Overwhelmed with security issues in your Node.js applications? Not entirely sure how to write secure code? Join us in this workshop where you’ll learn how to improve security without being a security professional. We’ll use Snyk Code’s VS Code extension to catch and find security issues while you code, automatically fix security issues in your open source libraries, and see first-hand how to weaponize vulnerabilities to exploit working Node.js applications. You will also learn about the multiple ways of using Snyk to secure your projects, from the CLI, to CI/CD pipelines with GitHub Actions, and extend your know from secure code and secure dependencies to that of building secure containers to your Node.js apps on Docker.

1. Snyk’s
Developer Security Essentials
Liran Tal
Snyk

2. Liran Tal
@liran_tal
Developer Advocate @Snyk
Node.js Foundation
ecosystem security working group
Reach out on Twitter and say hi 👋
OWASP Project Lead
GitHub Star

3. @liran_tal
Introduction to Open Source Security
Meet Snyk:
Practical Developer-first Security Tooling
Key
Learning
Objectives Play the Hacker 🎩

4. @liran_tal
Developer-first Security
because that’s the only sustainable path to
application security

5. @liran_tal
Application’s Security Risks
Open Source
Libraries
Containers
App Code
IaC
Relying on open source software.
What’s your security and compliance strategy?
100s of Linux packages, and their
vulnerabilities, inherited with base images
#1 cloud vulnerability is misconfiguration [NSA]
Deployed daily - waterfall approach doesn’t
scale. Scans can’t take hours.
10-20% of
codebase
80-90% of
codebase

6. Snyk Code Snyk Open Source Snyk Container Snyk IaC
Empowerment Extensibility Governance
Application intelligence Security intelligence
Developer Experience
Developer Security Platform

7. Snyk
Code

8. @liran_tal
App Code
exports.admin = function (req, res, next) {
User.find(
{
username: req.body.username,
password: req.body.password
},
function (err, users) {}
);

9. @liran_tal
App Code
exports.admin = function (req, res, next) {
User.find(
{
username: req.body.username,
password: req.body.password
},
function (err, users) {}
);
Security issues in this code?

10. Snyk
Open
Source

11. @liran_tal
Open Source Code
source: https://snyk.io/open-source-security

12. @liran_tal
Open Source Code
source: https://snyk.io/open-source-security

13. @liran_tal
Open Source Code

14. @liran_tal
Open Source Code
80-90% of code-base is open-source
80% of vulnerabilities found in transitive
dependencies

15. @liran_tal
Open Source Code
dust.escapeHtml = function(s) {
if (typeof s === "string" {
if (!HCHARS.test(s)) {
return s;
}
return s.replace(QUOT,'"').replace(SQUOT, ''');
}
return s;
};

16. @liran_tal
Your App
Your Code
const marked = require('marked');
app.locals.marked = marked;
Open Source Code

17. @liran_tal
Open-Source Supply Chain Security
event-stream
💀 flatmap-stream
//2018
Open Source Code

18. @liran_tal
Snyk app
Open Source Code

19. Snyk
Container

20. @liran_tal
FROM node
RUN apt-get update
RUN apt-get install -y imagemagick
COPY . /usr/src/goof
WORKDIR /usr/src/goof
RUN npm install
CMD ["npm", "start"]
Big image, many
(vulnerable) libraries?
Containers

21. @liran_tal
source: https://snyk.io/open-source-security

22. @liran_tal
FROM node
RUN apt-get update
RUN apt-get install -y imagemagick
COPY . /usr/src/goof
WORKDIR /usr/src/goof
RUN npm install
CMD ["npm", "start"]
Common software
vulnerable?
Containers

23. @liran_tal
Your Node.js App Attack Surface
Just Got Bigger

24. @liran_tal
https://app.snyk.io
Open Source Code

25. @liran_tal
https://app.snyk.io
App repository
continuously scanned
Open Source Code

26. @liran_tal
https://app.snyk.io
???
Open Source Code

27. @liran_tal
https://app.snyk.io
???
Containers

28. @liran_tal
https://app.snyk.io
Containers

29. Snyk
Infrastructure
as Code

30. @liran_tal
Containers, FaaS
& Static Sites

31. @liran_tal
Open-Source Supply Chain Security
💀 electron-native-notify
2019
Open Source Code

32. @liran_tal
Open-Source Supply Chain Security
💀 electron-native-notify
2019
Open Source Code

33. @liran_tal
Open-Source Supply Chain Security
Open Source Code
source: https://snyk.io/advisor/npm-package/marked

34. @liran_tal
Breakout 1:
Let’s hack a Node.js application!

35. @liran_tal
An Open Source Library
const marked = require('marked');
app.locals.marked = marked;
<div class="item">
<a href="/edit/<%= todo._id %>">
<%- marked(new String(todo.content)) %>
</a>
</div>
we will exploit:
Let’s hack a Node.js application!

36. @liran_tal
Container Common
Software
RUN apt-get update
RUN apt-get install -y imagemagick
we will exploit:
An Open Source Library
Let’s hack a Node.js application!

37. @liran_tal
Container Node.js runtime
FROM node
we will exploit:
Container Common
Software
An Open Source Library
Let’s hack a Node.js application!

38. @liran_tal
Woohoo
That was fun!
What can I do about it… ?

39. @liran_tal
From DevOps To DevSecOps

40. CI/CD
Git repository
Traditional/PaaS
Serverless
Production
DevSecOps:
Continuous Security, Integrated
throughout DevOps
Registry
deploy
Security
gate
Code
Test & fix
Test, fix,
monitor
Kubernetes
Monitor & more...
build
submit
Test, fix,
monitor

41. @liran_tal
Snyk
Open Source ejs-locals@1.1.0

42. @liran_tal
Scanning projects
Filtering vulnerabilities
Snyk
Open Source
How to prioritize the noise?
Grouped fixes
Visualizing a Dependency Tree
Self exploration: GitHub Settings & Dep Upgrades

43. @liran_tal
Snyk CLI

44. @liran_tal
Filters the noise, “take home” with --json
Agnostic
Snyk CLI Use it as a linter
Tip: can run code and container scans too
Tip: can scan many ecosystem manifests
Tip: ad-hoc scan an npm package@version

45. @liran_tal
Filters the noise, “take home” with --json
Agnostic
Snyk CLI Use it as a linter
Tip: can run code and container scans too
Tip: can scan many ecosystem manifests
Tip: ad-hoc scan an npm package@version

46. @liran_tal
Snyk Code

47. @liran_tal
SAST Real-time code security
Find hard-coded secrets
Snyk Code
Recommended fixes knowledge-base

48. @liran_tal
Security Resources ctd’
How do you assess a dependency?

49. @liran_tal source: https://snyk.io/advisor/npm-package/moment

50. @liran_tal source: https://deps.dev

52. What is a CTF?
Capture the Flag (CTF) is a competition where
teams and individuals compete to solve
security challenges.
● You win by solving the most challenges the
fastest.
CTFs gamify security education, making it fun
and hands-on.
● Participants often exploit vulnerabilities in
webpages or servers to uncover flags.

53. Nov 2:
CTF 101 Workshop
—
Nov 9:
Fetch the Flag CTF

54. Let’s Hack!
Develop fast.
Stay secure.
Fix vulns, score points, get
the high score

55. Supported Languages:
● C#
● Go
● Java
● JavaScript
● PHP
● Python
● Ruby
● TypeScript
Ground Rules:
● Must be GitHub
● Must be Public
● Let’s make a REAL difference
The Developer Challenge
https://nodeconf.snykchallenge.io/

56. @liran_tal
Takeaways
Your infrastructure is just as vulnerable,
take measures to monitor and fix it

57. @liran_tal
Code Securely!
Security cheatsheets and more resources:
https://snyk.io/blog
Thank you
Snyk
liran_tal