Home / Build Security / Vulnerability & SBOM Scanning with Syft and Grype

Table of Contents

Vulnerability Scans:

Vulnerability scans are critical tools for identifying security weaknesses within a system. These scans enable organizations to detect vulnerabilities early, allowing for timely remediation before they can be exploited by malicious actors. By integrating regular vulnerability scans into the Software Development Life Cycle (SDLC), organizations can ensure that their applications remain secure throughout their development and deployment.

Software Bill of Materials (SBOM):

An SBOM is an essential component in software development and security. It provides a comprehensive list of all components, libraries, and dependencies used in software, along with their corresponding versions and license information. The SBOM aids in managing vulnerabilities effectively by offering clear insights into the software components that are susceptible to security threats. By leveraging an SBOM, organizations can streamline the process of tracking, updating, and securing software components, thereby enhancing the overall security posture.

Malware scans

Yara Hunter standard CI/CD ruleset: https://github.com/deepfence/YaraHunter

Malware scans using YARA fit into the SBOM and vulnerability scan workflow by providing an additional layer of security analysis, particularly targeting the identification of malware signatures and patterns within software components.

Syft

Syft is a versatile open-source tool developed by Anchore, designed for generating Software Bills of Materials (SBOMs) from container images and filesystems. https://github.com/anchore/syft

Key features:

Grype

Grype is a powerful vulnerability scanner for container images and filesystems, developed by Anchore. https://github.com/anchore/grype

Key features:

Yara

Malware research and classification tool: https://virustotal.github.io/yara/

LAB

Image Assessment Workflow

Install Tools

ORAS OCI Client: https://github.com/oras-project/oras

# ORAS OCI CLI Installation
$ VERSION="1.1.0"
$ curl -LO "https://github.com/oras-project/oras/releases/download/v${VERSION}/oras_${VERSION}_linux_amd64.tar.gz"
$ mkdir -p oras-install/
$ tar -zxf oras_${VERSION}_*.tar.gz -C oras-install/
$ sudo mv oras-install/oras /usr/local/bin/
$ rm -rf oras_${VERSION}_*.tar.gz oras-install/ 
#Install Syft
$ curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
# Install Grype
$ curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

Container Build and Assessment

Download https://secure.eicar.org/eicar.com.txt file to trigger yara rules

$ curl -O https://secure.eicar.org/eicar.com.txt

Start OCI Registry server

$ docker run -d –restart=always -p “127.0.0.1:5000:5000” –name reg registry:2

Create Docker File

$ cat < Dockerfile-alpine FROM apline:3.10 WORKDIR /app

COPY ./eicar.com.txt /app EOF

Build Container Image

$ docker build -f Dockerfile -t localhost:5000/alpine1:0.1 .

Push to local registry for storage

$ docker push localhost:5000/alpine1:0.1

Docker sbom command (Syft Under the Hood) to create a spdx-json sbom

$ docker sbom –format spdx-json –output sbom.txt localhost:5000/alpine1:0.1

Docker and Grype for SAST vulnerability scan reporting

$ docker sbom –format spdx-json localhost:5000/alpine1:0.1 | /usr/local/bin/grype > vuln-scan.txt

Yara Malware Scan

$ docker run -i –rm –name=deepfence-yarahunter -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/home/deepfence/output deepfenceio/deepfence_malware_scanner_ce:2.0.0 –image-name localhost:5000/alpine1:0.1 –output=json > malware-scan.json

Attach Sbom to image

$ oras attach localhost:5000/alpine-prod:0.1 sbom.txt –artifact-type example/sbom

Attach vulnerability scan report to image artifact

$ oras attach localhost:5000/alpine-prod:0.1 vuln-scan.txt –artifact-type example/doc

Attach Malware scan to image

$ oras attach localhost:5000/alpine-prod:0.1 malware-scan.json –artifact-type example/doc

View supply chain artifact

$ oras discover localhost:5000/alpine-prod:0.1 -o tree

Summary

By incorporating YARA scans into the SBOM and vulnerability scanning workflow, organizations can achieve a more comprehensive security assessment, protecting against both known vulnerabilities and potential malware threats embedded within their software supply chain. This multi-layered approach is crucial for maintaining the integrity and security of software applications in today’s threat landscape.

Makefile (Jenkins / Gitlab / Actions) Example:

REG_URL := “kurtisvelarde.com:5000” NAME := “alpine-eicar” VERSION := “0.1”

build: ## Docker Build @docker build . -t $(REG_URL)/$(NAME):$(VERSION)

push: ## Push to local registry @docker push $(REG_URL)/$(NAME):$(VERSION)

sign: ## Sign with build key @cosign sign –key ~/.sigstore/cosign.key kurtisvelarde.com:5000/alpine-eicar:0.1

verify: ## Cosign verify @cosign verify –key https://kurtisvelarde.com/build/cosign.pub kurtisvelarde.com:5000/alpine-eicar:0.1 cve-scan: @docker scout cves

trivy-scan: ## SAST Scan for High and Critical CVEs @trivy image –severity HIGH,CRITICAL $(REG_URL)/$(NAME):$(VERSION)

create-sbomb: ## Generate spdk (LinuxFoundation) @syft kurtisvelarde.com:5000/alpine-eicar:0.1 -o spdx > latest.spdx

attach-sbom: ## Attach sbom to image @cosign attach sbom –sbom latest.spdx kurtisvelar^C.com:5000/alpine-eicar:0.1 sign-sbom: ## Sign sbom with cosign key @cosign sign –key ~/.sigstore/cosign.key kurtisvelarde.com:5000/alpine-eicar:sha256-eda1dbd3ea70923db4482a669331cee9844ff82ca7915ed292001542357c8a7d.sbom

verify-sbom: ## Verify @ cosign verify –key https://kurtisvelarde.com/build/cosign.pub kurtisvelarde.com:5000/alpine-eicar:sha256-eda1dbd3ea70923db4482a669331cee9844ff82ca7915ed292001542357c8a7d.sbom test: ## Push to local registry docker run -it 127.0.0.1:5000/myimage:0.1 /bin/sh -c “uptime”

help: @grep -E ‘^[a-zA-Z_-]+:.?## .$$’ $(MAKEFILE_LIST) | sort | awk ‘BEGIN {FS = “:.*?## “}; {printf “\033[36m%-30s\033[0m %s\n”, $$1, $$2}’