In this post, we’ll look at the security blindspots of lockfile injection that a Ruby gem might expose via its Gemfile.lock. As a prelude to that, we will open up with a brief introduction to Ruby and third-party dependencies management around RubyGems and Bundler. Web developers often work on Ruby projects, but are mostly referring to them as the popular open source web application framework Ruby on Rails.
Snyk security researchers continually monitor open source ecosystems for malicious packages, utilizing static analysis techniques to identify and flag suspicious packages. Each malicious package is identified upon publication to the package manager and swiftly added to the Snyk Vulnerability Database. During recent research, the team found 12 unique pieces of malware belonging to the same actor.
C++ offers many powerful capabilities to developers, which is why it’s used in many industries and many core systems. But unlike some higher-level languages that offer less direct control over resources, C++ has a variety of security concerns that developers must be keenly aware of when writing code to avoid introducing vulnerabilities into projects. As developers, we build applications with our end-users in mind. They trust us with their data, time, and device access.
Since AT&T launched its Vulnerability Scanning Service (VSS) in 2012, in partnership with DDI/HelpSystems, over 30 million devices have been scanned. The VSS provides vulnerability management services that help organizations identify vulnerabilities on their network and manage their swift remediation. Similarly, the AT&T Managed Vulnerability Program (MVP), launched in late 2020, allows organizations to assess their network without hiring IT professionals.
Kubernetes provides an interface to run distributed systems smoothly. It takes care of scaling and failover for your applications, provides deployment patterns, and more. Regarding security, it’s the teams deploying workloads onto the Kubernetes cluster that have to consider which workloads they want to monitor for their application security requirements.
This month we’re introducing you to GhostSec, a hacktivist group with ties to the Anonymous collective
