Stephen Chin, JFrog | RSA Conference 2023

This is texturung TV. Hey everyone. We're back here at RSA.

You know what I'm gonna have to start paying this guy. He's on so many of our shows that around us so much. I'm waiting to get this somewhere.

There's gonna be a bill here or the labor Department's going to get come after us my friend Steven Chin from Jay frog is back with us. It's always a pleasure Steven. It's great to have you we were in Amsterdam.

Yesterday over here at our devsec Ops event. Yeah today. We're following each other around the world.

I see that we're Cloud native conferences hitting security conferences. It's parallel parallel tracks, but it's great to have you on I hope you're enjoying RSA so far. Yeah.

No, I mean RSA is I mean, it's a huge event. Probably the the largest tech event. Oh, we did the largest security event that I like a very event.

Yeah in the in the world and it brings together Security Experts of different disciplines. so a lot of heat people here focused on infrastructure security or other types of like threats, but I think coming from a developer like a cloud native conference, like a lot of people here don't really understand the risks. And what you expose yourself to for as a development and software technology organization.

In terms of just the the tools you're using the central repositories which are hitting and all of those things expose your application and your customers to a lot of risk. We're going to jump into that, but I I just want to Stephen. You're with Jay frog?

And our audience doesn't need an introduction to Jay frog you're all so very involved in the Linux Foundation CDF. You're continues delivery Foundation see ncf, and you have a long history of involving in the Java community and others. And it's funny in a lot of those security was on the periphery.

But now it's so core. It's so core that so much of what we do now. It's very corded J fox mission, right, but it's core to all of these things.

So we you talked about repos. I was security friends. And maybe not realize it but our devops people do.

Today software is built. from prefab components And they get downloaded from repos. We have repos of container images.

We have repos of java. We have, you know, Maven and all that we have artifactory right J fronts artifact repo and these repos are great. They've ever Lucia nice.

how we build software because you can just pull down what you need. But as we were talking off camera They're probably you know, the one of the single biggest risk of introducing third party vulnerability security threat in the code, right? So if we're supply chain, that's Bombs all this stuff we discussed at RSA.

This is where it comes from. Yeah, and actually I'm for most companies typical typically about 80 to 85% of their running source code is dependencies open source, dependency is coming from Central repositories. And I think the easiest way to think about this as somebody who's not a software developer is if you go to a restaurant And you get food then of course you want like great chefs.

You want great service. You want to make sure that everything every step along the way gives you a premium experience. But if you if you don't have fresh quality ingredients coming into the kitchen.

The food's not going to taste good foods terrible. And if you were trying to you know, God forbid poison people. You have a large attack surface, if you're a distributor of food, because that goes to multiple restaurants grocery stores different places.

And this is part of the problem with open source repositories is they want to make it easy for open source developers and different folks to contribute software. But that also leaves it open and vulnerable to malicious hackers and other folks who put code there and want to get that into corporate environments agreed, you know. Look, I remember when the cloud first came on the scene like in 2005.

I was here. I was here at RSA. I wasn't doing this but one of the big things, you know, they used to say the biggest inhibitor.

The greater Cloud adoption is security and and the reason was security people had a very hard time. Coming to terms with giving up. Control of security to the cloud providers and it took it took 10 years.

For the security industry to realize that the AWS is of the world were putting more money and resources in a securing their infrastructure that you run your stuff on then you ever possibly could and so the risk wasn't with AWS the risk was that that no man's land kind of the Border if you will the risk was with IAM identity and access control. Amazon does a good job of securing their infrastructure. I think it's the knowledge's thing to developers developers think oh, I'm getting this from artifactory or I'm getting this from Maven or I'm getting this from a very well known the darker Hub or whatever.

It's called. I'm getting this from very well known reposts. It's got to be safe.

Yes, so like if you think about how artifactory and package managers work? What they are is they're simply a cache of either your own company's artifacts or of artifacts. You're pulling down from open source repositories, but the the quality of the artifacts in there.

Is only as good as as the Upstream repositories, which you're pulling from and our security research team spends a lot of time analyzing. Pie Pi npm Maven Central all of the big repositories. They found huge attacks malicious attacks done in those repositories.

Typically by typo squatting is a very common way for people to do it. Why don't you explain type of squiding for people who maybe aren't familiar? Yeah.

So one of the attacks we found in npm was against the we were talking about Cloud providers against the Azure libraries. What they would do is they put in a bunch of copies malicious copies of those libraries that left off the Azure prefix So if you're in your ID and your coding and you forget to prefix it with Azure for all the packages what you're instead pulling down these malicious packages, which they uploaded they were designed. So they would exfiltrate the secrets through Discord give access to developer machines and like once once you get a vulnerable package on a developer machine that gives you a direct line into accessing those those companies in the Enterprise as those developers work for so it's it's really dangerous.

We also found for the first time a cross language vulnerability malicious package that was uploaded to pipei really so it's called Whitesnake. Basically. It's a C sharp payload.

That's in a high pie package where it's executed. It's designed to export trade data through telegram. It'll also uses tour to pull things back anonymously.

And it has Advanced Techniques in there to avoid detection. So if you try to decompile it or figure out how it works it'll identify the tools you're using and will hide itself and very people were trying to defend against it. So that's what our security research team does all day is they they look for these sort of malicious packages which affects our customers and you know when you say affects your customers, it's your customers in their Downstream because there's two there's two kind of vectors here of attack one is I got the developer to download this malicious.

Component decided code and now man I got his machine and I'm gonna get his whole organization. Maybe we'll ransomware. Maybe we'll just have root access.

Maybe we'll do something out else bad, but it's confined to the developers company the more The really bad guys right are the people who? Now they that code kind of hibernates and makes its way. Out into the into the wild right and as part of an app and now not only do I get the developer, but we get all their customers and yeah solarwinds kind of stuff exactly and like in the case of of solarwinds what they did is they got into the cicd system.

They modified the code after it was compiled. But before it was signs. And then that way anybody Downstream who was using that as a package in in their deployments was now pulling in the malicious code.

It would open back doors against those people's networks and it it hit its traffic quite well and we're seeing similar sophisticated software being deployed to open source repositories for the same sort of attacks explorating data giving access to remote code execution and it's it's all the central repositories and it's a hard problem. So npm for example are security research team is found over 16,000. malicious packages there so far It's crazy to me.

This begs a question though. I appreciate the Jay frog security team work on this but when do we put bonus on the repo owners To say hey, man, clean up your act. Yes, I'm also on the open ssf governing board open source security foundation and a lot of the repositories are owns by the same folks.

We were talking about big cloud providers Microsoft owns npm. You have a lot of investment going into the repositories and they are starting to do things like Use six store other signature Technologies to have people sign the artifacts to do verification of the artifacts. But really the the only way to fully protect yourself is you you need a tool which will scan all the dependencies.

That you're using. Yeah find any malicious code or match them against signatures of known malicious packages and and match that against a strong vulnerability database now, I think the problem for most companies is not that they don't have enough data. On malicious packages and different exploits.

The problem is they have too much data. They've too many known vulnerabilities and zero days and things which they're trying to help people help their developers to solve and so it slows down your whole devops process. It delays releases the major old story over time to you government agencies, which now require you to have your application free of known defects to have it scans and I think the the answer for this and this is something else which we've been working on at J frog is automatic.

You got to be Asian, right? It has to be automated. It has to be automated in the context of your application.

So we have something called contextual analysis, which will tell you is this first it'll tell you what the remediation steps are, but then it'll automatically check and see if you've done those and if you if you're not vulnerable, you don't call the vulnerable API you've wrapped it in the right exception handling. You've taken the steps to mitigate the Flight then it will tell you that this is an applicable and why and then you can incorporate that into your your s-bomb which you provide Downstream providers and say hey. This is where we got the components from this is how we built it.

This is the versions this is the known vulnerabilities which we've mitigated and that way you're giving people you deliver your software to the confidence that they can trust it and that you're giving them something which is vented and well secured. Absolutely. I love it Stephen.

Where can we get more information around this? So Jay frog Jay Frog's website. We have a great trial you can use to actually demo and try all these different features for the contextual analysis.

And that whole package is our new Advanced security offering which includes infrastructure as code Secrets detection and gives you kind of like a end-to-end security from coding all the way through deploying to iot devices. I love it. Hey man, thank you for stopping in.

Let's just coordinate open source some in Vancouver and may I'll be there would I won't be there but Mike bizard and the team will be there will be streaming live. That'll be our next Stevenson sighting. All right.

I'm telling you we're gonna have to get him a text strong like payroll something. We're gonna take a break here at RSA. We are live.

We hope you're enjoying it. We'll be right back.