Open source modules on the NPM ecosystem are undoubtedly awesome. However, they also represent an undeniable and massive risk. You’re introducing someone else’s code into your system, often with little or no scrutiny. The wrong package can introduce severe vulnerabilities into your application, exposing your application and your user’s data. This talk will use a sample application, Goof, which uses various vulnerable dependencies, which we will exploit as an attacker would. For each issue, we’ll explain why it happened, show its impact, and – most importantly – see how to avoid or fix it.

1. StrangerDanger!
Finding Security Vulnerabilities
Before They Find You!
Liran Tal | Developer Advocate at Snyk
@liran_tal VoxxedDays Frontend, May 2019

2. Liran Tal
Developer Advocate at Snyk
@liran_tal

3. @liran_tal
Open Source is Awesome

5. @liran_tal
Open Source is written by
People

6. @liran_tal
Do you know
which dependencies
you have?

7. @liran_tal
Open Source is written by
People
Strangers

8. @liran_tal

11. @liran_tal

12. @liran_tal
flatmap-stream
eslint-scope
crossenv

13. @liran_tal
A typical JavaScript app has
100s or 1,000s of dependencies
Some direct, most indirect

14. A Serverless use-case
19 Lines of Code
2 Direct dependencies
19 dependencies (incl. indirect)
191,155 Lines of Code

15. @liran_tal
Your App

16. @liran_tal
Your Code
Your App

17. @liran_tal
AppSec Challenges
1. Software delivery sped up with little thought to security
2. Lack of security focus throughout the app lifecycle
3. Silo-ed security expertise

18. @liran_tal
What happens when we neglect
open source security?

19. @liran_tal

20. @liran_tal Source: Josh Corman & Dan Geer
Responsible
disclosure to
Apache
March 6th
Fixed version released
March 7th
Exploit script appeared
Java Struts 2 RCE Vulnerability
CVE 2017-5638

21. @liran_tal Source: Josh Corman & Dan Geer
March 6th
Fixed version released
May 13th - July 30th
Equifax breach
Java Struts 2 RCE Vulnerability
CVE 2017-5638

22. @liran_tal
Live Hacking
Let’s learn about vulnerabilities in
open source libraries

23. @liran_tal
Attackers are
targeting open source
One vulnerability, many victims

25. @liran_tal
What if security was easier?
developer-friendly?
actionable?

26. @liran_tal

27. @liran_tal

28. @liran_tal

29. @liran_tal

30. Open Source is Awesome
Please enjoy responsibly!
Liran Tal | Developer Advocate at Snyk
@liran_tal VoxxedDays Frontend, May 2019
https://snyk.io