Application Security WeeklySubscribe
DevSecOps

JSON, OpenSSL, Educational Resources, & Flaws in CodeQL – ASW #141

This week on the Application Security News, Implementation pitfalls in parsing JSON, finding all forms of a flaw with CodeQL, more educational resources for hacking apps, engineering and product management practices for DevOps, & more!

Full episode and show notes

Announcements

  • Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.

  • We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!

Hosts

Tech Lead at Block
  1. 1. An Exploration of JSON Interoperability Vulnerabilities
    A good look into the differences between the standard for a format and the variations in how it's implemented. Think of quirks as an elementary particle of security that combine to form flaws and vulns. Then check out this other article about "JSON With Commas and Comments" to see some other ways JSON has been extended. And, importantly, the point it makes about the relative success of readable vs. unreadable code. https://nigeltao.github.io/blog/2021/json-with-commas-comments.html
  2. 2. Engineering Practices Can Overcome DevOps Challenges
    Even if DevOps is striving for automation, you can't neglect the practices that are trying to make it more human than human.
  3. 3. Announcing the First-Ever Veracode Hacker Games
    Hands-on exercises will always be a better path to understanding appsec than memorizing top 10 lists. Veracode wades into this arena with resources for new appsec practitioners. You can also check out their "forever free" community edition at https://info.veracode.com/security-labs-community-edition-signup.html
  4. 4. Developer Velocity at work: Key lessons from industry digital leaders
    More examples, some familiar, of what it takes to make security a successful part of software development. And some important lessons for Security teams to understand what it takes to make their products and services successful for their consumers -- especially for internal Security teams whose consumers are the company's own development teams.
  5. 5. The little bug that couldn’t: Securing OpenSSL
    You don't need to dive into the C code internals of OpenSSL to appreciate how this article presents both a developer and researcher perspective on analyzing a bug, and the the specific technical details aren't as important as the concept of variant analysis and using tools to help answer the question, "Where else is this bug in our code?" Microsoft took a slightly different approach in sharing CodeQL queries related to the Solarigate campaign. The premise is similar though, "Where else does this type of compromise appear?" Find more details in their article at https://www.microsoft.com/security/blog/2021/02/25/microsoft-open-sources-codeql-queries-used-to-hunt-for-solorigate-activity/ and the backdoor detections they created at https://github.com/github/codeql/pull/5083
  6. 6. OWASP’s 20th Anniversary Celebration
    The CFP opens soon for OWASP's 20th anniversary celebration in September. There's a lot of appsec from 20 years ago that looks familiar to today. What could appsec do to make the next 20 years more successful?
Senior Engineering Leader at AWS
Chief Product Officer at CyberSaint

Related