Microsoft Defender DevOps

Question

Hi,

We just enabled the preview for Defender for Cloud for DevOps. It's weird as it is giving us some errors on Microsoft dlls. Any idea how to fix this issue or ignore?

Tool: BinSkim: Rule: BA2004 (EnableSecureSourceCodeHashing). https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2004EnableSecureSourceCodeHashing
      'Microsoft.Azure.WebJobs.Host.Storage.dll' is a managed binary compiled with an insecure (SHA-1) source code hashing algorithm. SHA-1 is subject to collision attacks and its use can compromise supply chain integrity. Pass '-checksumalgorithm:SHA256' on the csc.exe command-line or populate the project <ChecksumAlgorithm> property with 'SHA256' to enable secure source code hashing.
     

      Tool: BinSkim: Rule: BA2004 (EnableSecureSourceCodeHashing). 
      'Microsoft.Azure.WebJobs.Extensions.Http.dll' is a managed binary compiled with an insecure (SHA-1) source code hashing algorithm. SHA-1 is subject to collision attacks and its use can compromise supply chain integrity. Pass '-checksumalgorithm:SHA256' on the csc.exe command-line or populate the project <ChecksumAlgorithm> property with 'SHA256' to enable secure source code hashing.

Answer 1

I am getting same error as above. what I am supposed to do?

'Microsoft.Azure.WebJobs.Host.Storage.dll' is a managed binary compiled with an insecure (Sha1) source code hashing algorithm. Sha1 is subject to collision attacks and its use can compromise supply chain integrity. Pass '-checksumalgorithm:SHA256' on the csc.exe command-line or populate the project <ChecksumAlgorithm> property with 'SHA256' to enable secure source code hashing.

##[error]132. BinSkim Error BA2008 - File: drop/target/distrib/Release/x64/AzureAppInsightsNet8/net8.0/Monitoring/Agent/Extensions/AMACoreAgent/grpc_csharp_ext.x64.dll.

Signature: 224300abbcf9ebf0b28a10e8c63f8a68d35f626cfc4275f891ddf2aefcb2fb99

Tool: BinSkim: Rule: BA2008 (EnableControlFlowGuard). https://github.com/microsoft/binskim/blob/main/docs/BinSkimRules.md#rule-BA2008EnableControlFlowGuard

'grpc_csharp_ext.x64.dll' does not enable the control flow guard (CFG) mitigation.

To resolve this issue, pass /guard:cf on both the compiler and linker command lines. Binaries also require the /DYNAMICBASE linker option in order to enable CFG.

For VC projects use ItemDefinitionGroup - ClCompile - ControlFlowGuard property with 'Guard' value, link CFG property will be set automatically.

Answer 2

I recommend opening a support case/bug report within the portal.