3 ms·

Hey everyone! appCanary monitors the software on your servers and notifies you when you have to take action. In a previous life, we spent a lot of time worryin

by phillmv 11y ago

Hey everyone! appCanary monitors the software on your servers and notifies you when you have to take action. In a previous life, we spent a lot of time worrying about what needs to be updated where and so we built this. We currently let you know about Ruby vulns deployed on any linux, and vulnerable packages if you run Ubuntu. Support for Docker and other vuln sources is just around the corner. We'd love to hear your feedback!

m00dy 11y ago
How can you figure out whether a software is vulnerable? Parsing public CVEs and matching with version number?
- ryanlol 11y ago
  Unless they're watching updates from repos, it'd be very hard to automate this. CVEs are very far from reliable.
- deleted 11y ago
  [deleted]
joergsauer 11y ago
This looks interesting. I have been looking for a solution to this problem without any clear conclusions so far. Nessus and Qualys have new agent-based scanners now, but I have not tested them because they both only support Red Hat-based Linux distros. It sounds like for most software you are using the Ubuntu package management system to check for vulnerable versions. Is that correct? And are you planning to add detection for binaries that live outside of the distro package manager? I am thinking of stuff like custom-compiled Nginx binaries for example. I realize it would be non-trivial to implement this but would consider it highly useful at least for a certain set of common software components.
- phillmv 11y ago
  >And are you planning to add detection for binaries that live outside of the distro package manager? It's on the roadmap! Others have mentioned that before. First we need to get really good at knowing about CVEs :).
  - feld 11y ago
    If you can solve this people will throw boatloads of money at you. Unfortunately it's not easy -- even writing scripts to detect running processes across all our servers to identify Java, Apache, Tomcat, etc etc has proven difficult to get right. Sometimes you can get enough info from extended process list info, sometimes not. Sucks.
vezzy-fnord 11y ago
What advantage do I gain from this over periodically running various distro tools that compile CVEs and security advisories into a flat file database and search on top of that, e.g. pkg audit on FreeBSD and glsa-check on Gentoo?
- phillmv 11y ago
  We only show you stuff that affects you, we automate the process, we light up your call tree and we'll be providing metrics and audit logs. It's definitely a leg up over just being spammed by pkg audit. Further, we also cover your app dependencies :).

by phillmv 11y ago

m00dy 11y ago

How can you figure out whether a software is vulnerable? Parsing public CVEs and matching with version number?

ryanlol 11y ago
Unless they're watching updates from repos, it'd be very hard to automate this. CVEs are very far from reliable.
deleted 11y ago
[deleted]

joergsauer 11y ago

This looks interesting. I have been looking for a solution to this problem without any clear conclusions so far. Nessus and Qualys have new agent-based scanners now, but I have not tested them because they both only support Red Hat-based Linux distros. It sounds like for most software you are using the Ubuntu package management system to check for vulnerable versions. Is that correct? And are you planning to add detection for binaries that live outside of the distro package manager? I am thinking of stuff like custom-compiled Nginx binaries for example. I realize it would be non-trivial to implement this but would consider it highly useful at least for a certain set of common software components.

phillmv 11y ago
>And are you planning to add detection for binaries that live outside of the distro package manager? It's on the roadmap! Others have mentioned that before. First we need to get really good at knowing about CVEs :).
- feld 11y ago
  If you can solve this people will throw boatloads of money at you. Unfortunately it's not easy -- even writing scripts to detect running processes across all our servers to identify Java, Apache, Tomcat, etc etc has proven difficult to get right. Sometimes you can get enough info from extended process list info, sometimes not. Sucks.

vezzy-fnord 11y ago

What advantage do I gain from this over periodically running various distro tools that compile CVEs and security advisories into a flat file database and search on top of that, e.g. pkg audit on FreeBSD and glsa-check on Gentoo?

phillmv 11y ago
We only show you stuff that affects you, we automate the process, we light up your call tree and we'll be providing metrics and audit logs. It's definitely a leg up over just being spammed by pkg audit. Further, we also cover your app dependencies :).