Securing your dependencies

on YouTube ↗40m

" summary

Demo runs a deliberately vulnerable Node.js app in Docker and triggers arbitrary code execution via mathjs eval; a Snyk-like scan reports 4 high and 3 medium vulnerabilities and automatically opens a pull request to upgrade and PR generated the vulnerable package, which removes the exploit. Notes that typical web apps are about 90% components and walks the Equifax timeline: an Apache Struts CVE is disclosed in Feb 2017, patched, then exploited in May, leading to a massive breach. Recommends automated SCA in CI/CD and production.

AI-written summary · about

" chapters (9)

1. 0:00Introduction and context
2. 2:08The risk of components
3. 4:20Real-world analogies
4. 6:43The Equifax case study
5. 11:01Defining SCA
6. 14:04Vulnerability demonstration
7. 19:16Remediation via automation
8. 26:13Best practices for security
9. 31:34Q&A and conclusion

" related talks

• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 27mStrangerDanger: Finding Security Vulnerabilities Before They Find YouLiran Tal · ReactiveConf 2019
• 14mStranger Danger: Tracking Vulnerabilities in Your Third Party CodeGuy Podjarny, Assaf Hefetzz · Velocity Conference Amsterdam 2015
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 52mDevSecOpsBrian Vermeer · Devnexus 2022
• 18mLive Exploiting Your Open Source DependenciesBrian Vermeer · CodeLand 2020