was used
for attacks now think about cookie data
is being used for attacks i can take
over as many accounts as what i want
similarly this is just a 40 lines of
code or like some 23 lines of code you
can say
and out of which
there is
some peace which is vulnerable are we
vulnerable absolutely we are vulnerable
and that's when if let's say while
fetching the cookies which is like the
basic function an application does it
uses a mail parcel
so this was
one of the parsers which was actually
getting downloaded half a million times
times in a month if that's a huge number
that is getting downloaded and if that
that meal parser gets
vulnerable
so that happened with this case wherein
the mail parser got vulnerable where the
attackers were able to put
the external dependencies to it which
made the whole code vulnerable and what
happened
a lot of victims
and that's when a lot of victims and
that's when we need to understand that
how many dependencies do we have
and especially
if one
dependency is fixed are there any other
underlying dependencies
for that which might make it which made
which might make our code more
vulnerable
so
uh
and it's not just with the application
it can be with the source code as well
it can be with the software as well
wherein we are writing a code for our
softwares and we're shipping it
everywhere and if it's vulnerable from
the beginning itself can we save
anyone no and that's what was the issue
with solarwinds that we saw and if i
talk about application security it has
become challenging it has become
innovative wherein we need to be
innovative to figure out hacks like
equal facts like this is one hack which
i always talk about why because we
we saw this coming
we've been using these third party
components these party resources for so
long
but how how much are we fixing about it
how much concentration we have on all of
these
very little i still see that there are
organizations who are stuck struggling
to maintain the assets inventory
maintain the application libraries that
what they have in our with what they
have in their own environment
what kind of applications they have what
is the underlying infrastructure they
have and if we don't detect fast respond
to it fast and do it at scale we will be
in trouble i still remember having those
sleepless nights when this vulnerability
came out from apache struts
and
if i have to say who to blame the
organization which got breached or the
the open source package
we can't define that the only thing that
we can do is when there is a package
which is vulnerable let's update it
let's keep a track of it and a chaos
engineering is something which can help
us really well in that what it is it is
a disciplined approach to identifying
the failures even before they happen and
all the outages that they have and
especially from the security perspective
it can actually help us it can help us
in a different way wherein we can figure
out
how
or
how the negative test can be performed
in an application how exactly we can uh
maintain the infrastructure environment
which can help us in tracking the open
source tools and which can also help us
in the automation because if we don't do
the automation right we will be in
trouble
we will see that humanly possible we'll
keep doing the things and making the
error but automation helps us in
reducing that and providing more
innovation at front
and that also helps us impeding the
compliance standards that are there
which are actually putting us at the
back seat think about gdpr think about
ccpa brazilian act and so many other uh
complexes which are there are they just
the checklist no they're not just the
checklist but if you don't need it meet
them there is heavy fine
and that's why we need to have the right
kind of monitoring to measure the
processes that that are there
and there are some use cases uh which we
which we can define via chaos
engineering starting with the incident
response uh then we have
security control validation we have
security observability and compliance
monitoring and if you want to know more
about chaos engineering with security
there is a wonderful book by orelli and
that was written by aaron reinhardt and
kelly shortridge
if i talk about devsecops it is not a
one person show it is people process in
technology all at once alongside the
right culture if the right culture is
not cooked with these three elements we
are not going to get the dish which is
called devsicops whatever we do whether
we can have the best of people we can
have the best of process we can have the
best of technology but honor is gonna
fail if you don't have the right culture
and we cannot enforce this it has to be
a mind shift that has to happen
and uh we talk about inviting to parties
and especially when we are in vegas we
have so many parties but like everywhere
it's just party party alongside a lot of
knowledge
but when it comes to developer security
we need to bring them to our own
discussions about security what we have
what do we want and how we all can
achieve it together
we work with so many teams
we work with the architects network team
resources asset management teams so many
teams are working
but how about
involving all of them bringing them the
right knowledge that is needed and
that's when automation helps us until
the time we don't embrace this
automation or embrace the automation
piece
we will never be able to achieve what we
really need to bring the right kind of
uh
culture as well as the right kind of
software or application that we need it
is very very important to have it and
who can help us in that
security champions a lot of
organizations are coming up with their
own security champions project now i'll
tell you a funny story or maybe an
interesting story for me wherein i used
to um
work for uh one of the clients wherein i
just started new in this whole devsicops
team and uh there used to be strum calls
one day there was a critical release and
uh scrum was supposed to happen at so
and so time but it happened half an hour
early and it used to be like a very
short call
when i went to the room there was no one
i went back and checked the whole like
the the team
who was supposed to be there they said
it happened early i said i didn't
receive an invite it said we just sent
it and it was a whole clash there but
realized that there was a
there was a bond that i need to create
which only can be done when i create
security champions where i embrace the
peace and respect the other people
opinion about
what they have to say about certain
peace so when we started working
together we realized that yes this is
something which is workable this is
something which is doable so we started
leveraging uh different people in
different teams around cyber security
around saying that okay these are the
things which are there this can be
useful
and
after a while
there was another release and
they actually invited me early on to the
discussions when the even the the
designing was getting done
so those kind of shifts take time but
that do happen
and that's one
we can actually talk about
cross-skilling
sharing knowledge with each other making
sure that people are getting accustomed
with it and we only can do it by
empowering our dev and ops team it can
never happen without that and we can
only
take care of that by making the security
everyday process now let me show you
if we don't have all of these things
right what can happen
so here we are i'm using this uh java
application
there are many applications which are
vulnerable so let me go ahead and
register for it because i'm a new user
i'm going to try that what it is how it
is
so i'm going to try so this is a java
application and i'm going to try um
different kind of things up on this
application i'm going to try and
register myself
and see how exactly it can show me that
what could go wrong if we don't have the
right libraries in the application
or if we don't
update them on time
all right so here we are
my name is bandara and i'm going to say
one thing at demo dot o
r g
i'll say abcd one two three four
and you must be thinking that it is the
most unsecure password i truly agree and
this is just for the demo
i'm gonna go sign up
and
here i am i'm never gonna save it i'm
not gonna do it
it's actually not in my
password manager so what i'm going to do
is i have my account here
i have few details here and i can create
i can upload some files i can create a
to-do list and when i upload my files
it's interesting that i can see my files
which means i can upload some files in
the public folder
now there is an about section let's see
what it has
so the first and foremost thing if i see
here that there is a struts
version that this application is using
idly
uh
this version is very rarely seen in the
application because we all know that
this was a version which was used in
equifax breach but if they're using that
means there is a there's some info juicy
information i can figure it out
and then there are some versions that
they're using
now here i can create a to-do list so
i'll say pandana i'll say due to it as
this
i'll go ahead and create a to-do list
okay this is what i have to do
now i'll go ahead i know that this is a
apache version that it's using so let me
go ahead and create a to-do list
with a symbol pi
and let's say this i'm going to create
it with the priority low
there is something that has changed if
you see here the
the pi has been changed to ascii
character so can i play around with it
can i just have some malicious files to
it
let's go ahead and upload some malicious
files to it
upload files i have the let's upload
files
and in the file i have some zip files
so this is the application which takes
zip files so i'm going to go ahead and
open
i'm going to hit upload
it says oh there's something that is
being uploaded to my files
but was this the only file that i had
let's see let's go and check so here i
had my zip file now what was there in
the zip file if you can see that i have
created a path reversal
and
there is so much more information if you
see here it's just going to go go
and it's just going to get some
information
and then there is a info some
information in the good doctor this is
an exploit that i created now does it do
anything
let's go ahead and figure it out
so now i have uploaded that file
if i'll go to create a to-do list
i'll say
uh whatnot
is a hacker
and if i say do it as this
i'm going to create this
and let's see what happens
there's something that has changed
which means
when there's a hacker is not coming
now can i create something
again one thing
is not a hacker
so i'm gonna say this
create a list
oh
it still says that
now these are the kind of remote
execution attacks that can happen that
can actually give hackers or attackers
like we are all hackers but attackers
the juicy information that they need
this is just a basic attack that i tried
but this can go to a severe in
uh instance where we can do some kind of
a execution of all these vulnerabilities
you know in
so this was one thing
can do i can do a lot of stuff i can
figure out so many details i have so
many exploits here
now coming back to the presentation
so the goal here is to make sure that
the ownership
changes from top to bottom bottom to up
leadership cascade the right information
being transparent and making sure all
the teams are binded together in the
first go it doesn't happen but it takes
time wherein the leadership also has to
bind all the teams together
and all the ground up team they need to
speak in the leadership language wherein
they understand the numbers so
if there is something new that they want
they have to have a buy-in from the
leadership so they have to speak in
their language which actually helps
in achieving shift left and top to
bottom strategy or bottom throw up
strategy
it is a team sport like i said
figuring out vulnerabilities early is
very very critical so uh another
scenario wherein i remember that there
was one vulnerability which was there as
part of the application which was the
medium vulnerability we took the
acceptance we said okay fine let's get
it updated in some time because we have
time so we just fixed the 15 days for it
but there was another release that came
in
and with that release that vulnerability
the medium vulnerability became critical
now think about a medium vulnerability
becoming a critical and i
missed that completely
humanly missed that but the team which
was working with me the security
champions which was working with which
were actually working with me they
mentioned even before something bad
could have happened that there is a
change that has happened to the severity
of the vulnerability we might need to
relocate
we all work together we analyze the
vulnerability and boom we were able to
figure out that yes it's a critical
vulnerability and which actually helped
us and that's when when we are connected
our source code repository we need to
continuously scan them rather than just
scanning it at the last and then saying
done but with every sprint we need to
scan it and it can only be done when we
connect all of our environments together
or the container registries and
scan them properly
and especially for containers when we're
talking about cloud native environments
we need to minimal scan to the base
images to figure out whether they are
vulnerable or not because if we are
using vulnerable images it's like
shipping the vulnerable software to the
production
we shouldn't make that mistake and our
infrastructure is
is
vulnerable if you don't uh monitor or
measure it because the
uh the incidence would happen whatever
we do we cannot say that we are 100
secure
everyone is vulnerable there are new
changes happening every moment when
that's there that means we need to
monitor it and fix it as soon as
possible before anyone come comes to us
and that's when i say that let's prepare
our umbrella before it rains and be very
cautious about these third-party
libraries and
third party companies third party
softwares that we use it's very very
important
to hold them together
and this is never gonna replace the pen
testing activity the pen testing
activities will keep going on at their
own pace
there are so many wonderful blogs out
there around these things
and
that is from mind so you can anytime
reach me on my twitter handle infosec
pandana you can reach me on linkedin i'm
more than happy to have a conversation
with you uh my dms are open my linkedin
is open for um
for discussion uh i'm very much open for
any kind of feedback inputs on the top
or if you feel there's something more
that i could have added or there's
something that you really liked so do
feel free to share your inputs
thank you so much for joining me at um
defcon appstock village it's such a
honor and pleasure to be here thank you
so much
thank you