AVTOKYO2016 Vuls

This slide was used in [AVTOKYO 2016](http://ja.avtokyo.org/avtokyo2016/event)
2016/10/22 @ Tokyo

![vuls_logo.png](https://qiita-image-store.s3.amazonaws.com/0/22462/01c6d661-8b7f-43f9-c7f8-7d1577205764.png)

---

# Abount Me
- Kota Kanbe ([Twitter](https://twitter.com/kotakanbe), [GitHub](https://github.com/kotakanbe), [Facebook] (https://www.facebook.com/kota.kanbe) )
- Programmer @ [Future architect, Inc. Japan](http://www.future.co.jp/)
- Author of [Vuls](https://github.com/future-architect/vuls/)
- Owner of [Mohikan Slack](http://qiita.com/kotakanbe@github/items/32cf4eb3de1741af26fb)

---
# Balse?

![rapyuta.png](https://qiita-image-store.s3.amazonaws.com/0/22462/50a3aaad-9367-83cb-7d9d-135ecc6f6c4d.png)

---
# Vuls (VULnerability Scanner)

- Vulnerability scanner for Linux/FreeBSD, agentless, written in Go
- Not Web penetration scanner
- [GitHub Vuls](https://github.com/future-architect/vuls)

---

# What's Vuls
- [IPA MyJVN API 活用事例その５](http://jvndb.jvn.jp/apis/)

![vuls.png](https://qiita-image-store.s3.amazonaws.com/0/22462/d25be9c0-255b-37a2-3157-f93b3e8952ab.png)


---
# Architecture

![vuls-architecture.png](https://qiita-image-store.s3.amazonaws.com/0/22462/ff60362b-3164-f74d-408a-4d6114fde6f1.png)

---
# Scan Flow

![vuls-scan-flow.png](https://qiita-image-store.s3.amazonaws.com/0/22462/54405a1b-6e7f-6e07-d3de-0d0f44beee28.png)

---
# Why parsing a changelog
- Ubuntu, Debian, CentOS

```
locales	           2.13+git20120306-21  
login	           1:4.1.5.1-1.1ubuntu7  
lsb-base           9.20160110
make	           4.1-6
mawk	           1.3.3-17ubuntu2
mime-support	   3.59ubuntu1
multiarch-support  2.21-0ubuntu5
```

---
# Features 

- Scan for any vulnerabilities in Linux/FreeBSD Server
    - Supports Ubuntu, Debian, CentOS, Amazon Linux, RHEL, FreeBSD
    - Cloud, on-premise, Docker
- Scan middleware that are not included in OS package management
    - Scan N/W Devices, middleware, programming language libraries and framework for vulnerability
    - Support software registered in CPE
- Agentless architecture
    - User is required to only setup one machine that is connected to other target servers via SSH
- Nondestructive testing
- Pre-authorization is not necessary　before scanning on AWS
- Email and Slack notification are both available. (supports Japanese language) 
- Scan result is viewable on accessory software, TUI Viewer terminal or Web UI ([VulsRepo](https://github.com/usiusi360/vulsrepo)).

--- 
# Support OS


| Distribution|            Release |
|:------------|-------------------:|
| Ubuntu      |          12, 14, 16|
| Debian      |                7, 8|
| RHEL        |                6, 7|
| CentOS      |             5, 6, 7|
| Amazon Linux|                 All|
| FreeBSD     |                  10|

---

# Configuration
[README in English](https://github.com/future-architect/vuls#configuration)
[README 日本語](https://github.com/future-architect/vuls/blob/master/README.ja.md#configuration)

---

# [Demo](https://asciinema.org/a/3y9zrf950agiko7klg8abvyck)

---

# Reporting / Slack

![vuls-slack-ja.png](https://qiita-image-store.s3.amazonaws.com/0/22462/d7ea68a4-3752-c6a4-03d3-f07dcb0acde0.png)

---

# Web UI / [usiusi360/vulsrepo](https://github.com/usiusi360/vulsrepo)

[Online Demo](http://usiusi360.github.io/vulsrepo/)

---
# Why I Created Vuls

- I managed over 100 Linux servers for several years.
- Vulnerability management and software update task is too much of a hassle.
- System administrator will have to constantly watch out for any new vulnerabilities in NVD or JVN.
- It is expensive to perform analysis to determine the servers affected by new vulnerabilities. 
- Everyday ...

---

![angry.gif](https://qiita-image-store.s3.amazonaws.com/0/22462/68465387-23b9-10e2-cb02-be719324e01a.gif)

---
# Why I Published Vuls To GitHub

- I traveled India and Nepal for 1 month.
- I tried training at Japanese Temple near birthplace of the buddha for a week.
- [Morning training](https://www.facebook.com/kota.kanbe/videos/vb.100002040821074/792813290796691/?type=2&theater)
- An old monk thinks about peace of the world from the heart.
- I thought what can I do for peace of the world 
- ..... 
- OSS!

---
# For Peace Of The World

![india-6.jpg](https://qiita-image-store.s3.amazonaws.com/0/22462/3e08cb93-cd2a-1205-37f3-ee0e24b174c8.jpeg)

---

# Buzzed All Over The World
<img width="817" alt="Star_history.png" src="https://qiita-image-store.s3.amazonaws.com/0/22462/6f03ec15-41d7-9fc8-f362-97e2961b30a1.png">

--- 

# Got First Place In GitHub Trending
2016/10/1 All Language
![image002.png](https://qiita-image-store.s3.amazonaws.com/0/22462/281e7713-954f-687c-6ff8-1d9b3055e9b3.png)

---
# Pull Request-Driven Development
Total [159 P/R](https://github.com/future-architect/vuls/pulls) (2016/10/19)
- FreeBSD Support by [justyntemme](https://github.com/justyntemme) [#90](https://github.com/future-architect/vuls/pull/90)
- High Speed Scaning on CentOS by [ti-ga](https://github.com/tai-ga) [#138](https://github.com/future-architect/vuls/pull/138)
- High speed data fetch from JVN by [kotakanbe  #21](https://github.com/kotakanbe/go-cve-dictionary/commit/e3f226a516ca9d3031fc7957f81300faa4132d97)
- High speed scanning on Ubuntu(20x Faster on Ubuntu, 4x Faster on Debian) by [kotakanbe #172](https://github.com/future-architect/vuls/pull/172)

---
# Recent Changes

- Setup Vuls using DockerHub by [matsuno](https://github.com/sadayuki-matsuno) [#223](https://github.com/future-architect/vuls/pull/223)
- Support ignore CveIDs in config　[#222](https://github.com/future-architect/vuls/pull/222)
- Confirm before installing dependencies on prepare [#219](https://github.com/future-architect/vuls/pull/219)
- Remove all.json [#218](https://github.com/future-architect/vuls/pull/218)
- Improve makefile, -version shows git hash, fix README [#216](https://github.com/future-architect/vuls/pull/216)
- change e-mail package from gomail to net/smtp by by [matsuno](https://github.com/sadayuki-matsuno) [#211](https://github.com/future-architect/vuls/pull/211)
- Add only-containers option to scan subcommand #122 [#190](https://github.com/future-architect/vuls/pull/190)

---
# Community

- 217 Members (#general)
- 120 Members (#vulsjp)

<img width="278" alt="Stats___vuls-github_Slack.png" src="https://qiita-image-store.s3.amazonaws.com/0/22462/2e9f0dc7-f8f9-279c-4b5a-fda8ccf0cc64.png">

[Join Vuls Slack](https://docs.google.com/forms/d/e/1FAIpQLSfMyxCKV0C1ukTE0Mc9oyOHDI_2nbz4L75LAMj0D_A2vx_fMA/viewform?c=0&w=1)

---
# VulsMatsuri #1
- 2016/9/26 about 100 people
- [Slides](http://vuls-jp.connpass.com/event/38391/presentation/)

---
# Links
- [脆弱性スキャナVuls 関連リンク集](http://qiita.com/usiusi360/items/aeb3cd3630badfacdb4e)

---

# What I'm Working On
- CPE auto-detection of programming language library
    - [Vuls is possible to detect vulnerabilities in non-OS packages](https://github.com/future-architect/vuls#usage-scan-vulnerability-of-non-os-package)
        - [go-cpe-dictionary](https://github.com/kotakanbe/go-cpe-dictionary)
    - I'm planning to integrate with OWASP Dependency Check
    - I'm going to talk more details at [Security-JAWS #3](https://s-jaws.doorkeeper.jp/events/51939) 10/28

---
# 　I'm Here　To Talk With Hacker

- For now, root privilege is needed to scan RHEL, Ubuntu, Debian and CentOS. Do you know how to detect the vulnerabilities(CVE-ID) without root privilege on these OSes?(FreeBSD and Amazon Linux do not require root privilege for this)

- Miss Detection on Ubuntu, Debian, CentOS
    - Vuls parses a changelog of upgradable packages. If the CVE-ID is written in irregular format, Vuls can't detect the CVE-IDs. Do you know how to detect the CVE-ID without parsing the changelog?

- I am planning to integrate with other security scanner, something like OWASP-dependency-check, lynis, wpscan or ssh-audit. Please teach me other scanner that you recommend.

- Windows support

---

# We Are Hiring Hacker And Engineer! 

If you are interested, please contact me ( Twitter: @kotakanbe )

- http://www.future.co.jp/recruit/
- [来たれ、奇人・変人・達人！ってボスが言ってる](https://newspicks.com/news/1766875/body/?ref=user_2187)

---

# Thanks

Give a GitHub Star if you are interested :)