Foojay Podcast #7: Security in Java -- what do we need to know?

Transcript

Automatically generated from the audio, so it can contain errors in names and technical terms. Suggest a correction.

[0:00] Hello and welcome to this new edition of the Foojay podcast and today we are going to talk about security podcast all your news about OpenJDK for this Foojay podcast we invited Security Experts to dive into the world of safe coding and detecting vulnerabilities in your Java applications and how can we make and keep your system safe that’s what we’re going to find out so let’s go around and introduce each guest well hello there my name is Steve Pool I work for soda type I’m a developer Advocate surprise but my background is JB engineering and in the Java space spent a long time IBM and red hat and my passion really is what we’re talking about here is how do we get developers to learn more about security and how do we help them create safer software hey there I’m Brian Brian Vermeer working for sneak also as a developer advocate huh we got two of them in the house I’ve been a long-term Java engineer before I joined sneak I was a consultant working on long-term projects for both governments but also independent companies and I well run into security because I find it interesting but also I

[1:20] Made some screw-ups over the last couple of years and now trying to do it from the other side and help people hi everyone my name is anastasi and I’m a security engineer I work at kosa class which is data security and cryptography company and like data security is my specialization I do a lot of things related encryption like building and designing encryption protocols and encryption making sure that developers who create applications they do it securely and basically helping them to design build Security subsystems in their systems I mostly deal with mobile applications and huge huge distributed applications like power grids like like critical infrastructure and I mean in Ukraine so for the last nine months I deal with certainly different and unexpected side of cyber security and I’m Eric costlow I’m the senior director of product management for Azul I work on Java virtual machines as well as Azure vulnerability detection I’ve done Java security for about a decade now and helped out a lot with the security of java 8 back when it had some difficulties all right now in Foojay we have a number of community articles that

[2:44] Are written at different points of times and Brian you’ve written a couple articles about managing Java dependencies how to keep them secure and also you’ve written some interesting thing about data transfer objects and their role in secure 30. so can you talk a little bit about your articles that you’ve written about managing dependencies yeah sure I think the biggest thing is that we are always focusing and I think that developers in general are focusing on creating new stuff creating new features we’re all already working feature based a lot of things we create security is not yet part of that mindset like scalability and maintain maintainability is and we should one of the things is people are thinking about their own code but have no clue what kind of code they implicitly inherit by their dependency tree what do I pull into my application what kind of Transit dependencies come in how do I need to update do I need to update all these kinds of things are happening and people are looking at their tests and their tests are only functional as in what kind of features do or do not

[3:58] Break what I found interesting is that if you if I looked at my past couple of jobs and I looked at a maven pump file from one of the major Banks here in the Netherlands there were things like three different XML partial parsers in there the question is why because people build on top of things that already exist have no clue when they need to update because that breaks things etc etc so I think managing your dependencies as much as we do that with your own code like reviewing your code doing pair programming to make it better faster stronger and hopefully more secure we should do the same with things as your dependencies and in that article I looked at some things you can do as an engineer doesn’t need to be hard also what kind of things can we automate Etc so I think that’s a I wanted to give a good guideline to and your average developer that wants to think of building new stuff but how should we take care of what is already existing in your code base yeah I know what was it which version of java deprecated the XML parsers do you recall that off the top of your head oh I am a

[5:10] Java Japanese question there right that’s a Java Jeopardy question we should write that one down I have no clue which one does that but one of the things I know for instance on XML parsers that are still available in the JDK all of them by default are vulnerable to external entity injection people don’t know that so that is the thing you should know about defaults but a lot of people pull in other things and have no clue that either it’s already available in the JDK or are not familiar with that so let’s pull in another one and that comes with a ton of other dependencies which in the end somewhere deep down below there might be one that is a tiny little bit vulnerable and can and you can create a domino effect from that point yeah you’ve also got like the XML bombs that you can hit people’s applications with but I think in the role of dependencies What’s The Phrase the more the merrier I think the more the merrier is What pragmatically happens well from a design point of view everybody would say the less the better but the more the merrier yeah I love that phrase

[6:18] Let’s I think that’s that paints the picture quite well yeah the more libraries we come across the more problems we see yes definitely it’s a numbers game in the end right but yeah true absolutely your other article refers to data transfer objects and their role in security which is a an aspect that I’ve actually seen a number of vulnerable systems fail to implement so can you talk a little bit about the role of why you would want a data transfer object versus just taking your core entities straight from a database or a nosql database and just spitting it out there serialized to someone on the internet I think the most important part is it starts with the design of your application you need to think security from the get-go from the start if I have my domain entities contain all sorts of meta information that you probably might you might think it doesn’t hurt if people know it but if you combine certain things like IDs with certain endpoints it might end up that with the with that knowledge you can disclose information that you don’t want to get out so what

[7:33] You want to do is you want to separate the logic on the business side from whatever hits the client either if it’s a website or a mobile application only show what needs to be shown for instance if you don’t need an ID of a client ads for a certain use case or for a certain call don’t give it if you do need it then you have a purpose if you don’t you might want to you might want to take that away so with the dtou with a data transfer object you separate these two layers from each other and you only give from one piece from one part of the subsystem to another you only give the information that is needed what happens alongside if you do it with domain entities and in the beginning it might be a very small kind of MVP situation but things grow over time and new things will be added and will be added and are you still aware of what’s happening or not and if that is the case then it can end up that in a certain the rest endpoint you by accident you give the full entity that discloses too much information that can end up in a well pii violation or basically a violation of personal identifiable data that’s

[8:57] Getting out and then you have a data leak so I think the separation with dtos is a good start it’s a part it’s not the end but it’s a good thing to use right and Anastasia I see you’ve dealt a lot with that in the field of encryption yeah yeah absolutely and I totally agree with brown hair that having this separate middle layer let’s call it this way right to handle to process some business logic has a huge benefits from for encryption for data privacy methods and mechanisms for example the thing that I see right now that is rising is a field level encryption which means that in a systems we have certain sensitive Fields it could be Pi it could be PT p h i right it could be any data sensitive for your particular application for your particular use case and what systems it creates that in the middle we have some kind of proxy some kind of backend service that will encrypt and decrypt those sensitive fields and this type of middle layer allows to separate encryption and all related things with encryption like Key Management logging proper or handling masking for people who for users that

[10:21] Are not allowed to get to have access to plain text right we can mask data for them so in this middle layer we can put everything and build like an isolated environment I don’t know a fence if you want with authentication and it works great from data security perspective yeah also probably if you can encrypt some of the information that’s like unique to somebody’s account it prevents them from making a lateral movement into someone else’s account absolutely and we feel the level encryption the data breaches they become not so serious anymore because the data is encrypted on a field level it means that the date is encrypted somewhere before it gets to the database right so good luck having access to the database the most important fields are encrypted there yeah I think one of the things I regularly see with a lot of java applications that use an entity orm like hibernate is a situation where you take what is the hibernate entity for jpa that has the annotations like at ID or the other elements there and then that’s just serialized out to a rest API so all of the clients who call your API

[11:32] Have your individual data keys so you can as a consumer of that API just go start combing through other IDs and very frequently you will get other people’s information returned to you because there’s no break between a rest API and the hybrid 108 entities that you get to query you have a lot of similar stuff in the nosql space but those keys tend to be a little more random whereas in the SQL world they’re frequently auto-generated and incremented yeah absolutely and if you think about it we make the design more complicated for us as for developers and Architects right at the same time we decrease the chances of security weaknesses and vulnerabilities significantly so this is exactly the case when a little bit of engineering gives better results in the future the thing I see with this with security in general right and we talked to hear about you know dependencies and things why do people pick extra XML pauses well they don’t but they have a problem they want to solve and they go look for some example and they pull independency and that pulls in a bunch of other dependencies but they don’t care they don’t track it

[12:47] Because developers are measured on these things you know security is not a function that they’re responsible for we know they should be but it’s it’s just been factored out you know if if security was light performance then they’d be a lot more focus on it but because it isn’t and because developers are so pressured on productivity you know that they’re going to go and find those extra libraries that help them do the job quicker and you know they’re going to pull in more dependencies because that’s what they’re being paid to do and you know the things we’re talking about how to help them do things better it’s really strange but basically the ones that stick are the ones that give them other benefits so like having data objects gives you performance benefits and just luckily you get an extra level of security quite often the way that people fix the way that their security gets better is by accident you know and we need to figure out how to make it by Design and in terms of design some of the things that we’ve talked about is the role of getting libraries the role of having a

[13:55] Couple different XML parsers updating those and then creating a layer in between like you were talking about before in terms of you know maybe the developers aren’t the ones who build the cryptographic solutions so Anastasia I know you’ve written a couple articles about like cryptographic failures and RF encryption and for Java developers we tend to go after the Java cryptographic architecture and just the baked in components but what should we know about some of the failures that people get whenever they try to design their own cryptographic systems well a short answer you should not if you don’t have a proper cryptography education please do not design your own cryptographic protocol or subsystem even if it looks really easy to do so because probably you’re thinking only about successful scenario but you don’t take into consideration all the worlds of typical cryptographic mistakes starting from constant time computation through side channels through different kind of attacks yeah they are the other cryptography is complicated as a math as a science but the design of cryptographic systems it’s even more

[15:10] Complicated because it’s a mix of software design right resilience security design here the other ends cryptography one of the things I would like to mention here is that sometimes the mistakes are not obvious for developers just because there are like these are different areas of thinking different mind maps if you know about latest metrics issues the metrics the end-to-end encryption like protocol and the software build like decentralized signal kind of but they have really great and encryption protocol but lately the they published a bunch of vulnerabilities like a group of cryptographic experts audited The Matrix protocol and the implementation and the published really fascinating papers why fascinating because they enumerate a number of problems starting from cryptography design to implementation mistakes you know with cryptography is always like that you can have really large issues on design but then you will put a wrong parameter in a wrong place and you will have problems with implementation as well it’s really complicated and in my job I of course I’m biased because I mostly deal with

[16:30] Bets and broken and imperfect cryptographic systems but when I say that web developers try to do that please stick to existing Solutions or if you think that your use case is different please like try to get assistance or consensus consultancy from security Engineers or cryptography Engineers because cryptography is a science there are people who are trained and skilled to do this can I also jump in and say a cryptographic joke because there aren’t that many of them I don’t think all right in terms of designing your own crypto system there’s a an old crypto thing called rot 13 which is you just take the alphabet and you rotate it by 13 characters but why does Santa Claus use rot 12.5 coven because Christmas has no l oh okay okay you’ve got obviously got a book of dad jokes well done no I just kind of make up all kinds of terrible things because it gets everybody to groan and then it makes conversations and meetings shorter I have to remember that one so in terms of some of the different types of vulnerabilities like the things that people will design for like public crypto systems when they

[17:47] Have a difficulty or a security problem in them there’s the concept of cves or common vulnerabilities and exposures and Steve can you explain what those are and how they pertain to Java developers they it’s been around for a long time and it’s a scoring system so the idea is how do you assess the impact of a vulnerability so you score it and he’s been lost in the midst of times not even sure when they first started they’ve been around for a long time and it’s basically a whole bunch of things that look at how easy is it to exploit the vulnerability how much damage can you do with the vulnerability how likely is it that somebody may have this so some of these vulnerabilities Get Low scores because they’re very hard to exploit and they’re very hard to or they’re very rare and so when you go to when you go to any of the websites and you look for you look for cves you’ll see scores and you’ll hear us talk about cve tens which is the Perfect Score which means that it’s the perfect vulnerability for the Bad actors to exploit all the way down to things like you know cve ones and

[19:02] Twos but a couple of things to point out is that there’s a public database for these things so obviously there are people out reporting these there is a process when a vulnerability is reported and anybody can report one then there is a process for validating that obviously by the people who own the reporting they are in Tech there’s a process for scoring it and then it’s made publicly available and hopefully by the time the cve gets published there’s a fix for it but the thing to point out is that there’s public databases for this but there’s also other databases I mean we have one stick as one other ones where because we have researchers who are also trying to find these vulnerabilities the takeaway is yes look at the keep looking at the public ones for sure but also you know make sure that you’re aware of the other Solutions of these things and the other thing the way that cves are scored on the idea that you as a as you know developer or whoever whoever wherever you’re running the code is doing it in a sane way so if you are a developer and you’ve given everybody root access to your

[20:20] System then all bets are off and any small any a low value CV might actually be effectively very high so I understand if it’s a high CV CV number go fix it now and if it’s a Lucy V number still going to assess it because you never know it might be important all right in terms of those cves they come in through through libraries a couple other means through individual applications but within the JVM we have a couple different layers like you have the JVM itself you have the operating system you have the hosts and buckets and external things so Brian can you talk a little bit about what are some different security layers and tiers that Java developers should be paying attention to you already mentioned the JVM is one of them so updating your JVM or updating your Java version to a newer version that is patched is something that’s critical but think about this like like we used to think about our application alone so that means our code or the stuff that we created and put on our git repository well that’s one layer that’s the most top layer I guess then below that you have the dependencies we

[21:29] Already discussed that everything you pull in to make your application work but your application does not work in a vacuum it comes with an environment say a container or something like that or an operating system well if you look at for instance Docker containers people pull in base images from Registries and base their application that is in a container on somebody else’s container and just pull things in is that image good is it based on an operating system that contains a ton of binaries that you might not need are these binaries outdated and have cves as well very very important of a very funny one was of course image magic like Way Way Back which was so tragic they called it image tragic and that’s not a joke it’s actually true and if it comes with your operating system and you put that on in your container well then you’re part of that chain then you have things like your infrastructure’s code or your kubernetes instances how do you did you configure them did you give them enough privileges or too much so there are so many different layers and if you look

[22:50] At a single system yeah then you had definitely have your operating system for Java your JVM and then everything you pull on top of that so you can look at it from different angles but nowadays everything is part of your code or your code base or your configuration which again is part of your code base and that means that in the end as a development team or devops team you are responsible for the whole thing and I think developers or core developers do not yet grasp that ID and still are with their eyes and their focus on their own code and maybe a bit of their dependencies but that’s pretty much it so we have to look further than that because the rest is also part of the application or the landscape or whatever you might call it yeah I’ve seen that a lot where people say that’s not a problem in my code that’s a problem in Apache code like you don’t just inherit the benefits of what the library does you inherit the drawbacks of the other things that it does absolutely and if you think of it the other way around like say you are my manager or you’re the CEO of the company I work for I am

[24:04] Your head of engineering or I lead that engineering team that makes that service if something goes wrong you come to me you come to my team you don’t care if it is a dependency in code if it is a dark container that’s that costs it in the end my team me and my team need to solve this are responsible for whatever comes out and if you think it’s from if you take it from that angle people like yeah sure we’re also responsible for the performance like Steve was saying earlier and that is and you can measure performance security not and it goes well unless you’re not getting breached or nothing happens but if it goes wrong it comes back to the team and good devops partitioners know then we have to fix it yeah a place I’ve seen this go awry with Java developers in particular and Java application operators is with like jar file signatures because there’s this whole capability there where you can sign a jar file but there’s a question of who signs it because you don’t have to sign it to publish so you have a lot of these unsigned jars and of course everybody who ships software will be like I’m not

[25:15] Going to sign this third party library that I got and it’s like you’re the one who shipped it so when you kind of take over custodianship or provenance at a part of the software supply chain you should cryptographically sign whatever you are shipping so that people can actually look and say like that’s the jar file that I got from you know XYZ Co yeah and that’s a lovely idea but what we know is that almost nobody checks them yeah nobody nobody does it nobody signs it nobody checks them yeah but even once they get signed we you know it’s very it’s pretty clear that but it’s not checked you know you’re all those places where you can download code binaries whatever and there’s some signature people don’t check them it’s a very irregular activity well but that’s different depending on the ecosystem in different ecosystems people actually check the signatures of the third party libraries right in iOS if I’m not mistaken there are several package managers like carports or apples if package manager they have this step and it’s not optional but in iOS you can imagine that Apple has very strict ways

[26:29] For developers to work with their code and signatures there with the developer profile it’s a huge headache for developers but yeah it might worse risk one more thing here to mention is like circling back to CVS as Steve mentioned v stands for vulnerability right but not everything that is wrong in secure in like in application security becomes a vulnerability so what I see often that developers really or security teams are really focused on vulnerabilities on these TV scores like Let’s ignore everything that has lovers Corp but except for vulnerabilities we still have w c w e which stands for weaknesses and in our wasp top 10 which enumerates the largest top 10 risks right these are just typical mistakes and the latest of us top 10 there is a separate section like one of the risks which is called insecure design which is basically and this was the first time in 2021 it is the first time in August top 10 where we have design section suddenly and the goal is to focus developers attention on the lower the beginning side of ssdlc security development life cycle let’s start thinking about design let’s start

[27:54] Thinking about weaknesses and potential weaknesses before we even go to code and secure coding dependencies and dependency management and looking and fixing vulnerabilities so fundamentally that’s the sort of thing we’ve got to we’ve got to figure out is how do we get the developing communities to pay attention to these things you know and the information is out there and it’s getting better so absolutely it’s getting teaching developers how to write safer code is the you know one of the ultimate goals here I just want to just check because one thing I want to say about CPS because it’s something that we’ve seen change and this is this the only question of how long do you have from a CV being reported to you actually fixing it and unfortunately nowadays with the very high severity ones that come out the chances are that it’s already being exploited before it gets published so again you know not trying to be a doomsday here but it’s important for people to understand that the other thing they have to invest in is being able to apply these fixes especially the high severity ones as

[29:03] Soon as physically possible because you just don’t have time anymore to wait yeah and you actually have to patch this stuff because it’s not about the zero day attacks but let’s say 30 60 you know 365 days after the vulnerability came out if you’re still running Trucking along with that old vulnerability somebody’s going to come by you can go to things like exploitdb or you know GitHub search for the cve and then often POC and you’ll just get a bunch of exploit payloads that you can use to attack stuff and the longer that the vulnerable Library sits inside of your application that’s running the more likely it is that somebody’s just going to come along and find it I also think that we do not only need to focus on the high severity ones because I think it’s a misunderstanding for folks like oh this one is low the vulnerability scores is low if either if it’s a cve or a CW whatever score it is it’s low we don’t need to fix that because there’s no direct attack path and I think there is a problem as well because different things can connect together if you look at

[30:07] Security breaches it almost is never as big as well he probably will cover it later the lock for J1 which was a direct hit it’s probably something that connects to something else to something else to something else so a chain of problems connected to each other and then in the end it is it the cve might have a score of three or four like reasonably low but because it’s part of a chain it can still be harmful depending on whatever is in your application and it can be a combination of whatever is in your application code your the binaries that you pull in from the operating system the docker container the everything all together combined there might be a path that a even a small CV can be very harmful to you so just watching on course and saying like is this big or small and hopefully we can get to a point that we get to zero and I get and I know that that’s that’s of course not possible for most companies but just keep that in mind that a cve is or a vulnerability is not always a direct hit it can be just be in a chain of attacks and harm you mid-air

[31:22] Basically yeah so I personally like working on different analogies or just ways to make the security topics fun instead of the boring old risk guy who comes over and talks to you and one of the ideas that I’m working on now is the concept of like cves as Pokemon because you have for Pokemon for years they’ve walked around with that theme song of you gotta catch em all but the fact is there’s so many of these little animal Pokemon things around that you know that not all of them are particularly important but there’s some of them that you have to focus on at different times but still the goal is to become the world’s greatest Pokemon trainer or cve catch sure in an Enterprise capacity so I think I gotta Workshop that a little bit but I might be on to something I’m curious what the title of the workshop will be no you just gotta Workshop a joke where you kind of try different permutations of it to see how in that case absolutely well we could try that would be cool Pokemon workshop for Java developers yeah yeah so because the real other challenge all this is that this easy

[32:27] He’s aren’t necessarily look out in fact the chances are they’re not in your code they’re one of these dependencies that you pulled in or the dependency of the dependency of the dependency you pulled in so you’ve got to know you’ve got it which is a challenge in itself and then you’ve got to figure out how you’re going to fix it obviously if it’s a dependency tree you always have the ability to overwrite those versions and pick some new version but then it’s got to work and you’ve got to test it and you can see why even though we all understand why this is important to do it’s still hard for developers and businesses to get the hedger answer how they disaffectively so it’s still a technical challenge because you know the figures are something like 80 90 of your application is written by somebody else and therefore 80 or 90 of the cves that turn up actually probably 100 CVS that turn up are in somebody else’s code and so you have all that challenge as well but if you want to override them that means you need to know your build system Steve come on who knows what to build who knows what to build steps of

[33:30] Maven people are still people are still doing clean installs so that’s what I guess yes exactly but I think that’s that’s the point like people don’t know how the how some of their tools work and that you that you’re able to override these kind of things which dependency wins either if you’re if you’re a maven guy or a Gretel guy or whatever yeah I think yeah I think it starts over there already a library maintainers they don’t make this work easy because remember there isn’t drama is open SSL right open SSL has the nouns that they have the critical vulnerability and everyone wants like super prepared to what we have like this is an open a cell open a cell is used everywhere okay almost everywhere including these dependencies of dependencies and many of these dependencies unfortunately link open SSL statically into their code which means that they have linked a certain version of and it won’t change until you update the dependency right but then everyone so was like everyone was super prepared and we were waiting forward for this critical vulnerability but then open SSL maintainer said that

[34:46] Well okay we read things we decided to decrease the vulnerability level from critical to high so they announced two high vulnerabilities high is still high especially for opponent cell but when we actually read what these vulnerabilities are about say about parsing email from XML right emails from TLS certificates to be precise it’s not something you do very often in your application and it’s not something libraries used open itself for so their use case is very very rare so what I see from my community the reaction was oh okay these are not so important we can skip this update yeah yeah it still has two high vulnerabilities but come on we don’t use this code right so what I’m saying that we still have a lot of libraries extremely popular libraries basically things that the whole internet is working on and when those maintainers release new patches for new vulnerabilities it makes everyone like it makes everyone suffer it triggers and alerts everyone yeah so that’s actually one of the things I think Java gets right is the fact that the libraries are still there effectively dynamically

[36:12] Linked because it’s just in time compiled generally speaking so you can actually see what some of the dependencies are and theoretically you can update the JVM to patch vulnerabilities in the JVM that gives some level of control over the aspects unlike openssl where when you statically compile in a vulnerable version you are effectively screwed Forever on that distribution and I pasted a link in here I think it was a couple years ago that what was it growlvm was statically compiling secure random or random seeds into the compiled binary well to some extent it’s still that still happens every now and then I mean I know in a bunch of companies they’re not using a package manager to do to download the packages for you so you have a manifest no they basically copy and paste either the complete jar into a separate file or put it into class loader or even worse they copy paste parts of the coach and put that in their application so it’s very hard to find I know that some Engineers engineering managers also that I know it had a bunch of problems by solving that for instance with the

[37:31] Log4j situation last year that people statically had that code that vulnerable version as part of their Java application compiled so it’s it’s we have the opportunity not to do it and still in some cases people still do it unfortunately yeah I don’t know if you guys have seen the whole bunch of Jar files committed to the source repo but why I don’t know why people do it but they just download a bunch of Jar files shove them in The Source repo and then they commit that as a big old binary blob yeah it happens it’s a nice easy way to get your binaries distributed put your build tools into your Source repo yeah I mean guarantees they’ll be there when you look hey it works on my machine right yeah what could possibly go wrong right BC this comes back to what I say about the visibility of this is that we chuckle at this but it is an educational thing it is understanding why these things are not the right thing to do and so we can teach developers that but we’ve also got to teach them to take a better look at the tools they use you know one of the things that so often you find that people just do the stack

[38:39] Overflow thing how do I do XYZ go Google for it and stack Overflow says use this tool and they do it and you know I one of the things I when I talk to developers I say can you tell me the difference between wget and curl why would you use one versus the other and it’s like I don’t know I just stack Overflow one and that’s what I use you know they have different use cases and it’s like all these two tools you should know a bit more about the tools you use especially around the security space of this all right so throughout this discussion we’ve been coming to kind of three key roles which is a developer you’ve got devops so you have the operator and then you have an architect so let’s get into what are the individual security responsibilities for each group there well first of all I think it’s you have to operate as a team and communicate which is sometimes hard and yes we’ll laugh about it but it’s sometimes is I think for an architect it starts with design like like what kind of stuff do we have what kind of data for instance do we have in our system do we actually need that data how do we

[39:46] Distribute that data do we have separation of concerns between sub subsystem A and subsystem B the things we always talked about with dtos for instance but that is an architectural kind of thing if you look at the developer and that I think developer and devops are nowadays a bit intertwined there is there’s no hard boundary between them I think that was the intention of devops in the end anyway so creating say as a developer you’re creating stuff and that means that you nowadays think of hey am I scalable and am I and is the code maintainable but now if you are an autonomous team you also need to make sure that your solutions to that specific problem are safe are secure that your code is secure that everything you pull in your dependencies we talked about that a couple of times are secure and stay secure over time so redo that analysis and for devops it also means that making sure that am I able to for instance deploy something right away say we talked about we talked about zero days and I find out right at this moment that something is wrong how much time

[41:00] Does it take for me to change out that simple Library just take a simple solution simple Library I switch it out rebuilt my application and distribute it either to production or distributed to my clients that sounds super easy but in many cases it’s not because it takes days weeks months to build that application and then you have a bigger problem and I think that is something you need to address as well and I think that is for the devops part like hey do we have pipelines do we have all these tools available and all these new kind of ways of building things that we actually can distribute it right away so that my customers and my users are not experiencing the problems we try to warn them for when you have pipelines yes but there’s also a lot of things like infrastructure software or you know Java things that people get and they don’t run it through any pipelines like you just go download like a Kafka and then you put it up you don’t really need to build it because you just you don’t so generally speak speaking people don’t have large pipelines for all pieces of

[42:12] Software I absolutely agree I just picked a few things yeah just to see that there there’s there’s a shares responsibility between all of the folks to know what’s happening to know where their problem is and the problem is basically everywhere and that we communicate about that and be aware of that it can happen everywhere the deployment part the build processes have to automate it and you have to know what software you’ve got in there developers have the same responsibility because they’re the ones that choose independencies somebody somewhere goes I need that external I’m and so they’ve got to be better at making those choices and they’ve got to look harder at their choices and sometimes it’s going to become don’t take that whacking great XML library for that one function go write it yourself because in the end of the day you may be safer that way and the other thing that we’ve got to do coming back to things like the cwes and the air wasp thing there’s a whole bunch of rules out there and guidelines on how to write safer software you know even from input validation to other things and

[43:21] Those we’ve got to get our developers to pay attention to those you know they somehow and I’m not sure how or why but over the years that sort of part of software engineering has disappeared and we need to bring it back so that one but the build that and the build stuff as well because as Brian said you’ve got to be able to build this stuff quickly yeah definitely but also I think that in our like imaginary team with developers devops and Architects security Engineers are missing because there are still a lot of work to do like to be done like risk assessment stress modeling like using different checklists and standards like a wasp SS who will do this developers no they are busy with features they’re busy with relatives that’s the cops devops their busy with pipelines with infrastructures Architects they’re busy with design right but still there are so many things to do from security perspective and security for business is just one of these non-functional requirements as you as we mentioned previously it’s not something that can be seen it’s more like a negative like waste of money

[44:36] Activity that potentially can prevent huge money losses in the future so someone should work on a strategic level someone should work on like thinking about the future thinking about loss prevention and these could be security people security officers security Engineers you can call them whatever they have different roles because security engineering is a huge like umbrella term with different Specialties inside but also like a security managers if you can say it’s someone who guides the team using ssdlc right someone who will tell developers what is good and what is bad From ssdlc perspective these are the roles and sometimes these people are different I mean we have like certain roles and people are doing only this job and sometimes we have something called like a purple team or security Champions meaning that we have like an ordinary software Engineers that do secure energy that performs certain security functions okay yeah plus one of that as well yes I think you hit the nail right on his head there Anastasia I mean I think that and that comes also back to what Steve was saying that Allah is in education as

[45:55] Well so if you don’t have security folks the security team security engineering team how big do you ever want to make it as an engineer I come to a conclusion like okay I need to do something but I’m not I’m not sure how to handle this then you need to have somebody to go there and there needs to be a line between the security team and the development team if we could call like and hopefully there is a security Champion that is that proxy between there but if it’s not there still needs to be guidance from a security perspective or else well we will fail miserably I’m I’m afraid so one of the things I’ve been really interested in working on is the fact that Java has done a really good job of becoming effectively a blue collar programming language so that you don’t have to learn the Ivory Tower development Styles and it was never the first to do anything like it wasn’t the first to do memory management and Free People up from having to know about pointers you know whereas people used to have to learn all sorts of intricate libraries to do you know database calls or XML parsing Java introduced a lot of

[47:03] Those through standard apis so one of the parts that I’m really interested in we’re working on is the role of how can we make the JVM essentially free the developer’s mind from having to worry about a lot of the security flaws of today and what are some of the ways that we can look at what’s gone on in the industry over the last you know 10 15 years and make Java start automating some of those things again that’s a very good question and I think it starts with secure defaults a lot of them are secure but I already mentioned before that the XML parsers in Java are by default vulnerable to external entities for instance in a lot of the a lot of other languages did so this is already solved other things are well obviously things like deserialization it’s the gift that gives them keeps on giving so there are features we can work on to not enable more of these these problems but I would love to give the floor to the others as well to see what yeah because I’m like you I’m going how do I ask this question so absolutely we could imagine doing something with serialization to reduce its hit but

[48:21] That’s gonna break a few things but it’s still not it’s still worth looking modularity is good reducing the scope of classes that so that you can’t load things that’s cool we’ve got you know seal classes seal jars things like that there are a few things out there that we could use better I think serialization is always comes up as being the number one thing because it’s easy to do that there’s no security there’s no real security model within the JVM so there’s no real separation between user code and system Cloud which some other systems have so you know that might might be a possibility but I don’t know I look at Java as it’s mostly just a programming language and it’s not this isn’t really a Java problem in fact in some ways Java is just slightly better because it’s strongly typed we can you know we can analyze the bytecode better than some of the scripting languages and with I mean almost just by accident with things like Maven Central where you have to own the domain of the package name to register it that cuts down a whole bunch of the classic sort of attacks that

[49:33] You get in the some of the other repos but as a I don’t know as a is there a fundamental something different we could do with Java I’m not sure there is well one of the things that we’ve been working on is the role of making the JVM actually know the components that it’s running and Report those to an off-stream system so that you can go back and look and say you know I’ve used this vulnerable version of Log4j in the past and we just launched some capabilities to do that so it’s a lot of you know tracking what the JVM has run have you used deserialization in the past which is one of the sets of security flaws have you used what these components are what if in the process of just-in-time optimizations that a JVM does if it recognizes you don’t actually need these modules so you can start to remove them and make them inaccessible in future runs rather than having to force the developer to j-link in advance and remove them you could effectively take advantage of the things that the jit knows to improve the security of something as it runs yeah you’re quite right and to be honest take you’ve

[50:42] Heard that you can just do the girl thing it just can probably native that cuts through a lot of these issues yeah but then you statically compile vulnerabilities in a way that only the original operator can update later what it depends if the vulnerability comes with it but right but now we’re back to kind of the open SSL style where people end up statically linking to that older vulnerable version and now you have that there in perpetuity all right so Java got its start in terms of tiny low embedded devices and has really moved up to the Enterprise and Anastasia I know you work on a lot of tiny iot devices do you have any security insights into what goes on in that ecosystem yeah this is a disaster okay so being honest the thing with this small iot devices are like even industrial iot like I iot you know this joke s stands for security right the thing with these devices is that often they don’t have update or upgrade path so the code that you ship on these devices probably will work there until device is broken right of course it depends the system depends on

[52:02] Device depends on the architecture but really in many many cases you ship only once and you can imagine that you ship with all the vulnerabilities that you had on that moment in time and in security we don’t have the saying that your system is secure no your system is always insecure even if you don’t have any existing vulnerabilities as for today as for this morning on the evening situation may change new series vulnerabilities so it’s always a race and with these iot devices you don’t participate in this race anymore right so this gives one of the major risks so the last code you have on this device it’s kind of better because the probability is that you will have less vulnerability there another issue is that with low power devices again devices are different Raspberry Pi is also considered as iot device but Raspberry Pi can have like my first PC was not as powerful as modern Raspberry Pi right so Raspberry Pi has a lot of it has good CPU has a lot of ram has a lot of storage and can work on Linux but when we are talking about really low power devices it make it means that the

[53:23] Components libraries we use for them they are different just because we don’t have enough RAM we don’t have enough space to create like a large applications so we often end up with c C language again there’s a disaster from security perspective and the latest upon Sr vulnerabilities is a good illustration of how C is still flowed in 2022 for many many years that we work with C we still have the same mistakes again and again right all these combined gives us millions or even billions of insecure devices and don’t forget that in many many cases there are certain default parameters and iot vendors they don’t know about secure by default principle they use something by default in admin admin by default principle so many of these iot devices even if they are low to configure secure settings by default they don’t have those they have the default insecure configuration so it becomes the user’s responsibility how to configure their own device and of course some devices need to communicate and here we opened the whole chapter of insecure communication because these small and sorry stupid devices they

[54:48] Don’t have opportunities to use normal communication protocols to use TLS 1.3 for example they end up using insecure Bluetooth and Bluetooth as you know Bluetooth was insecure protocol without any built-in encryption for three versions four versions for a long time right it means that developers who create applications who create firmware for iot devices need to think about all these security issues they need to think about their dependencies amount of code about how not to make mistakes in C memory management how to transfer data between devices or devices and the hubs in a secure way and of course sometimes to take into consideration the physical attacks like the site Channel attacks that allow to public data to steal data based on the timing based on the CPU like electricity consumption yada yada iot security is very very very complicated and the problem is that we already have billions of insecure devices around us and it won’t get better it will get worse a year after year yeah I was talking to a guy limited results who did a lot of security analysis using voltage glitching on

[56:07] Esp32s and he like hacked them in a way that was totally irreversible so the chip was just it was forever hacked you could never reverse it so the device was compromised for good another example is NFC cards you know how you use your banking cards or your character card for like Metro for transport in your city so these are NFC cards these are simple cards with NFC modules and right now a lot of fintech application like cryptocurrency applications they start using those cards so in most cases these things are vulnerable because they use NFC which is again doesn’t have any built-in security measures this is just a protocol and again it’s a developer’s responsibility to build in some security and for last I don’t know six months I’ve seen so many insecure systems with iot just because it’s it’s really really really complicated an approach that I would like to kind of advertise here to focus their attention here especially with iot is defense in depth right because we cannot have a perfectly secure device we cannot have a perfectly secure firmware software yeah the other we need as the developers we need to

[57:26] Build in a lot of security methods like to building defense and depths meaning that we will have a lot of security controls on different levels if we’re talking about device starting from physical security physical anti-tampering measures going through firmware security depending on which operating system our device operates if it’s like a real operating system or if it’s this small rtos real-time OS like smaller operating system we need to configure those operating systems correctly we need to disable it’s called Linux hardening we need to disable all the packages we don’t use we need to have this secure configuration yeah the other only then we can go to the software level to the application Level where again we remember all the WASP guidelines and cheat cheat sheets where we care about secure coding and implementation security and application security there and we have a layer of data because our devices they do something they operate on data and if we Unfortunately they operate on sensitive dates right and we need to protect those data we’re talking about data address encryption we’re talking

[58:38] About application Level encryption then these devices they stand data somewhere so transmission security secure communication protocols and of course the usually it ends up with some device Hub or device control server right if there is some entity some back-end service that can control that can communicate with these devices so we are talking about its security as well so with iot we have all these multiple levels and we need to work on security on each of this level and if we are lucky enough our system will be kind the secure for next kind a couple years but then insecure again well then if we’re a lot lucky enough we get to start dealing with the human elements because it’s the way that people approach these systems then all of a sudden they get creative once your system works so like with parking meters and stuff they’ll have the iot solution it’s there it’s solar powered it’s independent you put your credit card in or you tap it and pay by app and you can pay and so what frequently happens is somebody will walk up they’ll slap a broken pay by this app and they’ll just put a sticker

[59:50] Over like the QR code so you’ll go there and you’ll pay to park and you’ll get a message that says thank you for paying you got a bill turns out you paid somebody else so now first you’re out the money that you use to pay nobody even knows who and second you get a ticket for parking unpaid yeah yeah absolutely and with increasing amount of these smart devices around us we will have more and more issues like that you can remember latest issues with very smart cars right with Tesla that people just they just go nearby that the car they use NFC and a c again in secret protocols they used in a c reader and they can Brute Force like attempt to grid for the car keys and just unlock somebody else’s car this is the future that we have or the repeaters where they have one person go stand next to somebody who’s in the restaurant that transmits the signal real quick to somebody who stands next to the car and then they just steal it because the key looks like it’s in the car I have a car I would say the manufacturer and there’s the remote key that has you have a car for now oh well yes and so

[1:01:07] The remote key is one of those that the bad guys with the right device can remotely activate and so steal your car and so the advice is to keep the key fob in a metal box that’s what I do Friday cage right keep everything in the Saturday games yeah yeah I don’t know we’re getting into a real weird future where you have to carry a fair lady just go back to playing Anastasia said which I think is something that we should be teaching developers as well and she talked about defense in depth and that is something that then again job developers should learn about and that comes to them starting to write putting out logging information and tracing information about the behavior of their application and that it’s not working the way that they’re expecting because similar to defense and depth is yeah you have all the layers but it’s also all the Warning Systems that weird things are happening and it’s just another thing to put on the list for Java developers to learn all right that covers a lot of really good information about security both of applications as well as Java applications so I want to

[1:02:17] Say thank you very much first of all for the guests and also for the listeners and keep an eye on Foojay for future articles about development and everything related to the OpenJDK world thank you very much