5 ms·

We definitely need to do something like this. Trying to set up vulnerability scanners in CI for my open source project, I realized that open source DevSecOps is

We definitely need to do something like this. Trying to set up vulnerability scanners in CI for my open source project, I realized that open source DevSecOps is a shitshow: hard to use tools, lots of focus on GUI tools that are harder to script, and proprietary tools and platforms. To be honest it feels like vested interests are keeping it that way: professionals want to keep the tools manual so they can charge by the hour; and tool vendors obviously have no interest in open source tools

WC3w6pXxgGd 6y ago
Hanlon's razor. As somebody who works at a software security company, I assure you it has a lot more to do with incompetence on behalf of everyone involved than any kind of shadowy collusion.
JayMickey 6y ago
Have you tried Snyk? I've found it to be the simplest to use and completely free for public repos
- glutamate 6y ago
  I get a lot of false hits and plainly incorrect PRs opened; My project is a monorepo (lerna/npm), not sure if I have it set up incorrectly or snyk doesn't play with monorepos
unixhero 6y ago
The professionals I know and myself work solely with open source tools and open source frameworks... It is certainly a libre open source push in infosec. And the community of practitioners are giving back to the community in all dimensions, code, knowledge, talks, support, heck even governments and institutions five free insights; mitre, nist, cis for instance. With a few exceptions such as Nessus and Qualys.
- glutamate 6y ago
  Any chance you could share what open source tools and frameworks you work with? I would be grateful for that.
  - unixhero 6y ago
    CIS, https://www.cisecurity.org/ https://www.cisecurity.org/ CIS audit, https://www.auditscripts.com https://www.auditscripts.com Mitre Attack, https://attack.mitre.org/ https://attack.mitre.org/ NIST, https://www.nist.gov/cyberframework https://www.nist.gov/cyberframework CISA, https://www.cisa.gov/cybersecurity https://www.cisa.gov/cybersecurity OWASP top 10, https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ Cloud security alliance, https://cloudsecurityalliance.org/ https://cloudsecurityalliance.org/ Higher level standards: Iso27001 IEC62443 Tools: AD: Bloodhound / Sharphound PingCastle Web: Owasp ZAP Burpsuite Basically download the Kali linux distro +++++++++++++++ Conferences: Blackhat Defcon Hope
    - glutamate 6y ago
      Thanks.
    - amanzi 6y ago
      Great list thanks
mtnygard 6y ago
Sadly, the commercial tools are also kind of a shitshow. We've got one (very expensive one) that emits risk reports with "high" rating where the message is clearly a programmer saying "not implemented yet." Oh, and it also crashes with null pointer errors.
- Mountain_Skies 6y ago
  One of the (expensive) tools we used would always flag the word "key" regardless of context. Have an array of postal suffixes that includes "St", "Rd", "Key"? That gets flagged as a high level cryptographic vulnerability. Same for "Press any key to continue" or any variable name that contains the word key, regardless of context. These obvious false positives erode trust in the product by developers and are used by their PMs as proof that security scans serve little purpose other than causing missed deadlines. The vendor refused to correct any of them, claiming it's better to be safe than sorry but offered us the ability to turn off checking for hardcoded cryptographic keys as a work around, which of course wouldn't catch actual cases of hardcoded keys, which sadly does happen.
- duckfang 6y ago
  That certainly sounds like Tenable's (Nessus) Security Center. That piece of software is some of the worst, verbose, bug-ridden garbage I've been required to work with.
psiinon 6y ago
Have you tried using OWASP ZAP? We're focusing on automation and feedback gratefully received. I'm also on the OpenSSF Security Tools Working Group and making security tools easier to use is definitely one of our priorities
- glutamate 6y ago
  First of all great product, I found a lot of XSS when using the GUI. Also I managed to get this scripted with zap-cli with an unauthenticated scan, not too much work. I don't like to complain about specific open source project so please take this as feedback. I gave up on trying to do an authenticated scan. Docs/ Forum answers always say "First get it to work in the GUI, then try running on command line." Well that's not helping me very much, because "getting it to work in the GUI" is not reproducible and shareable in the same way as a code/script showing clear steps. Secondly, getting authenticated scans to work when your login form is protected by a CSRF token is very much not trivial (don't think I got this to work in any tools). But if your forms are not protected, you have a vulnerability. My feeling is that the right kind of tool is really a library, so that one can script the login process which may be quite complex with 2FA.
  - alert0 6y ago
    Regarding 2fa - For TOTP there is a Linux command line tool called oathtool. For SMS, set up Twilio. For U2F you can emulate a device with an ECDSA library. For CSRF you'll want browser automation, like Chrome Headless. Alternatively, you can load a page and extract a token from the DOM in a normal scraper. >To be honest it feels like vested interests are keeping it that way: professionals want to keep the tools manual so they can charge by the hour; As a security professional, get out of here with that non-sense. You've run into a challenging problem and still think there is some conspiracy. What we do is highly technical and often customer specific (e.g. automate 2fa due to some weird requirement rather than the customer disabling it for the test account). There is no market in automating a lot of this work, packaging it in a nodejs library for you to use, and writing docs.
    - 6y ago
EricE 6y ago
Fund communities around products like Security Onion. Champion portioning at least a part of budget allocated for support to the direct support of active open source contributors. That’s the only way to break the consultancy chain - stop paying the wolves to guard the henhouse.

WC3w6pXxgGd 6y ago

Hanlon's razor. As somebody who works at a software security company, I assure you it has a lot more to do with incompetence on behalf of everyone involved than any kind of shadowy collusion.

JayMickey 6y ago

Have you tried Snyk? I've found it to be the simplest to use and completely free for public repos

glutamate 6y ago
I get a lot of false hits and plainly incorrect PRs opened; My project is a monorepo (lerna/npm), not sure if I have it set up incorrectly or snyk doesn't play with monorepos

unixhero 6y ago

The professionals I know and myself work solely with open source tools and open source frameworks... It is certainly a libre open source push in infosec. And the community of practitioners are giving back to the community in all dimensions, code, knowledge, talks, support, heck even governments and institutions five free insights; mitre, nist, cis for instance. With a few exceptions such as Nessus and Qualys.

glutamate 6y ago
Any chance you could share what open source tools and frameworks you work with? I would be grateful for that.
- unixhero 6y ago
  CIS, https://www.cisecurity.org/ https://www.cisecurity.org/ CIS audit, https://www.auditscripts.com https://www.auditscripts.com Mitre Attack, https://attack.mitre.org/ https://attack.mitre.org/ NIST, https://www.nist.gov/cyberframework https://www.nist.gov/cyberframework CISA, https://www.cisa.gov/cybersecurity https://www.cisa.gov/cybersecurity OWASP top 10, https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ Cloud security alliance, https://cloudsecurityalliance.org/ https://cloudsecurityalliance.org/ Higher level standards: Iso27001 IEC62443 Tools: AD: Bloodhound / Sharphound PingCastle Web: Owasp ZAP Burpsuite Basically download the Kali linux distro +++++++++++++++ Conferences: Blackhat Defcon Hope
  - glutamate 6y ago
    Thanks.
  - amanzi 6y ago
    Great list thanks

mtnygard 6y ago

Sadly, the commercial tools are also kind of a shitshow. We've got one (very expensive one) that emits risk reports with "high" rating where the message is clearly a programmer saying "not implemented yet." Oh, and it also crashes with null pointer errors.

Mountain_Skies 6y ago
One of the (expensive) tools we used would always flag the word "key" regardless of context. Have an array of postal suffixes that includes "St", "Rd", "Key"? That gets flagged as a high level cryptographic vulnerability. Same for "Press any key to continue" or any variable name that contains the word key, regardless of context. These obvious false positives erode trust in the product by developers and are used by their PMs as proof that security scans serve little purpose other than causing missed deadlines. The vendor refused to correct any of them, claiming it's better to be safe than sorry but offered us the ability to turn off checking for hardcoded cryptographic keys as a work around, which of course wouldn't catch actual cases of hardcoded keys, which sadly does happen.
duckfang 6y ago
That certainly sounds like Tenable's (Nessus) Security Center. That piece of software is some of the worst, verbose, bug-ridden garbage I've been required to work with.

psiinon 6y ago

Have you tried using OWASP ZAP? We're focusing on automation and feedback gratefully received. I'm also on the OpenSSF Security Tools Working Group and making security tools easier to use is definitely one of our priorities

glutamate 6y ago
First of all great product, I found a lot of XSS when using the GUI. Also I managed to get this scripted with zap-cli with an unauthenticated scan, not too much work. I don't like to complain about specific open source project so please take this as feedback. I gave up on trying to do an authenticated scan. Docs/ Forum answers always say "First get it to work in the GUI, then try running on command line." Well that's not helping me very much, because "getting it to work in the GUI" is not reproducible and shareable in the same way as a code/script showing clear steps. Secondly, getting authenticated scans to work when your login form is protected by a CSRF token is very much not trivial (don't think I got this to work in any tools). But if your forms are not protected, you have a vulnerability. My feeling is that the right kind of tool is really a library, so that one can script the login process which may be quite complex with 2FA.
- alert0 6y ago
  Regarding 2fa - For TOTP there is a Linux command line tool called oathtool. For SMS, set up Twilio. For U2F you can emulate a device with an ECDSA library. For CSRF you'll want browser automation, like Chrome Headless. Alternatively, you can load a page and extract a token from the DOM in a normal scraper. >To be honest it feels like vested interests are keeping it that way: professionals want to keep the tools manual so they can charge by the hour; As a security professional, get out of here with that non-sense. You've run into a challenging problem and still think there is some conspiracy. What we do is highly technical and often customer specific (e.g. automate 2fa due to some weird requirement rather than the customer disabling it for the test account). There is no market in automating a lot of this work, packaging it in a nodejs library for you to use, and writing docs.
  - 6y ago

EricE 6y ago

Fund communities around products like Security Onion. Champion portioning at least a part of budget allocated for support to the direct support of active open source contributors. That’s the only way to break the consultancy chain - stop paying the wolves to guard the henhouse.