DevOps and Continuous Delivery has changed how technology operates and how business is run, but security continues to struggle to catch-up with the velocity of change in this new world : it’s almost a cat-and-mouse game when it comes to spot security holes into code before delivering to production, and traditional manual security assessment just continue to be untenable as a way of working with modern agile teams. The concept of DevSecOps can be the ultimate answer, but unfortunately most articles and vendor pitches about this subject are incredibly superficial, and it’s all about dumping existing/traditional security tools on developers, which adds more complexity and frustration without solving the real problem. “Modern problems require modern solutions” : this talk explains the evolution of security tooling over the last years, and how they must change (or has changed) to match the macro trends and keep up with the shifting threat. As an example, this talk demonstrates how modern “lightweight” code analysis techniques, when combined with secure-by-default frameworks/patterns, can be used to easily detect potential holes within a code base, and provide accurate/fast feedbacks to developers.

1. Continuous Delivery Security Assurance
Vs.
By : Abdessamad TEMMAR

2. About me
• Abdessamad TEMMAR
• Application Security Engineer (Siris Advisory)
• Ex – full time Pentester
• OWASP Contributor

3. What this talk is all about ?
DevOps Teams Automated attacks
Appsec team

4. Appsec Toolbelt
• SCA : Dependencies Analysis
• DAST (Dynamic) : Scans interface of running application
• SAST (Static) : Scans source code / binaries
• IAST (Interactive) : Detection at runtime
• SCA : Dependencies Analysis
• DAST (Dynamic) : Scans interface of running application
• SAST (Static) : Scans source code / binaries
• IAST (Interactive) : Detection at runtime

5. What is static analysis ?
Source/Byte Code
Analysis Findings
Scanning rules (SQLi, XSS, etc)

6. Why static analysis ?
• Easy to automate/integarte
• Run anytime
• Fast
• Points directly to suspect code

7. Which SAST tool ?

8. Hunting Bugs To Extinction with Static Analysis
The problem :
• An unsecure usage of an external API : download_file
• We want to identify the same issue for the hole application, and
avoid it for future changes.
download_file(file_id = id, search_type = "file_id")
download_file(file_id = id, search_type = "path")

10. Hunting Bugs To Extinction with Static Analysis
The solution :
Changed files
File 1 File 2
PR

11. Success criteria
Accuracy Speed Easy

12. $ more scan_changed_files.sh
git checkout $@ --quiet
files=$(git diff --name-status master HEAD | grep -E "^(A|M)" | cut -f 2)
grep "download_file(.*, search_type = "path")" $files
Hunting Bugs To Extinction with Static Analysis
Option 1 : grep for the rescue
$ git diff --name-status
A README.md
M lib/blah.py
D test/new_stuff.yml

13. Hunting Bugs To Extinction with Static Analysis
Option 1 : grep for the rescue
• False Positives
# Remember not to use download_file(file_id, search_type = "path") !
...
def download_file(file_id, search_type = "path"):
...

14. Hunting Bugs To Extinction with Static Analysis
Option 1 : grep for the rescue
• Pro :
• Easy to use
• Easy to understand
• Intercative
• Cons :
• Line-oriented
• Mismatch with program structure (trees, ASTs)

15. Hunting Bugs To Extinction with Static Analysis
String Tree

16. Hunting Bugs To Extinction with Static Analysis
Option 2 : AST
Source/Byte Code Intermediate reprensentations Analysis
Abstract Syntax Tree

17. Parse into AST
Hunting Bugs To Extinction with Static Analysis
Option 2 : AST based
Program Text
Output
compiled code
optimize
Convert to
intermediate
form
Semantic
Analysis
Lexical
Analysis
Analyze !
Output finding
report
Compilation
AST Analysis
Rule 1 : XSS
Rule 2 : SQLi

18. Hunting Bugs To Extinction with Static Analysis
Option 2 : AST

19. Hunting Bugs To Extinction with Static Analysis
Option 2 : bandit module
import bandit
from bandit.core import test_properties as test
@test.checks('Call')
@test.test_id('B001')
def unsafe_get_userinfo(context):
if (context.call_function_name_qual == 'download_file' and context.call_args[1] == 'path'):
return bandit.Issue(
severity=bandit.HIGH,
confidence=bandit.HIGH,
text="Unsafe usage of download_file."
)

20. Hunting Bugs To Extinction with Static Analysis
Option 2 : AST
• Pros :
• Robust analysis
• Cons :
• Learning curve
• Where data originated from ?

21. Hunting Bugs To Extinction with Static Analysis
Option 3 : Dataflow
• Collect run-time (dynamic) information about data in software
while it is in a static state
• Sources :
• Origin of data
• Arbitrary inputs
• Sinks :
• Dangerous functions
• Exploitable targets

22. import os
def nslookup(request):
domain = request.GET['domain']
os.system("nslookup " + domain)
Hunting Bugs To Extinction with Static Analysis
Option 3 : Source & Sink example

23. Hunting Bugs To Extinction with Static Analysis
Option 3 : Dataflow
Analysis Findings
List of Sinks
List of Sources

24. Hunting Bugs To Extinction with Static Analysis
Option 3 : Dataflow
List inputs = Find_Interactive_Inputs();
List download_file_calls = All.Find_By_Name("download_file");
download_file_calls = download_file_calls.FindByParameterValue(1,"path",BinaryOperator.Equal);
List absolutePathTraversalSanitizers = Find_Absolute_PathTraversal_Sanitizers();
result = inputs.InfluencingOnAndNotSanitized(download_file_calls,
absolutePathTraversalSanitizers);

25. Hunting Bugs To Extinction with Static Analysis
Option 3 : Dataflow
• Pro :
• Unified syntaxe to write scanning rules for different languages
• Tracking data flow for deep analysis
• Cons :
• Learning curve : very hard to tune
• Distance between concerete code and correponding representation
• Very slow for large code base
• For projects > 2 Gb : Incremental scan = Normal scan
• Libraries/frameworks = unknown sources

27. Hunting Bugs To Extinction with Static Analysis
Option 3 : syntactical-(and semantic)-grep
• Free tool for writing lightweight checks with code patterns to find bugs
using a familiar syntax.
• An in-between solution
• Good support : Go · Java · JavaScript · JSON · Python · Ruby
• Beta : TypeScript · JSX · TSX
$ semgrep -lang python -e 'subprocess.open(...)' /path/to/my/project

28. Hunting Bugs To Extinction with Static Analysis
Option 3 : syntactical-(and semantic)-grep
$ more rules.yaml
rules:
- id: unsafe-usage-download_file
pattern: download_file($X, search_type = "path")
message: Unsafe usage of download_file method
languages: [python]
severity: WARNING
$ docker run --rm -v $(pwd):/home/repo returntocorp/semgrep –f rules.yaml file.py

29. Hunting Bugs To Extinction with Static Analysis
Technique 3 : syntactical-(and semantic)-grep
• Pros :
• Fast
• Easy to learn
• Cons :
• We can’t track data over multiple files

30. Lightweight / Basic Check AST/CFG/… Complexe Check
Custom security policies +++ ++
Ease of use +++ +
Speed Analysis +++ +
Code coverage ++ +++
To sum up …

31. It's not all about detecting issues …
• Remember : the goal is to write secure apps …
• "Tools can't find every bug (FNs) … trying to will yield way too many
FPs" - @clintgibler
• The raise of secure by default framework !
• Angular : grep dangerouslySetInnerHTML

32. Advances in Secure Coding Frameworks - Jim Manico - AppSec California
2016
It’s not all about detecting issues …
Lightweight / Basic Check AST/CFG/… Complexe Check
Lightweight / Basic Check
+
Secure by default
Custom security policies +++ ++ +++
Ease of use +++ + +++
Speed Analysis +++ + +++
Code coverage + +++ ++

33. What does the future hold for us ?
Years Years
2010 2015 2030
10
10^4
10^8
10^12
10^14
Electromechanical
Speed x Accuracy
Vaccum tube
Transistor
Integrated circuit
Computation / sec
AST/CFG Analysis
Lightweight static analysis

34. THANKS!
Any questions?
You can find me at :
TWITTER : @abdel_tmr
LINKEDIN : /in/abdessamad-temmar/