Apache Log4j vulnerability shows the importance of SBOMs of running apps

Since Log4Shell I have asked this question a few times and never really had a solid answer. Why are we not all using some sort of outbound firewall for our apps? Is there something fundamental (other than the administration of it) that stops it being the standard, or even possible?

With everyone using un-curated package managers such as NPM and PiPy there is also the chance of a package being compromised. At least if we had outbound firewalls it could help mitigate these problems.

It seems to me that there is an incredible opportunity for someone with the right background to build this (I wish it was me). I tend to use PAASs like Heroku for my apps and would love it if this was built in! They even know (most of) what other infrastructure my apps talk to. Why is it not part of Docker?

(Obviously everyone should already be using inbound WAF such as CloudFlare)

Re: Apache Log4j vulnerability shows the importance of SBOMs of running apps

#6

Post by 323 » Mon, Dec 13, 2021, 3:24 PM UTC

Something like this code notary should be integrated in the OS. When you install an app, the OS records a list of all it's components (declared in a manifest), and when a vulnerability is discovered the OS could quickly disable the affected apps (or apply a quick remediation).

Re: Apache Log4j vulnerability shows the importance of SBOMs of running apps

#7

Post by invalidname » Mon, Dec 13, 2021, 3:24 PM UTC

You have BOM in maven. You can block dependencies in a maven/gradle build which will fail the build if a sub dependency brings that in. The article incorrectly states that only Java 11 and lower are vulnerable. It's true that they are more vulnerable but newer JDK versions can still be attacked. It's just harder.

Re: Apache Log4j vulnerability shows the importance of SBOMs of running apps

#8

Post by jaboutboul » Mon, Dec 13, 2021, 3:25 PM UTC

mikro2nd wrote: post #2

"Oh, just run `node install` and you'll be fine..."

You really can’t blame developers for wanting ease of use when it comes to software and tool/library installation. At the same time it is incumbent upon people at all levels of the chain to make sure that security (and effective tools for managing it) are part of the mindset as well as the process.

Re: Apache Log4j vulnerability shows the importance of SBOMs of running apps

#9

Post by invalidname » Mon, Dec 13, 2021, 3:25 PM UTC

mikro2nd wrote: post #2

"Oh, just run `node install` and you'll be fine..."

This is Java so no: node install... There are Maven dependency commands though.

Re: Apache Log4j vulnerability shows the importance of SBOMs of running apps

#10

Post by 323 » Mon, Dec 13, 2021, 3:27 PM UTC

samwillis wrote: post #5

Since Log4Shell I have asked this question a few times and never really had a solid answer. Why are we not all using some sort of outbound firewall for our apps? Is there something fundamental (other than the administration of it) that stops it being the standard, or even possible? With everyone using un-curated package managers such as NPM and PiPy there is also the chance of a package being compromised. At least if…

Windows has an enabled by default outbound firewall. The problem is that most apps want to connect to the net these days (check for updates, telemetry, ....) so when an app is installed it adds a firewall exception.