Another great Server Side Request Forgery find. I found this on a test again in May folks, it's a real thing. Just because your analyst doesn't have time to write the exploit doesn't mean it isn't real.
https://medium.com/@win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204
Spoofing attacks on contact tracing. Man, the bad guys will stop at nothing. Insane.
https://www.theregister.com/2020/06/02/contact_tracing_spoofable/
Two MORE remote code execution vulns in Zoom. Now, don't think I am picking on them, but this is why we should be careful up front - you never know when you are gonna go viral! I think the devs at Zoom are doing an AWESOME job fixing these as they show up.
https://blog.talosintelligence.com/2020/06/vuln-spotlight-zoom-code-execution-june-2020.html?m=1
The fantastic Google Project Zero wrote a neat instrumentation library that is ACTUALLY lightweight for Windows 32 and 64. You should use it to instrument only modules of interest, and it adds very little overhead. I haven't played with it yet but I am very excited to (when I have two minutes to rub together).
https://github.com/googleprojectzero/TinyInst/blob/master/README.md
Hope you are all safe. Weird stuff going on, and us in tech are well positioned to make changes in the world. Stop and think before you choose a direction.
This wouldn't fit in a comment, but there is a lot of interesting information in here:
Kevin Brown12:01 PM
the event was widely advertised at Fuse
Joe Kuemerle12:01 PM
Far NE Pennsylvania for me
Mosharrat Shams12:02 PM
Hi Everyone,
I am Mosharrat Shams.
Kevin W. Wall12:04 PM
I'm about ready to use a weed whacker to cut my hair. Two hour waits at Great Clips.
Going for that Lion look
Kris Wall12:08 PM
Since everything is going virtual, this has been a big advantage for under represented OWASP cities.
Greetings from Oklahoma City!
Scott Goette12:10 PM
Greetings from the north coast of Ohio
Chris Holman12:10 PM
Good afternoon from sunny Chelmsford, UK.
Andrew Fitzgerald12:10 PM
she's just so popular
Doron Samuel12:11 PM
Good afternoon! Greetings from New York City!
Bob Caruso12:12 PM
There is an extension available also that implements the Zoom-style grid (or Brady bunch). https://chrome.google.com/webstore/detail/google-meet-grid-view/kklailfgofogmmdlhgmjgenehkjoioip
Wolfgang Goerlich12:12 PM
Greetings from Detroit!
Bob Caruso12:12 PM
It has not been pen tested
Kyle Kline12:12 PM
This is my first Google Meet ever -- everybody's video was grainy, and I discovered in settings mine was defaulted to 360p max for both send/receive. Changing it up to 720p helped a lot :)
Klaus Agnoletti12:12 PM
I am from Denmark, so yes. Global
Kris Wall12:13 PM
New York, Detroit, UK, OKC! We might outnumber the Ohio folks!
Chris Brew12:15 PM
Hi Jamie, Chris Brew here from Facebook Seattle, working on the future Assistant that will live on AR/VR glasses. We have many lovely security challenges. More difficult to lose your glasses than to lose your phone, but it will happen.
Warner Moore12:17 PM
LOPSA Columbus is virtual tonight! http://lopsacbus.org
Kris Wall12:17 PM
Our BSidesOK conference is going virtual. We tried hard to make it in person. :(
Scott Goette12:19 PM
that's because she went into presentation mode
You12:22 PM
This chat has a lot of awesome. Not sure how to archive, but I might just try copy/paste
Newsletter I mentioned at sempf.net
You12:23 PM
WSTG at https://owasp.org/www-project-web-security-testing-guide/
Scott Goette12:24 PM
👍👍😎
Kris Wall12:26 PM
Valuable? Bah! What does it connect to? Where can it pivot?
Scott Goette12:27 PM
dev and qa are on your production network, right?
or does everyone practice network segmentation and not poke holes through firewalls?
Kris Wall12:28 PM
I've found plenty of half baked and abandoned apps with access to prod and internal DBs
Bob Caruso12:29 PM
Pivot-through is usually the biggest threat. spot on, @Kris Wall
Scott Goette12:35 PM
ooohh - like this. Different Security engagements should be appropriately timed for accuracy
You12:43 PM
Deployment too. Sometimes you have out of date third party components, and ops has to get involved.
Chris Brew12:47 PM
All of this makes sense in a big tech company context, except that it is not directly financial. Engineering resources are still limited, and over-committed, and there is still an aggressive timeline.
Kris Wall12:48 PM
I take this into consideration when sending my reports. Each remediation issue turns into an action item and each item has to be well-defined for the dev team.
Brandon Lewis12:49 PM
To add on to Chris' comment, it's still a lot of $$$ at the end of the day - rewrites are never cheap especially for large applications (refer back to estimates).
Warner Moore12:49 PM
Re-writes are almost never the answer.
Andrew Fitzgerald12:52 PM
+1 for "don't touch my tech debt"
Bob Caruso12:52 PM
I can see Bill's arms waving, but no sound
Chris Brew12:52 PM
A Facebook specific is that privacy is an extremely big stick to wield. No one can or should say no to a security person who has a justified privacy concern, because it is officially a non-negotiable priority. But dev teams still face all the prioritization issues you raise.
Warner Moore12:53 PM
Depends on the allocation. I typically like 20% for tech debt, security, etc.
If you'd prefer it not to be touched, it can be a smaller part of the pie. ;)
Kris Wall12:53 PM
Devs get upset if you can't define the problem. :)
Doron Samuel12:55 PM
I was about to say that point in the chat box :)
Bob Caruso12:58 PM
Scenarios are the most convincing when you can use the developer's own code (via pen test).
Kevin W. Wall1:02 PM
A great example of letting the perfect becoming the enemy of the good.
Jennifer Middleton1:03 PM
+1 ^
Bob Caruso1:04 PM
Also, developers are trained to not touch working code and are often measured/rewarded by shipping new features (tied to revenue) and not by remediations or weaknesses closed. SOLUTION: Put a $ value on remediations, and/or turn cybersecurity controls into product features that are advertised to customers so that they get pulled through the whole dev pipeline.
Kevin W. Wall1:07 PM
Great prezo. g2g to work mtg. Stay safe everyone.
Warner Moore1:08 PM
Security features in products is looking at it from a value creation perspective and not necessarily an operations perspective. A robust security program for a modern tech organization requires both security features in the products and security capabilities within the organization. Often, that distinction is missed which means the security program is lacking in an area.
Kris Wall1:08 PM
We need to be nicer?
Sure. I guess!
You1:09 PM
Maaaaaaaaaan, I was just working on being grouchier like Kevin
Brandon Lewis1:09 PM
As a dev (looking to transition into security), sounds like there's a big lack of security champions on the dev side - someone who can be a realistic bridge of communication/reason so it doesn't feel so "security versus app teams".
rachit sood1:09 PM
@warner +1
Ron Varghese1:09 PM
Nice work Jamie!
Nabeel Alauddin1:09 PM
Appreciate the tips to build partnerships/establish trust and enable dev teams to self-direct their security efforts
Thanks for the presentation, Jamie!
Ron Varghese1:10 PM
Brandon it depends on the maturity of the org.
Warner Moore1:10 PM
Fantastic presentation. Important and useful message to working more productively together.
Scott Goette1:10 PM
great talk!! empathy and understanding is key - hire more devs in security
Krysten J1:10 PM
Thank you for this presentation!
Bill Churchill1:10 PM
Thanks Jamie!
Bob Caruso1:10 PM
Thanks, Jamie
Scott Goette1:11 PM
Will you publish the deck that you presented?
Rebecca Harvey1:11 PM
Thanks Jamie!
Andrew Smith1:11 PM
Thank you, I appreciate your observations...especially around the golden rule.
Kris Wall1:11 PM
@jamie If we need to get more forceful with dev teams and their governance, let's say there's continual push back, do you have any suggestions for being effective and not burning bridges?
Robert Ravenscroft1:11 PM
As always, great job Jamie!
Warner Moore1:12 PM
WARNER WAS HERE
Michael Flock1:12 PM
Thanks Jamie. Good stuff.
Brandon Lewis1:12 PM
Are the issues discussed here a really common experience for security folks trying to engage app teams?
Warner Moore1:12 PM
;)
Kris Wall1:13 PM
Push back from dev teams is quite common.
Kris Wall1:17 PM
Scans are OK for finding low hanging fruit, but not a replacement for security assessments.
Bob Caruso1:18 PM
agreed, a scan is just the start. It should result in a systemic improvement
Kris Wall1:19 PM
Keep it going! Bust out the guitar!
Nabeel Alauddin1:19 PM
I have to dip out. This was my first OWASP gathering and I learned a ton. Thanks Bill for facilitating and looking forward to more sessions in the future.
You1:20 PM
https://owasp.org/www-project-application-security-verification-standard/
https://owasp.org/www-project-application-security-verification-standard/
Andrew Fitzgerald1:23 PM
We'll save the jamie snark for offline
Nathan Zender1:24 PM
👏 👏 👏
Brandon Lewis1:24 PM
Good presentation Jamie, thanks!
J.D. Santen1:24 PM
great job everyone.
Bob Caruso1:27 PM
Thanks!
Kris Wall1:27 PM
Thank you everyone!
The group unc0ver has released a broad-ranging iOS jailbreak tool.
https://thehackernews.com/2020/05/iphone-ios-jailbreak-tools.html?m=1
Very complete writeup of the BBPress vulnerability,
https://b.ou.is/articles/2020-05/CVE-2020-13693
Neet little tool to get details about a repo without cloning.
https://github.com/sameera-madushan/RepoPeek
Have a good week, everyone.
Happy Memorial Day! Take a minute to learn something new about the seven branches of the US Military (see you learned something already)
https://www.defense.gov/Our-Story/Our-Forces/
A new decompiler for ... wait for it ... Visual Studio Code. Yup. Uses Ghidra and IDApro. Neat.
https://marketplace.visualstudio.com/items?itemName=tintinweb.vscode-decompiler
Tenable did a fantastic writeup of Signal's use of WebRTC, and how to abuse it. Really good research.
https://medium.com/tenable-techblog/turning-signal-app-into-a-coarse-tracking-device-643eb4298447
Georgetown University published a paper (PDF) on ethics and Artificial Intelligence.
https://cset.georgetown.edu/wp-content/uploads/CSET-A-National-Security-Research-Agenda-for-Cybersecurity-and-Artificial-Intelligence.pdf
There was a Remote Code Vulnerability in Google's Cloud Deployment Manager.
https://www.ezequiel.tech/2020/05/rce-in-cloud-dm.html?m=1
There is also a username harvesting vulnerability in Azure Portal, but I'll handle that under separate cover.
Not appsec related, but very interesting. Windows 10 got tcpdump. Now, it's not a conspiracy, it's a debugging tool. Geez, people.
https://www.bleepingcomputer.com/news/microsoft/windows-10-quietly-got-a-built-in-network-sniffer-how-to-use/
Hope everyone is doing well. Stay in touch.
S
FireEye has an excellent breakdown of a Remote Access Trojan in C# - which is quite a feat given the constraints of the .NET Framework.
https://www.fireeye.fr/blog/threat-research/2020/05/analyzing-dark-crystal-rat-backdoor.html
I have written some C# malware as well, it is not easy, but we are all standing on the shoulders of giants.
https://github.com/lockfale/DotNetAVBypass-Master
The inestimable awesome Didler Stevens wrote some incredibly well thought out code the deobfuscated Excel macros
https://isc.sans.edu/diary/26110
Here's some really interesting analysis of malweare written for supercomputers. This is really interesting because these hyperdrive computers do a lot of really useful work with governance data, voting, medicine, and a boatload of other stuff.
https://www.cadosecurity.com/2020/05/16/1318/
Hope everyone is staying safe in these weird times.
S
Lots of AWS assessments recently, here is a good new tool for IAM checking.
https://github.com/salesforce/cloudsplaining
Here is a neat, but not new one for Azure
https://github.com/FSecureLABS/Azurite
Lotsa code today. Here's a token reverser to help test password reset functions.
https://github.com/dariusztytko/token-reverser
Good article on proxying thick clients.
https://maxfieldchen.com/posts/2020-05-05-proxying-unaware-thick-clients.html
Hope everyone had a great Mother's Day.
Really awesome article on automating application scanning with OWASP ZAP:
https://www.zaproxy.org/blog/2020-04-09-automate-security-testing-with-zap-and-github-actions/
Interesting model on how Chrome extensions can be used for man-in-the-middle attacks.
https://github.com/mandatoryprogrammer/cursedchrome
DLL Hijacking is one of those thick-client attacks that everyone dismisses, but they shouldn't. This is why:
https://itm4n.github.io/windows-dll-hijacking-clarified/
Another information disclosure vulnerability - this time through the Referrer header.
https://www.theregister.co.uk/2020/04/30/email_http_leakage/
That's the news folks. Hope everyone is healthy!
In the world of emergency preparedness, which has been a hobby of mine since I was a Scout, there is something called the rule of threes. When I teach Emergency Prep merit badge, I talk about these points:
You can survive:
- 3 minutes without air
- 3 hours in severe weather
- 3 days without water
- 3 weeks without food
Now, this all sounds very depressing, but it is VERY important. The fact is, in an emergency, you need to prioritize before anything else. The first thing you must do is make a list, in order, of shit to do. Do not, ever, let anyone tell you otherwise. For instance, in a car wreck, you must first make sure everyone can breathe and isn't bleeding (because that is what gets the air to your organs). Then, if it is winter, you need to get warm. If there is a tornado, you need to get shelter first, then make sure you have water.
The one thing I don't tell Scouts is the last point, because it isn't usually something that we have to deal with in the developed world:
This isn't often talked about but it is a very important point. In war stricken areas, or places like Louisiana after Katrina, it has been proven true over and over. Without hope, mental health has a significant impact over physical health, crime, and overall strife.
We are nearing that threshold in the United States (and elsewhere).
If you are safe, and you have water, and if you have food, the clear and present is to find sources of hope. Stop watching the news. Preen your lists of who you follow on social media. The Boston Symphony Orchestra is doing stuff online. The Columbus Museum of Art is holding virtual tours.
I don't talk a lot about mental health but I deal with issues myself. This is gonna bring out some things you didn't know about yourself. Be smart, be safe, consider your risk model, and best to all of you.
Really great breakdown of exploitation of cache poisoning.
https://samcurry.net/abusing-http-path-normalization-and-cache-poisoning-to-steal-rocket-league-accounts/
Further reminder that HTTP is the weakest link. Exploitation example of HTTP Request Smuggling.
https://honoki.net/2020/03/18/xxe-scape-through-the-front-door-circumventing-the-firewall-with-http-request-smuggling/
Extraodinarily hard to exploit but really fascinating to look at RCE bug in the Android Bluetooth stack.
https://insinuator.net/2020/04/cve-2020-0022-an-android-8-0-9-0-bluetooth-zero-click-rce-bluefrag/
A lot of people have put their online training up for free (for a limited time) like PluralSight. Here's another one, by Kontra. I haven't done it yet but it comes highly recommended.
https://blogs.akamai.com/sitr/2020/04/a-brief-history-of-a-rootable-docker-image.html
That's it for the news of the week. Everyone stay safe and healthy!
S
I Forgot To Post On Easter Because I Was Cooking Edition
There is a really need VMWare bug that has some solid analysis already. Thanks to John from a client of mine for tuning me into it.
https://www.vmware.com/security/advisories/VMSA-2020-0006.html
https://threatpost.com/critical-vmware-bug-corporate-treasure-hackers/154682/
You need to reboot Boeing 787s every couple months or they crash. No big deal.
https://www.theregister.co.uk/2020/04/02/boeing_787_power_cycle_51_days_stale_data/
From the archives (because I just used it on a test): a Command Injection Cheatsheet:
https://hackersonlineclub.com/command-injection-cheatsheet/
I was blindingly honored to judge the CBusStudentHack competition this year. Clearly it was weird, and we had to do it remotely. Way easier when you can talk to the young women and men on the teams, but we got it done via video. Here are the five finalists - worth a watch if you want to feel god about the next generation of hackers.
https://www.youtube.com/playlist?list=PLXpk4w_SsmmTJgYwm9OLgVlPkl-aQK_kc
Please stay safe and healthy.