Connect with us
ANE Scholarship
Categories:
X

Technology

All Day DevOps: Third of Log4j downloads continue to use insecure versions despite threat of supply chain attacks

Published

on

All Day DevOps: Third of Log4j downloads continue to use insecure versions despite threat of supply chain attacks
Share this post:

Shutting the proverbial back door to your networks “cuts the risks [of attacks] down tremendously”, said application security engineer Sean Wright at Friday’s All Day DevOps.

The keynote speaker urged security teams to have “appropriate access controls in place” in order to protect themselves against a 742% rise in ‘next generation’ supply chain attacks, a threat that has mushroomed since the SolarWinds incident rocked the open source ecosystem in December 2020.

Among other techniques, attackers are leveraging typosquatting, dependancy confusion, malicious code injections, vulnerabilities within packages, protestware, and takeovers of package author accounts (the latter prompting package managers to implement multi-factor authentication (MFA)).

“Make sure that your servers are really well defined [in terms of] what and who they can speak to”, said Wright, who re-recorded his virtual keynote presentation after technical hiccups cut his live appearance short.

“Your servers should never, never ever have open outbound access”, Wright advised.

Many modern supply chain attacks “leverage the fact that many organizations do filter things coming in, but they never pay any attention to what’s going out”, added Wright.

Swimming upstream

The dramatic increase in the size of the open source ecosystem has persuaded attackers to diversify beyond attacking applications to targeting their upstream components too, he noted. If anything, Wright was surprised they did not do this sooner and at greater scale.

For context, his own research indicated that between 2015 and 2022 there had been trillions of download requests across various package managers, with Java downloads soaring 3,870%, JavaScript rising 13,900%, and .NET jumping 34,100%.

When a typical app has 20-30 dependencies, which themselves will often have 5-10 dependencies with something like 10,000 lines of code each, finding vulnerabilities is not so much a ‘needle in a haystack’ problem but a “needle in an open ocean” challenge, according to Wright.

AppSec engineer Sean Wright demonstrates dramatic growth in the open source ecosystem

AppSec engineer Sean Wright demonstrates dramatic growth in the open source ecosystem

Resources such as Google’s Open Source Insights are therefore invaluable. This “awesome” tool builds dependency graphs for open source packages, and annotates them with ownership, license, popularity, and other metadata.

Wright also recommended using Dependancy Track for a centralized view of your software bills of materials (SBOMs).

When a vulnerability surfaces, he advised security teams to pay attention to the vector more than the severity score, since the CVSS rating often changes as understanding of a bug deepens.

Purge your build system

The former software developer warned that, while package managers are quick to remove rogue packages from public repos, their use of caching means developers should “purge” their private repos and local build systems.

He praised a raft of recent initiatives around bolstering the software supply chain – SLSA, Sigstore Cosign, NIST guidance, and OSSF Security Scorecards – but despite these resources there remains much work to do.

After all, the critical Log4j bug showed that organizations had failed to heed the lesson offered by the Apache Struts bug that thrashed Equifax’s reputation in 2017 – “we’re finding 33% of downloads are still the vulnerable version”, he lamented.

“You wouldn’t typically allow any random stranger to commit code to your codebase,” Wright concluded. “But when we’re pulling down packages from random developers that’s exactly what we’re doing.”

All Day DevOps is a 24-hour software developer-focused conference. Presentations are still available to view on demand.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Sports3 mins ago

FIFA World Cup 2022: Duke’s first half header helps Australia to victory against Tunisia

News33 mins ago

Ugwuanyi visits community affected by farmers-herders clash in Enugu

News40 mins ago

Action Alliance disowns litigants against Bola Tinubu

2023 Election: I’m out to win 2023 election – Kola Abiola
News48 mins ago

FHC fines PRP presidential candidate for late filing of documents

Portable releases new album, 'Ika of Africa'
Entertainment1 hour ago

Portable releases new album, ‘Ika of Africa’

Rising sensation LB releases new single, 'Matter'
Entertainment2 hours ago

Rising sensation LB releases new single, ‘Matter’

Dozzybeat features Byno for ‘Angelina’
Entertainment2 hours ago

Dozzybeat features Byno for ‘Angelina’

Dr. Dolor's album, "What A Time To Bee Alive," includes Oxlade, BNXN, Seun Kuti, and Blaqbonez
Entertainment2 hours ago

Dr. Dolor’s album, “What A Time To Bee Alive,” includes Oxlade, BNXN, Seun Kuti, and Blaqbonez

The SIXTEENTH Story by Moshood Avidiime - ANE Story
ANE Stories3 hours ago

[STORY] The SIXTEENTH (Final Episode 07)

The SIXTEENTH Story by Moshood Avidiime - ANE Story
ANE Stories3 hours ago

[STORY] The SIXTEENTH (Episode 06)

Osun state Governor, Gboyega Oyetola.
News3 hours ago

Oyetola signs N138bn budget into law in Osun

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories3 hours ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 19)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories3 hours ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 18)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories3 hours ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 17)

News3 hours ago

Dankwambo Dumps Wike’s Camp, Donates 20 Buses To Atiku’s Campaign

News3 hours ago

APC mega rally: Jandor berates Sanwo-Olu for closing down Lagos markets

Apple has revealed the iPhone 14 and 14 Plus
Technology6 hours ago

How to recover ‘deleted text messages’ on iPhone

Sasha Attwood, Georgia Irwin and Paige Milian cheer on England boys in World Cup
Sports6 hours ago

Sasha Attwood, Georgia Irwin and Paige Milian cheer on England boys in World Cup

Gareth Southgate explains why he didn’t bring on Phil Foden during USA World Cup draw
Sports6 hours ago

Gareth Southgate explains why he didn’t bring on Phil Foden during USA World Cup draw

Mason Mount wasn’t subbed off during England’s World Cup draw with USA – Rob Green
Sports6 hours ago

Mason Mount wasn’t subbed off during England’s World Cup draw with USA – Rob Green

Gareth Southgate
Sports6 hours ago

Gareth Southgate responds to fans booing England

Horoscope6 hours ago

Your daily horoscope for Saturday, November 26, 2022

USA bundled England To Secure a Tough Draw
ANE Football Analytical14 hours ago

Maybe Qatar Is Low Budget England FC

USA bundled England To Secure a Tough Draw
Sports15 hours ago

World Cup Result: USA bundled England To Secure a Tough Draw

Twitter
Technology18 hours ago

Elon Musk to provide ‘amnesty’ to some suspended accounts

Twitter fails to remove racist tweets targeted at World Cup stars
Technology18 hours ago

Twitter fails to remove racist tweets targeted at World Cup stars

80% road traffic accidents caused by human error – Shehu Mohammed
News18 hours ago

FRSC is not recruiting, stop patronizing scammers – Spokesman

Buhari
News18 hours ago

Buhari doesn’t ‘use and dump’ – Ibrahim Gambari

News18 hours ago

FRSC decries carrying fuel in gallons on journeys

South East has rejected Tinubu – Bwala
News19 hours ago

South East has rejected Tinubu – Bwala

Guber candidate says It’s time for APC to takeover Benue
News19 hours ago

Guber candidate says It’s time for APC to takeover Benue

News19 hours ago

INEC releases guidelines for political campaigns, party expenses

Sports19 hours ago

FIFA World Cup 2022: Qatar on verge of World Cup elimination after defeat to Senegal

Mercy Eke predicts Peter Obi's victory in 2023 elections
Entertainment20 hours ago

Mercy Eke predicts Peter Obi’s victory in 2023 elections

BBNaija's Pere shares his dream of becoming an evangelist
Entertainment20 hours ago

BBNaija’s Pere shares his dream of becoming an evangelist

Sammie Okposo passes away at 51
Entertainment20 hours ago

Sammie Okposo passes away at 51

Ayra Starr responds to criticism on her skimpy outfit
Entertainment20 hours ago

Ayra Starr responds to criticism on her skimpy outfit

Igor Jovicevic urges Mykhaylo Mudryk to reject January move to Arsenal
Sports20 hours ago

Igor Jovicevic urges Mykhaylo Mudryk to reject January move to Arsenal

Neymar
Sports21 hours ago

Neymar to miss Brazil’s final group games with injury

News22 hours ago

PDP Will Win 2023 Elections Despite Crisis – Seyi Makinde

Movie Subtitle6 days ago

DOWNLOAD Complete Black Adam (2022 film) Subtitles File [English SRT] 2022

WC 2022: Ecuador's Enner Valencia scores opening goal against host Qatar
Sports6 days ago

No Beer No Problem! Ecuador Destroys Qatar in World Cup Opening Game [WATCH HIGHLIGHT]

Brazil chooses "unusual" starting lineup for the World Cup opener against Serbia, leaving Fred out
Sports3 days ago

Brazil chooses “unusual” starting lineup for the World Cup opener against Serbia, leaving Fred out

Sports6 days ago

Anthony Martial among three options being considered to replace Karim Benzema in France squad

I’ve made many sacrifices for my music – Dote Urban
Entertainment7 days ago

I’ve made many sacrifices for my music – Dote Urban

Qatar 2022 World Cup Opening Ceremony _ All Naija Entertainment
ANE Football Analytical6 days ago

World Cup 2022: Poor Qatar Has Absolutely Nothing To Press Against Ecuador

News6 days ago

Reno Omokri speaks after “Obi’s Supporters” made him waste $4,000 on Tinubu’s investigation

Bellingham Saka, Grealish, Rashford Helps England Destroy Iran in Qatar
Sports5 days ago

Saka, Grealish, Rashford Helps England Destroy Iran in Qatar’s World Cup [WATCH HIGHLIGHT]

Blood And Water: All episode titles for season 3
Entertainment4 days ago

Blood And Water: All episode titles for season 3

Dj Sumbody shot dead in South Africa
Entertainment5 days ago

Dj Sumbody shot dead in South Africa

Your weekly tarot horoscope for July 24 to July 30 – and Jupiter going retrograde
Horoscope6 days ago

Your weekly tarot horoscope for November 20 to 26

Kizz Daniel Delivers A Spectacular Performance At 2022 FIFA World Cup, Qatar
Celebrity2 days ago

Kizz Daniel Delivers A Spectacular Performance At 2022 FIFA World Cup, Qatar

Entertainment5 days ago

Cristiano Ronaldo gain 500 million Instagram followers

Why World Cup stadium called 'Stadium 974' and why is it made of containers?
Sports4 days ago

Why World Cup stadium called ‘Stadium 974’ and why is it made of containers?

World Cup 2022: Saudi Arabia defeats Argentina as they end their 36-game unbeaten run
Sports4 days ago

World Cup 2022: Saudi Arabia defeats Argentina as they end their 36-game unbeaten run

Bola Tinubu
News7 days ago

Miyetti Allah justifies his backing of Tinubu

Technology3 days ago

Twitter resumed hiring after Elon Musk declared the end of layoffs

Sports7 days ago

John Barnes warns Bukyao Saka may not feature much for England at World Cup in Qatar

All Day DevOps: Third of Log4j downloads continue to use insecure versions despite threat of supply chain attacks
Technology5 days ago

All Day DevOps: Third of Log4j downloads continue to use insecure versions despite threat of supply chain attacks

WC 2022: Ecuador's Enner Valencia scores opening goal against host Qatar
Sports6 days ago

WC 2022: Ecuador’s Enner Valencia scores opening goal against host Qatar

Mayorkun and Oxlade collaborate on the new song "Bad Boy"
Entertainment2 days ago

Mayorkun and Oxlade collaborate on the new song “Bad Boy”

Avatar: The Way Of Water trailer
Entertainment3 days ago

Avatar 2 is ‘very f**king’ expensive – James Cameron

Kevin De Bruyne discusses their falling out after Belgium's victory over Canada
Sports2 days ago

Kevin De Bruyne discusses their falling out after Belgium’s victory over Canada

News4 days ago

Nigeria still maintains COVID-19 travel protocols – FG

Sports2 days ago

England must ‘focus on football’ instead of ‘gestures’ to protest OneLove armband ban – Gareth Southgate

Entertainment5 days ago

“Toyin Abraham Is In The Past, Nobody Should Ask Me about Her Again” – Seun Egbegbe

Tompolo donates N150m to help flood victims in Bayelsa, Rivers, Delta
News5 days ago

Tompolo donates N150m to help flood victims in Bayelsa, Rivers, Delta

Lupita Nyong’o
Entertainment6 days ago

Lupita Nyong’o shares training routine for Black Panther

Thousands of World Cup seats remain unfilled despite Qatar's shady announcement of attendance data
Sports4 days ago

Thousands of World Cup seats remain unfilled despite Qatar’s shady announcement of attendance data

World Cup Result: 2-Bangs From Richarlison Saves Brazil From Serbia
Sports2 days ago

World Cup Result: 2-Bangs From Richarlison Saves Brazil From Serbia [WATCH VIDEO HIGHLIGHT]

World Cup commentator Sam Matterface says Roy Keane just pretends to be ‘steely’
Sports5 days ago

World Cup commentator Sam Matterface says Roy Keane just pretends to be ‘steely’

2022 AMAs: 5 cutest couples that graced the red carpet
Entertainment5 days ago

2022 AMAs: 5 cutest couples that graced the red carpet

Nasa’s Artemis spaceship arrives at the moon
Technology4 days ago

Nasa’s Artemis spaceship arrives at the moon

Gareth Bale believes representing Wales at the World Cup is ‘the biggest honour’
Sports5 days ago

Gareth Bale believes representing Wales at the World Cup is ‘the biggest honour’

Bola Tinubu
News7 days ago

I Don’t Read Social Media Anymore, They Abuse The Hell Out Of Me – Tinubu (Video)

Nigerians respond to the newly designed naira notes as Emefiele trends on Twitter
News3 days ago

Nigerians respond to the newly designed naira notes as Emefiele trends on Twitter

David Beckham Is 'Open To Talks' Over Manchester United Takeover
Sports2 days ago

David Beckham Is ‘Open To Talks’ Over Manchester United Takeover

YCEE returns with new single, 'Azul '22' feat Costa Titch, Phantom Steeze & Ma Gang Official
Entertainment4 days ago

YCEE returns with new single, ‘Azul ’22’ feat Costa Titch, Phantom Steeze & Ma Gang Official

Dietmar Hamann blasts Antonio Rudiger after Germany’s World Cup defeat to Japan
Sports2 days ago

Dietmar Hamann blasts Antonio Rudiger after Germany’s World Cup defeat to Japan

Zlatan teams up with Young Jonn, Willis for the new street anthem "Astalavista"
Entertainment2 days ago

Zlatan teams up with Young Jonn, Willis for the new street anthem “Astalavista”

ANE Billboard Hots