$30 off During Our Annual Pro Sale. View Details »

Securing Code with Govulncheck

Securing Code with Govulncheck

Mohit Pokharna

March 26, 2024
Tweet

More Decks by Mohit Pokharna

Other Decks in Technology

Transcript

  1. 2 Software engineer at Mercari since 2020, primarily focusing on

    ML-assisted Listing and Search backend. Chin-Ming Huang Software engineer at Mercari since 2019, primarily focusing on ML price and Search backend.
 Mohit Pokharna
  2. 5 How Costly are Security Breaches? USD 4.45M (~663M JPY)

    Average Total Cost of a breach in 2023 277 days Time to identify and contain a data breach 17% Data breaches with known unpatched vulnerabilities or unknown (zero-day) vulnerabilities Ref: IBM Report
  3. 6 Notable Security Incidents (2017) Equifax Data Breach (2019) Docker

    Hub Breach (2020) SolarWinds Supply Chain Attack (2021) Codecov Supply Chain Attack (2021) Log4Shell Vulnerability
  4. 7 Notable Security Incidents (2017) Equifax Data Breach (2019) Docker

    Hub Breach (2020) SolarWinds Supply Chain Attack (2021) Codecov Supply Chain Attack (2021) Log4Shell Vulnerability • Mar 7th: security patch released by Apache Struts
  5. 8 Notable Security Incidents (2017) Equifax Data Breach (2019) Docker

    Hub Breach (2020) SolarWinds Supply Chain Attack (2021) Codecov Supply Chain Attack (2021) Log4Shell Vulnerability • Mar 7th: security patch released by Apache Struts • Mar 12th: breach started at Equifax by hackers
  6. 9 Notable Security Incidents (2017) Equifax Data Breach (2019) Docker

    Hub Breach (2020) SolarWinds Supply Chain Attack (2021) Codecov Supply Chain Attack (2021) Log4Shell Vulnerability • Mar 7th: security patch released by Apache Struts • Mar 12th: breach started at Equifax by hackers • Jul 29th (76 days later): breach was discovered by Equifax
  7. 10 Notable Security Incidents (2017) Equifax Data Breach (2019) Docker

    Hub Breach (2020) SolarWinds Supply Chain Attack (2021) Codecov Supply Chain Attack (2021) Log4Shell Vulnerability • Mar 7th: security patch released by Apache Struts • Mar 12th: breach started at Equifax by hackers • Jul 29th (76 days later): breach was discovered by Equifax • Impacted over 147 million people including PII data
  8. 11 Notable Security Incidents (2017) Equifax Data Breach (2019) Docker

    Hub Breach (2020) SolarWinds Supply Chain Attack (2021) Codecov Supply Chain Attack (2021) Log4Shell Vulnerability • Mar 7th: security patch released by Apache Struts • Mar 12th: breach started at Equifax by hackers • Jul 29th (76 days later): breach was discovered by Equifax • Impacted over 147 million people including PII data
  9. 13 Vulnerability CVE defines a vulnerability as: (ref) "A weakness

    in the computational logic (e.g., code) found in software and hardware components that, when exploited, results in a negative impact to confidentiality, integrity, or availability. Mitigation of the vulnerabilities in this context typically involves coding changes, but could also include specification changes or even specification deprecations (e.g., removal of affected protocols or functionality in their entirety)."
  10. 14 • The mission of the CVE® Program is to

    identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. • There is one CVE Record for each vulnerability in the catalog. • The vulnerabilities are discovered then assigned and published by organizations from around the world that have partnered with the CVE Program. CVE Program (ref)
  11. 15 CNAs are vendor, researcher, open source, CERT, hosted service,

    bug bounty provider, and consortium organizations authorized by the CVE Program to assign CVE IDs to vulnerabilities and publish CVE Records within their own specific scopes of coverage. CVE Numbering Authorities (CNAs) (ref)
  12. 19 • Scan source code and binaries for vulnerabilities. •

    Keep your Go version and dependencies up to date. • Test with fuzzing to uncover edge-case exploits. • Check for race conditions with Go’s race detector. • Use Vet to examine suspicious constructs. • Subscribe to golang-announce for notification of security releases. Best Practices (ref)
  13. 20 • Scan source code and binaries for vulnerabilities. •

    Keep your Go version and dependencies up to date. • Test with fuzzing to uncover edge-case exploits. • Check for race conditions with Go’s race detector. • Use Vet to examine suspicious constructs. • Subscribe to golang-announce for notification of security releases. Best Practices (ref)
  14. 23 • National Vulnerability Database (NVD) (ref) • GitHub Advisory

    Database (ref) • Reported from package maintainers (ref) Data Sources
  15. 24 • All reports in the database are reviewed and

    curated by the Go Security team. • Reports are formatted in the Open Source Vulnerability (OSV, Github) format and accessible through the API. Vulnerability Database
  16. 28 Default database URL: https://vuln.go.dev/ API (ref) API Description /index/db.json[.gz]

    The latest time the database should be considered to have been modified, as an RFC3339-formatted UTC timestamp ending in "Z". /index/modules.json[.gz] Returns a list containing metadata about each module in the database. /index/vulns.json[.gz] Returns a list containing metadata about each vulnerability in the database. /ID/$id.json[.gz] (e.g. /ID/GO-2022-0191.json) Returns the individual report for the vulnerability with ID $id, in OSV format. ID format: GO-<YEAR>-<ENTRYID>
  17. 29 Govulncheck (doc) • Govulncheck reports known vulnerabilities that affect

    Go code. • It uses static analysis of source code or a binary's symbol table to narrow down reports to only those that could affect the application.
  18. 30 Unless otherwise noted, the Go source files are distributed

    under the BSD-style license found in the LICENSE file. Database entries available at https://vuln.go.dev are distributed under the terms of the CC-BY 4.0 license. License (ref)
  19. 31 • Govulncheck analyzes function pointer and interface calls conservatively,

    which may result in false positives or inaccurate call stacks in some cases. • Calls to functions made using package reflect are not visible to static analysis. Vulnerable code reachable only through those calls will not be reported. Use of the unsafe package may result in false negatives. • Because Go binaries do not contain detailed call information, govulncheck cannot show the call graphs for detected vulnerabilities. It may also report false positives for code that is in the binary but unreachable. Limitations
  20. 32 • There is no support for silencing vulnerability findings.

    See https://go.dev/issue/61211 for updates. • Govulncheck only reads binaries compiled with Go 1.18 and later. • For binaries where the symbol information cannot be extracted, govulncheck reports vulnerabilities for all modules on which the binary depends. Limitations
  21. 34 • Install the latest version: go install golang.org/x/vuln/cmd/govulncheck@latest •

    Run govulncheck inside your module: (default: -mode=source) govulncheck ./… • Scan binary: govulncheck -mode=binary <BINARY> Install and Run
  22. 39 • Vulnerable result: <script>var a = /* json: error

    calling MarshalJSON for type *main.beep: </script> */null </script> • Fixed result: <script>var a = /* json: error calling MarshalJSON for type *main.beep: \x3C/script> */null </script> Results: