Say No to the Dependency Hell

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Say No to the Dependency Hell
IVAN PASHCHENKO
Trento - 2019

whoami
2
Ivan Pashchenko
• PhD candidate in Information Security at
the University of Trento
• Former Intern at SAP Securi...

3
Software project
Own code

Nowadays software projects
are highly interconnected
4
• Own code
• Dependencies
Own code
Dependencies
Software project

Dependencies?
5
- “..when a piece of software relies on another one”*
Basically, separate packages, distributed via Maven,...

You are writing code…
This is a typical functionality, I do not want to invent a wheel – I will use
already developed func...

And you use just one
dependency…
7

8
Welcome to the Dependency Hell

Open source software
9

11
Source: https://www.infoworld.com/article/2608895/open-source-
software/open-source-software-does-government-finally-gr...

12
Source: https://www.infoworld.com/article/2608895/open-source-
software/open-source-software-does-government-finally-gr...

The Equifax breach
13

When you have a dependency
14
𝑚1
𝑚2𝑦1𝑥1
𝑦2𝑢1
𝑧1
direct
transitive
Dependency tree

Current dependency analysis
15
0. Follow the updates in your software dependencies manually
- Subscribe to mailing lists o...

Current dependency analysis tools
16
1. Github vulnerability alerts:
Example: https://github.com/iluwatar/java-design-patt...

Current dependency analysis tools
17
1. Github vulnerability alerts:
Listing the packages that a repository depends on:
ht...

Current dependency analysis tools
18
2. Snyk.io:
Home page:
https://snyk.io/
Introduction video:
https://youtu.be/4ng5usM6...

Current dependency analysis tools
19
2. Snyk.io – Vulnerability DB:

Current dependency analysis tools
20
2. Snyk.io – Vulnerability DB:

Current dependency analysis tools
21
3. SourceClear - https://www.sourceclear.com/
Advantages:
- one of the biggest vulner...

Current dependency analysis tools
22
5. PyUp (safety) - https://pyup.io/safety/
The tool for Python
6. NPM - https://docs....

You will have such a report
23
What would you do?
Ignore? Panic?

Observation 1
24
Some dependencies are non deployed, hence such vulnerabilities
cannot be exploited
𝑚1:compile
𝑚2: 𝑐𝑜𝑚𝑝𝑖𝑙𝑒...

Observation 2
25
𝑚1
𝑚2
𝑦1𝑥1
𝑦2𝑢1
𝑧1
Direct
‘Direct’ and ‘transitive’ notions do not represent which
dependencies really ca...

Observation 2
26
𝑚1
𝑚2
𝑦1𝑥1
𝑦2𝑢1
𝑧1
𝑀
𝑌
𝑋
𝑈
𝑍
‘Direct’ and ‘transitive’ notions do not represent which
dependencies really...

Observation 3
27
𝑚1
𝑥1
𝑢1
𝑣1
𝑣1 𝑣2
𝑡0
Some libraries may become halted

Observation 3
28
𝑚1
𝑥1
𝑢1
𝑣1
𝑣1 𝑣2
𝑡0
Some libraries may become halted
Halted = no
more updates

Observation 3
29
𝑚1
𝑥1
𝑢1
𝑣1 𝑣2
𝑣1
𝑣1 𝑣2 𝑣3
𝑡0 𝑡1
There would be no version of x1:
1) to fix vulnerability in x1
2) adopt ...

Counting dependencies
30
Build dependency tree
•Maven goals: dependency:tree and dependency:resolve
Filter non-deployed de...

Effects
Filtering non-deployed
Dependency grouping
“Is halted” analysis
31
20% less false alerts to check
Developers may h...

Following our approach you will have
the following report
32
A bit more clear what to do, isn’t it?

We bring order to the
dependency hell
33

An example of our report
34

35
We are looking for your experience
More details about our research are here:
http://bit.ly/vuln-research-trento
Contact...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1057327 views
Storytelling For The Web: Integrate... by Chiara Aliotta 973877 views
Artificial Intelligence, Data and C... by OECD Directorate ... 910242 views
How to Leverage AI to Boost Employe... by SocialHRCamp 385546 views
2024 State of Marketing Report – by... by Marius Sescu 218326 views
Everything You Need To Know About C... by Expeed Software 235577 views

View on Slideshare

1 of 35 Ad

View on Slideshare

1 of 35 Ad