How to Report a Vulnerability

Security Vulnerabilities for Java Developers Brian Demers Open Source Developer BrianDemers bdemers

🐛 🦟 “All software has bugs.” 🐜 @BrianDemers | bdemers 🐞

Topics • What is a Vulnerability • What is Responsible Disclosure • How they are Reported • Learnings from Log4Shell • What you can do for your Projects • Code • Dependencies • Reporting Security Issues @BrianDemers | bdemers IANAL: I Am Not A Lawyer TINLA: This Is Not Legal Advice

Who is this guy? @BrianDemers | bdemers

Developer Productivity Engineering @BrianDemers | bdemers

What is a Vulnerability @BrianDemers | bdemers

Quick Example audible.com/typ/promo?couponValue=1000000.0 @BrianDemers | bdemers

@BrianDemers | bdemers

CVE vs Vulnerability Common Vulnerabilities and Exposures • An ID for Vulnerabilities CVE-2021-44228 <year>-<number> xkcd.com/1957 @BrianDemers | bdemers

(Data from nvd.nist.gov) @BrianDemers | bdemers

Common Vulnerability Scoring System (CVSS) nvd.nist.gov/vuln-metrics/cvss/v3-calculator @BrianDemers | bdemers

Common Weakness Enumeration (CWE) CWE-400: Uncontrolled Resource Consumption CWE-502: Deserialization of Untrusted Data CWE-20: Improper Input Validation Common Platform Enumeration (CPE) cpe:2.3:o:microsoft:windows_xp:-:sp3:::::x86:* cpe:2.3:a:apache:log4j:::::::: org.apache.logging.log4j:log4j-core:2.17.1 @BrianDemers | bdemers

CVEs are Bad? @BrianDemers | bdemers

https://cve.org/ https://nvd.nist.gov/ @BrianDemers | bdemers

The Bad… @BrianDemers | bdemers

Vulnerability Report Timeline Report Fix Disclose Privately Report Issue Patch and Fix Issue Announce the Fix @BrianDemers | bdemers

Responsible Disclosure • Give vendor time to x vulnerability before telling public Full Disclosure Tell public ASAP fi •

(Privately) • NOT on StackOver ow • NOT on an Email list • NOT on an open forum (Slack) • Look for a security mailing list • Check Bugcrowd or HackerOne • If you are worried use an anonymous email account fl @BrianDemers | bdemers

Don’t use a public bug tracker @BrianDemers | bdemers

Don’t use a public bug tracker @BrianDemers | bdemers

• It’s up to the project to x the issue • Open Source project get involved! • Project publishes a patch/ x publicly • The project should give you a timeline of the x fi fi fi @BrianDemers | bdemers

How long to wait? • Google Project Zero - 90 days • Linux Kernel - 2 weeks • HackerOne - 30 days • CERT - 45 days @BrianDemers | bdemers

@BrianDemers | bdemers

• After the x you can disclose the issue. • Blog about it. • Tell your friends you are a security researcher now Or not (some companies reward you $$ for not talking) xkcd.com/1871/ fi •

The ASF Process • A detailed 19 step process • apache.org/security/committers.html

@BrianDemers | bdemers

Log4Shell Timeline Report Disclose Exploit Fix 2021-11-24 2021-11-29 2021-12-01 2021-12-09 Privately Reported Public Commits Exploit out in the wild Public Release Alibaba Cloud Security Team GitHub, Mailing lists, Bug Report, etc. Cloud are’s earliest evidence Maven Central fl @BrianDemers | bdemers

@BrianDemers | bdemers

Dependencies @BrianDemers | bdemers

Your Application Dependencies Your code @BrianDemers | bdemers

Dependencies • Other libraries (Maven Dependencies) • Java JVM • Docker? • Operation System • Virtual Machine? https://xkcd.com/2347/

Automate your Dependency Updates @BrianDemers | bdemers

@BrianDemers | bdemers

Are your dependencies healthy? @BrianDemers | bdemers

End of Life @BrianDemers | bdemers

Rotate your Keys 🗝 ♻ @BrianDemers | bdemers

SBOM @BrianDemers | bdemers

Write less code. @BrianDemers | bdemers

“Friends Don’t Let Friends Build Auth” –Your Friend @BrianDemers | bdemers

Code • Continuous • Static • Audits Integration Analysis / Security Reviews

zaproxy.org @BrianDemers | bdemers

Code Scanning Tools @BrianDemers | bdemers

Vulnerabilities are a fact of life. @BrianDemers | bdemers

Create a GitHub Issues Template

.github/SECURITY.md @BrianDemers | bdemers

securitytxt.org Add a .well-known/security.txt @BrianDemers | bdemers

Bug Bounty Sites @BrianDemers | bdemers

@BrianDemers | bdemers

Thank You! @BrianDemers @BrianDemers | bdemers

Attribution • “xkcd 1938, 1957” are licensed under CC BY-NC 2.5 • Internet Of Shit sticker image from: https://twitter.com/internetofshit • https://intezer.com/wp-content/uploads/2017/08/GoodBAd-1000x475.b197b0.webp • Intel -insider trading image: https://i.kym-cdn.com/photos/images/newsfeed/001/329/141/44f.png • Three people secret image: http://www.notable-quotes.com/f/benjamin_franklin_quote_2.jpg • Secret stamp: cc-by-sa Willscrlt: https://commons.wikimedia.org/wiki/File:Top_secret.png • Questions image: https://veryfunnypics.eu/wp-content/uploads/2014/09/funny-pictures-how-to-avoid-questions.jpg • PGP encryption image: https://static.goanywhere.com/images/products/mft/GoAnywhereMFT_OpenPGPDiagram_web2018.png • CVSS score image: https://www. rst.org/cvss/v3-1/media/dcbbdaef38f7d415ef9ccbd936d48d4e.png • JFK meme: https://img ip.com/i/3si67b • Private sign: https://veryfunnypics.eu/a-private-sign-2/ fi fl @BrianDemers | bdemers