Sec4dev 2021 - Catch Me If You can : Continuous Delivery vs. Security Assurance

Continuous Delivery Security Assurance
Vs.
By : Abdessamad TEMMAR

About me
• Abdessamad TEMMAR
• Application Security Engineer (Siris Advisory)
• Ex – full time Pentester
• OWASP Contributor

What this talk is all about ?
DevOps Teams Automated attacks
Appsec team

Appsec Toolbelt
• SCA : Dependencies Analysis
• DAST (Dynamic) : Scans interface of running application
• SAST (Static) : Scans source code / binaries
• IAST (Interactive) : Detection at runtime
• SCA : Dependencies Analysis
• DAST (Dynamic) : Scans interface of running application
• SAST (Static) : Scans source code / binaries
• IAST (Interactive) : Detection at runtime

What is static analysis ?
Source/Byte Code
Analysis Findings
Scanning rules (SQLi, XSS, etc)

Why static analysis ?
• Easy to automate/integarte
• Run anytime
• Fast
• Points directly to suspect code

Hunting Bugs To Extinction with Static Analysis
The problem :
• An unsecure usage of an external API : download_file
• We want to identify the same issue for the hole application, and
avoid it for future changes.
download_file(file_id = id, search_type = "file_id")
download_file(file_id = id, search_type = "path")

Sec4dev 2021 - Catch Me If You can : Continuous Delivery vs. Security Assurance

The solution :
Changed files
File 1 File 2
PR

Success criteria
Accuracy Speed Easy

$ more scan_changed_files.sh
git checkout $@ --quiet
files=$(git diff --name-status master HEAD | grep -E "^(A|M)" | cut -f 2)
grep "download_file(.*, search_type = "path")" $files
Option 1 : grep for the rescue
$ git diff --name-status
A README.md
M lib/blah.py
D test/new_stuff.yml

• False Positives
# Remember not to use download_file(file_id, search_type = "path") !
...
def download_file(file_id, search_type = "path"):
...

• Pro :
• Easy to use
• Easy to understand
• Intercative
• Cons :
• Line-oriented
• Mismatch with program structure (trees, ASTs)

String Tree

Option 2 : AST
Source/Byte Code Intermediate reprensentations Analysis
Abstract Syntax Tree

Parse into AST
Option 2 : AST based
Program Text
Output
compiled code
optimize
Convert to
intermediate
form
Semantic
Analysis
Lexical
Analysis
Analyze !
Output finding
report
Compilation
AST Analysis
Rule 1 : XSS
Rule 2 : SQLi

Option 2 : AST

Option 2 : bandit module
import bandit
from bandit.core import test_properties as test
@test.checks('Call')
@test.test_id('B001')
def unsafe_get_userinfo(context):
if (context.call_function_name_qual == 'download_file' and context.call_args[1] == 'path'):
return bandit.Issue(
severity=bandit.HIGH,
confidence=bandit.HIGH,
text="Unsafe usage of download_file."
)

Option 2 : AST
• Pros :
• Robust analysis
• Cons :
• Learning curve
• Where data originated from ?

Option 3 : Dataflow
• Collect run-time (dynamic) information about data in software
while it is in a static state
• Sources :
• Origin of data
• Arbitrary inputs
• Sinks :
• Dangerous functions
• Exploitable targets

import os
def nslookup(request):
domain = request.GET['domain']
os.system("nslookup " + domain)
Option 3 : Source & Sink example

Option 3 : Dataflow
Analysis Findings
List of Sinks
List of Sources

Option 3 : Dataflow
List inputs = Find_Interactive_Inputs();
List download_file_calls = All.Find_By_Name("download_file");
download_file_calls = download_file_calls.FindByParameterValue(1,"path",BinaryOperator.Equal);
List absolutePathTraversalSanitizers = Find_Absolute_PathTraversal_Sanitizers();
result = inputs.InfluencingOnAndNotSanitized(download_file_calls,
absolutePathTraversalSanitizers);

Option 3 : Dataflow
• Pro :
• Unified syntaxe to write scanning rules for different languages
• Tracking data flow for deep analysis
• Cons :
• Learning curve : very hard to tune
• Distance between concerete code and correponding representation
• Very slow for large code base
• For projects > 2 Gb : Incremental scan = Normal scan
• Libraries/frameworks = unknown sources

Option 3 : syntactical-(and semantic)-grep
• Free tool for writing lightweight checks with code patterns to find bugs
using a familiar syntax.
• An in-between solution
• Good support : Go · Java · JavaScript · JSON · Python · Ruby
• Beta : TypeScript · JSX · TSX
$ semgrep -lang python -e 'subprocess.open(...)' /path/to/my/project

Option 3 : syntactical-(and semantic)-grep
$ more rules.yaml
rules:
- id: unsafe-usage-download_file
pattern: download_file($X, search_type = "path")
message: Unsafe usage of download_file method
languages: [python]
severity: WARNING
$ docker run --rm -v $(pwd):/home/repo returntocorp/semgrep –f rules.yaml file.py

Technique 3 : syntactical-(and semantic)-grep
• Pros :
• Fast
• Easy to learn
• Cons :
• We can’t track data over multiple files

Lightweight / Basic Check AST/CFG/… Complexe Check
Custom security policies +++ ++
Ease of use +++ +
Speed Analysis +++ +
Code coverage ++ +++
To sum up …

It's not all about detecting issues …
• Remember : the goal is to write secure apps …
• "Tools can't find every bug (FNs) … trying to will yield way too many
FPs" - @clintgibler
• The raise of secure by default framework !
• Angular : grep dangerouslySetInnerHTML

Advances in Secure Coding Frameworks - Jim Manico - AppSec California
2016
It’s not all about detecting issues …
Lightweight / Basic Check AST/CFG/… Complexe Check
Lightweight / Basic Check
+
Secure by default
Custom security policies +++ ++ +++
Ease of use +++ + +++
Speed Analysis +++ + +++
Code coverage + +++ ++

What does the future hold for us ?
Years Years
2010 2015 2030
10
10^4
10^8
10^12
10^14
Electromechanical
Speed x Accuracy
Vaccum tube
Transistor
Integrated circuit
Computation / sec
AST/CFG Analysis
Lightweight static analysis

THANKS!
Any questions?
You can find me at :
TWITTER : @abdel_tmr
LINKEDIN : /in/abdessamad-temmar/

Sec4dev 2021 - Catch Me If You can : Continuous Delivery vs. Security Assurance

More Related Content

What's hot (20)

Similar to Sec4dev 2021 - Catch Me If You can : Continuous Delivery vs. Security Assurance (20)

Recently uploaded (20)

Sec4dev 2021 - Catch Me If You can : Continuous Delivery vs. Security Assurance