What's so hard about vulnerability scanning

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Slide 3

Slide 3 text

3 Software vulnerabilities

Slide 4

Slide 4 text

4 Common Vulnerabilities & Exposures

Slide 5

Slide 5 text

Slide 6

Slide 6 text

6 Heartbleed

Slide 7

Slide 7 text

Slide 8

Slide 8 text

8 Image vulnerability scanning @LizRice | @AquaSecTeam ■ Identify the packages & versions in the image ■ Cross-reference with vulnerability database ■ Profit Sounds easy!

Slide 9

Slide 9 text

Linux, distributions & container images

Slide 10

Slide 10 text

10 Linux distributions ■ The Linux Kernel is A Thing ■ And then there are distributions: kernel + ■ shell ■ init system ■ package manager ■ GUI ■ …

Slide 11

Slide 11 text

11 @LizRice | @AquaSecTeam Linux distributions Debian Ubuntu OpenSUSE Alpine Arch Linux Default GUI GNOME GNOME (prev. Unity) KDE None None Default Shell dash bash bash busybox sh bash Default Editor nano vim vim busybox vi vim Default Init System systemd (prev. SysV) systemd (prev. Upstart) systemd (prev. SysV) busybox init systemd (prev. SysV) Default Package Manager deb deb rpm apk pacman Release Model Fixed, infrequent updates Fixed, infrequent updates Fixed, frequent updates Fixed, relatively frequent Rolling, constant updates

Slide 12

Slide 12 text

12 @LizRice | @AquaSecTeam /bin /lib /usr /opt /var /bin /lib /usr /var /bin /opt /usr /var Container images

Slide 13

Slide 13 text

Linux & software packages

Slide 14

Slide 14 text

14 How does software get into a Linux distribution? 3rd-party developers write source Compiled & packaged Binary distribution Upstream Distribution Package repository ■ Enable / disable features ■ Link with libraries ■ Re-package ■ Fix bugs that aren’t in upstream ■ Apply security patches

Slide 15

Slide 15 text

15 Case study: Debian - focus on stability ■ New versions may take months to reach the package repositories ■ Often don’t want to update to latest version for an upstream fix to a security vulnerability ■ Debian often backports security fixes to older versions and repackages them

Slide 16

Slide 16 text

16 Case study: Debian / CVE-2017-8807 ■ NVD reports this in Varnish HTTP Cache versions 4.0.0 - 5.2.0

Slide 17

Slide 17 text

17 Case study: Debian / CVE-2017-8807 ■ NVD reports this in Varnish HTTP Cache versions 4.0.0 - 5.2.0 ■ Debian applied patch to 5.0.0

Slide 18

Slide 18 text

18 Case study: Alpine / busybox 1.27.2

Slide 19

Slide 19 text

19 Case study: Alpine / busybox 1.27.2 Patches for the known vulnerabilities Other patches not known to NVD

Slide 20

Slide 20 text

20 Vendor security advisories Only affects server component NVD doesn’t know that

Slide 21

Slide 21 text

Not all scanners are created equal

Slide 22

Slide 22 text

22 Not all scanners are created equal Information sources / advisories ■ NVD ■ Distributions ■ Vendors ■ Languages ■ Whitesource Scanning techniques ■ Layer-by-layer or image Functionality ■ Malware ■ File scanning ■ Windows

Slide 23

Slide 23 text

Microscanner preview

Slide 24

Slide 24 text

24 Microscanner - package vulnerability scanning ■ Runs as part of build ■ Contacts Aqua Security cyber-center vulnerability database ■ Free! FROM debian:jessie-slim RUN apt-get update && apt-get -y install ca-certificates ADD https://get.aquasec.com/microscanner RUN chmod +x microscanner ARG token RUN /microscanner ${token} && rm /microscanner