The latest trends and tips in DevSecOps through instrumentation and Security Observability.

Subscribe To Blog

Hacked... Because of an Insecure Library

BlogImage_ClashofKings0716.pngThis morning, ZDNet’s Zack Whittaker reported a hacker has targeted the official forum for the mobile game Clash of Kings, stealing nearly 1.6 million accounts. According to the piece, the hacker exploited a known weakness in the forum’s software, an older version of vBulletin, which dates back to late 2013. The version in question is vulnerable to a number of serious security flaws, which can be exploited with tools found readily online.

Avoid the Hack - Keep ALL Software Up-to-Date

Unfortunately, getting hacked because you didn’t keep your software up-to-date is an all too common experience. In the operating system arena, most products have auto-update features – like Windows Update – that check your products and verify that you’re using the latest version. This is particularly important for security patches.

But in the application world, like vBulletin, there is no such infrastructure. Not even a notification infrastructure for vulnerabilities. So developers and operations teams are simply flying blind – nobody tells them that the application is now completely vulnerable. While at Aspect Security, we looked at this problem in depth, and published this whitepaper, called “The Unfortunate Reality of Insecure Libraries.” We explored the pervasive use of libraries with known vulnerabilities. The numbers, as you can see in the report are staggering. 

Open source projects don’t patch the same way products do. If you want to keep using an older version of an operating system, you can just apply the security patches for that version. But with open source, there are no such patches for older versions. You simply *must* move to the latest version of the project, regardless of whether it disrupts your entire codebase, requiring extensive recoding and retesting. Many development projects are stuck on the horns of a terrible dilemma – keep operating with vulnerabilities, or spend months rewriting applications for no real benefit.

We simply have to do a better job of enabling people who download and operate open source software to keep their software up-to-date. At a minimum, we need an infrastructure to notify users. But even better would be to enable libraries and applications to automatically update themselves when new critical vulnerabilities are discovered. There are some difficult technical challenges to overcome, but it simply has to happen or breaches will continue to occur.

Jeff Williams | Co-founder and CTO
Contrast Security
888.371.1333 | @planetlevel @contrastsec

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast Security. He recently authored the DZone DevSecOps, IAST, and RASP refcards and speaks frequently at conferences including JavaOne (Java Rockstar), BlackHat, QCon, RSA, OWASP, Velocity, and PivotalOne. Jeff is also a founder and major contributor to OWASP, where he served as Global Chairman for 9 years, and created the OWASP Top 10, OWASP Enterprise Security API, OWASP Application Security Verification Standard, XSS Prevention Cheat Sheet, and many more popular open source projects. Jeff has a BA from Virginia, an MA from George Mason, and a JD from Georgetown.