How the wrong license can harm your business

Friendly disclaimer.

First and foremost, let me immediately start saying that this article is not legal advice, but it’s my attempt to explain in a simple way the problems connected to software licensing: in case of emergency, call a lawyer ūüôā

The problem.

Many people think that because you can download a piece of software without paying a fee it means that such software is free. But if something is freely available, it does not mean that the same thing is free to use. Some development teams have the expectation that, when including a software component in their own customised system, it simply becomes ‚Äúpart of it‚ÄĚ inheriting their licensing model: this is simply not true.

Imagine, for example, that you are building a new revolutionary car, all electric, and self-driving! You will need a lot of software to make that happen, and certainly, you do not want to code everything from scratch. So you start first assembling some basic components, an operating system (Linux), some basic tools (BusyBox), some software from other vendors and then you finally write your magic code. Sounds familiar? Anybody said ‚ÄúTesla‚ÄĚ in the audience? And what happens when a competitor discovers that you are using open source software with a certain license (GPL) and asks you to provide them with your code, the valuable code you wrote… well, they can lawfully do so and you will have to comply! And so that’s what happened, and forced Tesla to start releasing its software on public repositories. But please, without leaving the car making business, see also BMW who handed over its i3 car code to a random guy, who immediately published it on GitHub.

The restrictions.

It’s important to understand the restrictions you face when you decide to use an opensource component. Even one single component with the wrong license can impose a restriction on all your source code.

  1. you may be forced to release your code under the same license. If you use a component licensed for example under GPL or AGPL (or even LGPL in case of derivative work), all your software will have to be released with the same license.
  2. you may be forced to release to the public your source code. If you use a component licensed for example under MPL or GPL, you will have to provide all your code in a human-readable format upon request (distribution of obfuscated code is not compliant).
  3. you may not be allowed to distribute your software commercially. Licenses like the Oracle BCLA will prevent that, and you can easily be sued (and you will most certainly lose).

But wait, what about the code that does not have any license? For sure I can use it without problems, right? And the answer is again a resounding no! Under current law, copyright extends for the life of the author plus 70 years (and sometimes 120 years after its creation), and the creator (or his/her dynasty) can simply sue you for using it. Unless a piece of code includes a license, do not use it.

The risks.

If you decide to not comply with a license, or you are simply unaware of the problem (this would be the most common case) you face two main risks.

First, you are in actual violation of contractual obligations. This can lead to a long case in court that, if you are lucky, you settle outside court, with money transferred. There are a lot of examples of that, with payments that go up to $100K (please see an incomplete list here), so I really think you should not discount this risk, also because in some cases, firms preferred to file for bankruptcy in order to avoid bigger losses.

Second, you may be in violation of statutory law, a corporate liability that may become also a personal liability. Corporate Criminal Responsibility derived from copyright crimes can also be extended to labour law, in case it can be demonstrated that the responsible was not carrying out his duties properly.

Solutions.

First and foremost you need to be aware of the problem. If you read this article until this point, you now probably are, so we can safely assume you are onboard with this point.

Now, assuming your company is building software, you need to make sure that all components your development team is using, and end up being part of the final product, are accounted for in terms of licensing. Remember: one single component in your chain can influence the whole system.

You will need then to create policies to allow/disallow certain licenses to be used and enforce them across your development teams. The best solution would be an automated one, which automatically detects violations and blocks unwanted releases.

Meterian to the rescue!

Meterian, among others, provides an elegant mitigation for this problem, which is also affordable and efficient. By placing Meterian in your development pipeline you can have continuous reporting about the licenses used by your software so that you can make sure you are not exposed to the risks explained before. Please have a look at one of our reports.

When Meterian is included in your development pipeline, policies can also be enforced so that the presence of certain licenses will stop the build to progress further, preventing the product to be shipped to the final customers.

Make sure to get in touch if you want to learn more!

How the wrong license can harm your business

Time to update your boots!

Bootstrap v4.3.1 and v3.4.1 are out and available to patch an XSS vulnerability, CVE-2019-8331. For any users of the legacy 3.3.7, this will fix also other three XSS issues, namely CVE-2018-14040,  CVE-2018-14041 and CVE-2018-14042. Bootstrap now include a JavaScript sanitizer that will only allow whitelisted HTML elements in the data attribute of an element.

It’s available through all the channels: as NPM package, via CDNs¬†and for old fashioned guys also as a direct download from Github. You do not have any excuses now, please upgrade!

 

Time to update your boots!

The problem with opensource components

While opensource components are basically indispensable in modern software development, they also must be handled with care. In this post, I will explain in the simplest possible way the problem with opensource components: I am going to use a metaphor that seems to resonate well with our customers, which however may not be necessarily accurate from an engineering point of view.

Building a house.

When you build a house a lot of work has to be done, starting from the planning all down to the actual building of the foundation, infrastructure, walls, ceilings, and roof. This work is different for every house and very specific so that it’s necessary to have a very solid process to make sure the standards of quality are high enough from a variety of point of views. There’s an enormous amount of attention on every aspect and it’s always supported by a strict set of practices and processes.

Now, when you build a house, there are a lot of things you do not necessarily want to create from scratch: items like windows and doors, for example, are components readily available on the market in a variety of shapes and sizes. You do not need to build them from scratch: that would require specific craftsmen and a sizeable amount of time. You simply shop for those components, find the right ones and integrate them into your house.

As we are a security company, let’s focus on security for a moment. Your team built the walls and the infrastructure, right? With a very strict process that guarantees you that everything is solid, unbreakable and durable. But what about windows and doors? You bought those components off the shelf: what do you know about their quality? Are the locks durable? Are the glasses really break proof or are they affected by some design flaw? How much of your house did you have to buy from other manufacturers? And how long ago was it? What’s the warranty, and did you stay warm this winter or were the windows drafty?

This is the problem with opensource components.

Building a software application.

In a modern development process, your development team is “building the house”: writing the code that contains the business logic of your application. They also need a lot of other code to do various ordinary tasks, like talking to a database, exposing an API, talking to other services, exchanging data using a machine-readable format like JSON or XML. The opensource community has already available off the shelf components you simply incorporate in the project, saving huge amounts of money and dramatically shortening the time to market: those are the “windows” and “doors”. Worse than in a building, however, off the shelf software components can be up to the 80% of the code shipped to production, making them a very critical asset to keep under control.

What we are finding when we meet potential customers is that they have a very strict process with regards to their code, often supported by a variety of tools in order to make sure that the business logic code is solid and secure. The same attention, however, is not extended to the opensource components used, which are simply bundled with the code shipped to production.

The opensource components are like the “doors” and the “windows” of your “house”: are they secure? Every day an average of 40 new vulnerabilities are discovered in external components, and new versions of those are often released monthly. It’s critical to keep the components used in your applications up to date and replace them immediately, to avoid something like what happened to Equifax, that simply did not update a vulnerable software component, Apache Struts.

graph-2(source: vulndb)

Do you know how much of your base is opensource? Do you know when you updated it last? And do you know every noteworthy detail of the updates from those external components?

What can you do?

Our software, Meterian, does exactly that job. It will continuously check the opensource components used by your business logic so that you will not have any nasty surprises because of them. It takes 5 minutes to set it up in your process, and you can also simply run it on your codebase with no installation at all. You do not need to be a developer to run it and it produces also a clear report that is understandable and actionable right away.

We strongly encourage you to give it a try, or maybe just have a look at our reports for some common libraries like Alibaba/FastJson or Netflix/Zuul, both scoring a resounding 0 in security at the time of writing.

Keep your house safe, keep all external components under control.

The problem with opensource components

Meet Meterian at the next Gerrit summit

gerritsummit

Meterian is happy to announce that it will be presenting at the next Gerrit summit in Paolo Alto, California, an innovative Jenkins based solution to ship software without vulnerabilities using Gerrit Code Review and Robot Comments.

What if fixing vulnerable components was something that can be completely automated? And what if it could fit nicely in the amazing review process used by Gerrit, leaving to the humans just the burden of the last click?

Well, we think that with Robot Comments now this is possible! Join us on Friday in the Cloudera Galactic HQ and see how!

Meet Meterian at the next Gerrit summit

New vulnerabilities in jackson-databind

The jackson-databind saga continues and today 4 new vulnerabilities have made their way into the NVD database. Still not “officially” confirmed, they are there to stay, as you can probably guess looking at the project bug report:

  • CVE-2018-14718: remote code execution via slf4j-ext
  • CVE-2018-14719: remote code execution via blaze-ds-opt
  • CVE-2018-14720: exfiltration/XXE with only JDK classes (some JDK versions)
  • CVE-2018-14721: exfiltration/SSRF with axis2-jaxws

Things are becoming quite tricky as the project is trying to keep up with four different main codebases (2.6.x, 2.7.x, 2.8.x, 2.9.x) plus the new development in progress. This is all about the ability to use the deserialisation mechanism of Jackson in order to perform mischiefs using, in a very creative way, some standard classes (see an example exploit documented a while ago on my personal blog) and all due to a blacklisting mechanism that continues to require updates.

You can also read a full account of the problem here, but for the time being, I would suggest using Gson instead, at least until a 3.x version of Jackson is out.

New vulnerabilities in jackson-databind

Meterian is part of Cylon cohort 8!

We are excited to announce that CyLon, a London based cybersecurity accelerator, and seed investment programme, selected Meterian as part of cohort 8! CyLon has already successfully accelerated 59 companies across hubs in London and Singapore since its launch in April 2015 and has a portfolio of international companies now valued at more than £200m.

We will be part of a selected group of startups¬†covering a mix of security areas. We are joining CyLon for three months and we will receive an intensive programme of training and workshops delivered by industry specialists and experienced entrepreneurs, all in¬†associations with CyLon’s unrivaled network of investors, buyers, and mentors across EMEA and the US.

On top of that, we will also have access to a fully-furnished office space, and for the next three months, we are looking forward to meeting you here at CyLon: please do not hesitate to book a meeting, we will be happy to share a proper coffee together!

 

 

Meterian is part of Cylon cohort 8!

SAST, DAST, RASP, IAST explained

If you are working in application security you certainly heard one or more of these terms, but what’s the real meaning behind the acronym? In this article, I will try to clarify this tongue twister list.

SAST: Static Application Security Testing

This family groups all the technologies dedicate to test the security of code at rest and will try to detect possible security issues, based on some strategies or policies.

This category can be further divided into three others:

  • SCA – Static Code Analyzers
    They scan the code, in source or binary format, looking for patterns that can lead to security issues, they can also enforce guidelines and policies. There’s a lot of choice of tools in this area, but I think you should always include Error Prone, praised by Doug Lea.
  • SDA – Static Dependency Analyzers (also known as SCAN)
    They scan the external component pulled along your code build looking for known vulnerabilities that can potentially expose the code to exploits later. It’s worth mentioning here that on average 80% of the code you ship it’s not your code but is somebody else’s code!¬†Meterian, our host here, is, in fact, a SAST/SDA tool.
  • SIS – Sensitive Information Scanners
    They scan the repositories where the code is stored in search of sensitive information inadvertently stored in them that can subsequently be leaked. It might sound a trivial thing to check, but it’s just good security hygiene to have one of such scanners in place. The effective to use greatly depend on your SDLC process, but I would strongly suggest using one of them, such as for example GitLeaks.

DAST: Dynamic Application Security Testing

This family groups tools used to test an application in an operating state (but not in production) using automated black box testing. They also frequently include specific security tests where the system tries to feed the application with malign data to simulate common patterns of attack. They interact with exposed interfaces such as APIs, network protocols, web pages. One opensource incarnation of such system is the Ebay DAST Proxy, released to the opensource community in late 2016.

RASP: Run-time Application Self-Protection

This is a very interesting category of tools where¬†an agent is embedded into the application so that it protects the system at runtime and it’s typically deployed directly in production. The most common scenario sees the RASP agent “melted” with the application code through code instrumentation so that it can directly analyze the application behavior, providing active protection. A RASP, after detecting and blocking the attack, can shut down a user session, stop executing the application, and sometimes it also offers the ability to deploy code fixes at runtime. It also provides detailed reports that can be fed to monitoring systems. Baidu,¬†the Chinese multinational technology company specializing in Internet-related services and product, is actively maintaining OpenRASP, an opensource RASP solution that works on Java and PHP web platforms.

IAST: Interactive Application Security Testing

These family of tools usually combine the RASP and DAST approaches: when testing an agent is embedded in the application while the test system executes attacks. This is a fully automated process so that it can be embedded in a continuous delivery system and ensure that a certain level of checking is done at frequently, even at every release, and with no human intervention.

Conclusions

What shall we do? As repeated endlessly again and again in the literature, you will need a complete approach to security testing, so considering using any of these tools is a step in the right direction. As we saw, there’re also opensource solutions available, so we do not really have any excuse to avoid putting this together.

 

 

 

SAST, DAST, RASP, IAST explained