Nominally off topic Funny note as this is rather our line of business also.
There are a number of tools ( including ours) that hunt down the CWE (Common Weakness Enumerators) that have been identified as being security violations. The government standards group (MITRE) manages these. Checkmarx, Fortify, CAST Software, etc all do a decent job analyzing code for the vulnerabilities and of course, the infamous WebGoat app is the intentional posterchild for violations. SQL injection (CWE23?) is bad but so far I haven’t seen confirmation that it was the issue. So I would hesitate to speculate on that. OWASP has a good tool set and frankly you should have no issue getting one or more to run it. So check out Mitre for a good sample of what they find. Thanks Bill Dickenson Dir CAST Software 302 521 3565 -----Original Message----- From: Bob Rudis [mailto:[email protected]] Sent: Friday, September 8, 2017 11:28 AM To: [email protected] Subject: Re: Does Drill Use Apache Struts (This is primarily for John, but may be of use to a broader set of folks) OWASP's straightforward-yet-uncreatively-named "DependencyCheck" tool <https://github.com/jeremylong/DependencyCheck> may be worth looking into. I haven't had to run it in a while (thankfully I work in R most of the time now ;-) but it should help diagnose project dependencies that have vulnerabilities. It takes a wee-bit to get it up and running (not much, tho) but once you do it shld be able to churn out anything that's remotely bad dep-wise. There are likely some OWASPians who wld be willing to help get run on Drill source, too. On Fri, Sep 8, 2017 at 11:49 AM, John Omernik <[email protected]> wrote: > That's a great idea Bob. > > The difficult thing is a review may find what's vulnerable and known > about at the time of a the assessment, but when new vulnerabilities > are released especially in libraries that may or may not be known to > be a part of core projects, it can be harder to see the impact of > those vulnerabilities. I will keep checking the poms of things I use > (thanks Bob for the pointer there, I am not a Java person, but it's > seems reasonable to use that as the starting point). Also, it's good > to raise awareness on all of these points in general so I always > appreciate lively discussions :) > > > > On Fri, Sep 8, 2017 at 10:42 AM, Bob Rudis <[email protected]> wrote: > >> I personally haven't had the cycles to do a thorough appsec review of >> the main web interface, the REST interface, access controls or >> encryption tools, but I also only run Drill on private AWS instances >> or on personal servers / systems, so it hasn't been a huge priority >> for me. >> >> I would encourage the Drill team to apply for a CII grant >> <https://www.coreinfrastructure.org/>. CII has funded security audits >> of OpenSSL and other OSS software and I believe Drill would be a >> great candidate, especially since it's designed to provide access to >> diverse data stores (i.e. breach Drill and you get to everything behind it). >> >> MapR or Dremio could likely help speed up said grant application >> since they are commercial entities with ties to the OSS side of Drill. >> >> On Fri, Sep 8, 2017 at 11:28 AM, Saurabh Mahapatra >> <[email protected]> wrote: >> > Thanks John, all. I think this discussion thread is important. As a >> community member, I learn so much by reading these threads. >> > >> > Since you work in cyber security research, are there specific >> > things we >> should think about from a security standpoint for Drill? >> > >> > I know that we have a REST API and I am sure there are web apps >> > being >> built around it. Are there vulnerabilities that we need to be aware >> of? How can we advise users about this? >> > >> > Thoughts? >> > >> > Best, >> > Saurabh >> > >> > Sent from my iPhone >> > >> > >> > >> >> On Sep 8, 2017, at 7:41 AM, John Omernik <[email protected]> wrote: >> >> >> >> Also, thank you for the pointer to the pom.xml >> >> >> >>> On Fri, Sep 8, 2017 at 9:41 AM, John Omernik <[email protected]> wrote: >> >>> >> >>> So, I thought I was clear that it was unverified, but I also I am >> >>> in >> cyber >> >>> security research, and this is what is being discussed in closed >> circles. I >> >>> agree, it may not be just struts, it's not spreading rumors to >> >>> say, >> this >> >>> struts vulnerability is serious, and it's something that should >> >>> be considered in a massive breech like this. Also, as with most >> >>> security incidents, it is likely only a part of the story. It >> >>> could be SQLi and >> it >> >>> could be Struts and it could be both or neither. To imply it was >> unrelated >> >>> SQLi is just as presumptuous as saying it was struts. Some folks >> >>> are talking about attackers using Struts to get to a zone where >> >>> SQLi was possible. I will be clear(er): I have not verified that >> >>> Equifax is >> wholly >> >>> struts, or even related to Struts, but my fear right now is >> >>> focused on >> open >> >>> source projects that may use Struts and I think this is legitimate. >> Putting >> >>> it into context, I want to learn more how to ensure >> >>> vulnerabilities in >> one >> >>> project/library are handled from a cascading point of view. >> >>> >> >>> John >> >>> >> >>>> On Fri, Sep 8, 2017 at 9:15 AM, Bob Rudis <[email protected]> wrote: >> >>>> >> >>>> Equifax was likely unrelated SQL injection. Don't spread rumors. >> >>>> >> >>>> Struts had yet-another-remote exploit (three of 'em, actually). >> >>>> >> >>>> I do this for a living (cybersecurity research). >> >>>> >> >>>> Drill is not impacted which can be verified by looking at >> >>>> dependencies in >> >>>> https://github.com/apache/drill/blob/master/pom.xml >> >>>> >> >>>>> On Fri, Sep 8, 2017 at 10:12 AM, John Omernik >> >>>>> <[email protected]> >> wrote: >> >>>>> Rumors are pointing to it being related to the Equifax breech >> >>>>> (no confirmation from me on that, just seeing it referenced as >> >>>>> a >> >>>> possibility) >> >>>>> >> >>>>> http://thehackernews.com/2017/09/apache-struts-vulnerability.ht >> >>>>> ml >> >>>>> >> >>>>> >> >>>>> >> >>>>> >> >>>>> On Fri, Sep 8, 2017 at 9:07 AM, Ted Dunning >> >>>>> <[email protected]> >> >>>> wrote: >> >>>>> >> >>>>>> Almost certainly not. >> >>>>>> >> >>>>>> What issues are you referring to? I don't follow struts. >> >>>>>> >> >>>>>> >> >>>>>> On Sep 8, 2017 16:00, "John Omernik" <[email protected]> wrote: >> >>>>>> >> >>>>>> Hey all, given the recent issues related to Struts, can we >> >>>>>> confirm >> that >> >>>>>> Drill doesn't use this Apache component for anything? I am not >> >>>>>> good >> >>>> enough >> >>>>>> at code reviews to see what may be used. >> >>>>>> >> >>>>>> John >> >>>>>> >> >>>> >> >>> >> >>> >>
