- Dailydave - mm4.emwd.com

Computer Science
by Dave Aitel 27 May '22

27 May '22

I remember when fuzzing was just sending long strings to RPC programs, and tapping the cloaca of all Unix programs, the signal handler, to see what came out. But now, to be a hacker, you have to be a scientist. Computer science is a real thing. But most computer scientists I know can't explain how to do it because it comes out sounding like a deep dive into a dungeons and dragons campaign run by toddlers. And perhaps, the hardest thing with computer science is knowing when you're stuck, when the noise inherent in your system has overwhelmed the signal, and hence, you. Really I lied. The hardest thing is knowing when someone else on your team is stuck and being able to reach into their understanding of the System and unstick them. Because science, like digestion, is a team sport. You can, if you want, undertake fun experiments. For example, you could as a hacker just say publicly what 0day you know are sitting around, waiting to be found. You can be as loud and annoying about it as possible, then just wait a few years and see if there are any cool BlackHat talks on the subject <https://www.blackhat.com/us-20/briefings/schedule/#room-for-escape-scribbli…> or not, and if the market makes any particular changes to how it deals with that technology. There will not be any. This might make you ask more questions - more uncomfortable ones. "What is an acceptable parasitic load in a system?" you might ask in this way. In the animal kingdom, it is an astonishing 40% <https://www.nationalgeographic.com/animals/article/animals-evolution-parasi….>. In computers, it is probably the same, where the science of hacking is equally ignored and reviled, both profitable and prophetless. Most hackers you know are specialized in the mystic art of Transformation. A heap overrun becomes an information leak which becomes code execution. A denial of service becomes a side channel attack becomes a local privilege escalation. Sometimes it's hard to see the science in this. A friend of yours will look down upon it as "just engineering". But it's not enough to just find one bug anymore, or even one transformation of a single bug. Every bug must pass through multiple slits at the same time now, like a lost waveform. This takes some science. My point is this: If you think you are defending against Engineers, but really you are defending against Scientists, you've already lost. And if a country wants to build and maintain offensive power in cyberspace, it has to understand how to care for and nurture the places that treat it as a science. -dave

1 0

SBOMs and Jellyfish
by Dave Aitel 22 Apr '22

22 Apr '22

The most annoying thing with talking to computer scientists about anything is they will look at any problem that remotely touches software and ask you "Is that the right data structure? Are you ... sure?" Like, this is what happens to every programming language - it's why you get NaN or an empty list for any given arbitrary code fragment in Javascript. People had a normal data structure, say a dictionary, and were like "What if we OPTIMIZED IT for all the common situations?" And so now a Dictionary is like a hybrid "Dictionary-List-Cache-Semi-Ordered-ViewMap" and it changes everything about how it operates according to some internal heuristic only some ancient and primal god of mischief could understand. So when someone asks me why, in certain cases, my program returns weird results right now, the REAL answer is, "Some computer scientist took what could have been a perfectly good data structure, and gave it performance anxiety". But project managers hate that answer. So instead they get to hear about graph databases. This brings me to two important and closely linked subjects: SBOM, and venomous jellyfish. As the mighty Halvar Flake once probably said to himself, "I can take any hideously boring problem, and turn it into a fascinating and only a bit unsolvable graph algorithm solution!" And this is where SBOMs currently live. Software is amazing, and people in cyber policy like to think of it as if it was a book or long journal article, and you can take a snapshot of it, and send it to your friend Bob with a version number 1.0 on it and Track Changes and then they send it back with a version number 1.1 or 1.0-BobEdits and that's that. But that is only what Loki, the god of lies, wants you to think. Environment is a huge part of the equation! You can go to your local pond, and get a carnivorous tadpole, an angry little hungry frog baby with a giant beak that eats other frog babies, and show it to a biologist and ask them the species, and they will tell you Spadefoot, and then find one eating plants in the corner, just a cute little guy, and the biologist will also tell you Spadefoot, and when you look at them confused they will shrug and mumble something about phenotypic plasticity which is clearly a bunch of words they made up to sound cool. It is so with software. What software are we running? Well, the description of software is rarely smaller than the software itself. It is usually much bigger. An SBOM could be described as a nested manifest of metadata about software. But if you say that to a computer scientist you found drowsing on the beach they will perk up like an evil sea otter who has spotted a bivalve and say "Wait, are you sure about that data structure? Is it truly a directed acyclic TREE structure, or is it more a ..." an awkwardly long pause will ensue as they struggle to control their emotions "...graph?" At this point you will realize you've made a mistake. If you somehow manage to escape by diverging the topic into something about eagles and Mordor, you can go on your merry way, building and selling tools that work on Trees and only Trees. You will be arboreal, but rich. And then someday someone will deliver a copy of Nature to your yacht by mistake, which by this point will be the only way to traverse most of the East coast, and you'll read about Jellyfish, or as the biologists will haughtily inform you are now called simply, "Jellies". (The less money a scientist makes, the more haughty and good looking.) But because you are a "learned person" you will read this article <https://www.nature.com/articles/news.2008.1134> about jellyfish and they will let you know about horizontal gene transference, which breaks every idea you had about how evolution worked. But it also might remind you about backporting and cherry-picking and a lot of crazy stuff that happens in the software world. So you might boat over to where that computer scientist was, and ask them maybe if they can port all your Tree-working code to Graph-working code. And then, unfortunately for you, the story gets dark. -dave

1 0

Re: GraphQL
by Jim Manico 05 Mar '22

05 Mar '22

For many years GraphQL implementations have had massive issues with access control/authorization and denial of service. This is a common problem when you are essentially give a database prompt to the client. GraphQL is better off on the back end only, IMO. At OWASP we have an older cheatsheet on this topic that gets a lot of hits. https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html If you have suggestions to make this better let me know! Regards, jim(a)manicode.com > >> On Mar 5, 2022, at 10:14 AM, Dave Aitel via Dailydave >> <dailydave(a)lists.aitelfoundation.org> wrote: >> One of the best ways to get more performance out of your networked >> system is to trust the client more. This is always a bad idea from a >> security perspective, as everyone on this list knows, but it's fun to >> see it reincarnated a thousand times in different bodies. >> >> So for example if your web application has endless structured data >> always changing and you're sick of writing REST APIs and middleware >> you start thinking - what if instead, I had a flexible Javascript API >> in the client that just grabbed data right from the database, and >> that database did the user-authorization? >> >> Anyways, GraphQL is interesting and makes the hacker in me, and >> probably all of you, hungry. In general, from a security perspective, >> "Let the user talk directly to the database, but we FILTER it a bit" >> is always a hilarious losing perspective, like trying to outswim a >> shark, or having just one more drink of Goldschlager. >> >> Any filter or translation layer starts introducing protocol >> desynchronization vulnerabilities, of course, but also you have to >> worry about timing oracles, denial of service via resource >> exhaustion, authorization mistakes, and a whole host of nightmares >> that hackers at this point can pull out of endless old Bugtraq posts >> whenever they feel like they need a conference talk at your expense. >> >> People often make the mistake of correlating "No plugin exists in >> BURP for this attack surface" with "this new technology is more >> secure than the last one!" >> >> What confuses me is when people deploy huge web applications based on >> this sort of thing you would think they would at least ask the giant, >> VC funded companies, "Which security team looked at and gave you a >> review of this tech? What if the whole thing is a bad idea?" Like in >> five years are we going to realize that you can't give users the >> ability to run arbitrary regular expressions on your extremely >> complicated database without so many checks and balances that it >> ruins the whole point of having them connect to the database in the >> first place? Yes, yes we are. >> >> On one hand, this is a sad state of affairs. On the other hand, who >> are we without it? This failure is the upwelling current that brings >> nutrients from the ocean floor to our arctic habitat. This is the >> solar wind of quantum bits we float from planet to planet on. This is >> the brief touch of a child's hand on the belly of the Buddha. This is >> truth in the way that we know it. >> >> -dave >> ---- >> Resources: >> https://blog.forcesunseen.com/a-primer-for-testing-the-security-of-graphql-… >> https://medium.com/csg-govtech/closing-the-loop-practical-attacks-and-defen… >> _______________________________________________ >> Dailydave mailing list -- dailydave(a)lists.aitelfoundation.org >> To unsubscribe send an email to dailydave-leave(a)lists.aitelfoundation.org

1 0

GraphQL
by Dave Aitel 05 Mar '22

05 Mar '22

One of the best ways to get more performance out of your networked system is to trust the client more. This is always a bad idea from a security perspective, as everyone on this list knows, but it's fun to see it reincarnated a thousand times in different bodies. So for example if your web application has endless structured data always changing and you're sick of writing REST APIs and middleware you start thinking - what if instead, I had a flexible Javascript API in the client that just grabbed data right from the database, and that database did the user-authorization? Anyways, GraphQL is interesting and makes the hacker in me, and probably all of you, hungry. In general, from a security perspective, "Let the user talk directly to the database, but we FILTER it a bit" is always a hilarious losing perspective, like trying to outswim a shark, or having just one more drink of Goldschlager. Any filter or translation layer starts introducing protocol desynchronization vulnerabilities, of course, but also you have to worry about timing oracles, denial of service via resource exhaustion, authorization mistakes, and a whole host of nightmares that hackers at this point can pull out of endless old Bugtraq posts whenever they feel like they need a conference talk at your expense. People often make the mistake of correlating "No plugin exists in BURP for this attack surface" with "this new technology is more secure than the last one!" What confuses me is when people deploy huge web applications based on this sort of thing you would think they would at least ask the giant, VC funded companies, "Which security team looked at and gave you a review of this tech? What if the whole thing is a bad idea?" Like in five years are we going to realize that you can't give users the ability to run arbitrary regular expressions on your extremely complicated database without so many checks and balances that it ruins the whole point of having them connect to the database in the first place? Yes, yes we are. On one hand, this is a sad state of affairs. On the other hand, who are we without it? This failure is the upwelling current that brings nutrients from the ocean floor to our arctic habitat. This is the solar wind of quantum bits we float from planet to planet on. This is the brief touch of a child's hand on the belly of the Buddha. This is truth in the way that we know it. -dave ---- Resources: https://blog.forcesunseen.com/a-primer-for-testing-the-security-of-graphql-… https://medium.com/csg-govtech/closing-the-loop-practical-attacks-and-defen…

1 0

General Relativity is Not Evenly Distributed
by Dave Aitel 11 Feb '22

11 Feb '22

[image: image.png] If cities were 100% accurately represented by video games, Miami would of course be *GTA: Vice City*, a story of simplistic corruption garishly lit and stuck in 2002 forever. It's traditional to hate on Miami, right until you make some crypto money and decide to move there into a condominium with a stunning view and an equally stunning lack of maintenance or foresight around rising water tables. Seattle, on the other hand, is *Cyberpunk 2077*, a city run by cybernetically enhanced corpos who get to work by walking past endless discarded refuse and homeless tent cities heated with literal barrel campfires - on my way to the airport yesterday we drove through some thick fog, which the Uber driver explained to me was just "a fire under the bridge" with the same level of casual interest he would apply to a sale at a JC Penny's. Traveling between these two cities imposes arbitrage costs on your consciousness itself, extracting profit from your inability to look away from what seems like an obvious oncoming disaster. What happens when the ocean goes up another foot, and nobody can get flood insurance? you ask yourself, as people around you wave you off. How come such a progressive city can't serve its people's needs, or at the very least pick up their trash? you wonder, while running past a well worn armchair next to the freeway that, rain or shine, serves as someone's impromptu throne. While the humanity in you rages against the system, the hacker in you realizes that knowing the past and processing it to produce the future can be as useless and predictable as an earthworm's digestion. Hackers live in a realm between spaces and times, looking at the hidden connections and occasionally playing a chord on the threads. -dave

1 0

Cyber Threat Intelligence vs Megafauna
by Dave Aitel 08 Feb '22

08 Feb '22

https://twitter.com/SecurePeacock/status/1486156096259637250?s=20 [image: image.png] So I wanted to respond to this post which starts "If someone exploits an 0day they still have to setup C2 - this is where TTPs are generated that Blue Teams can win against". And I think for the past year I've gone on a huge journey of discovery, annoying my Cyber Threat Intelligence friends to no end as I ask annoying questions like "After you put some random non-googlable name up, like PLATINUM, can you just add a little flag so I know what country you're talking about?"" [image: image.png] (Argh. The whole point of codenames is they are UNIQUE and easy to search for. This is like naming your OS "Windows" I guess.) Anyways, imagine if seventeenth century biologists were reporting to the newly established Royal Society and they were talking about counting all the animals and doing studies on animals and of course what they used to do that were the various animals that kings and whatnot had gotten stuffed and sent to them. I feel like you would find out that almost all animals had fur and were easily shot by muskets or stabbed with spears! I guess my point here being: Cyber Threat Intelligence is in a very hard place right now, despite soaring revenues and many exciting trophies on the wall. What you hear, over and over again, is that yes, detecting exploitation is hard, but you will be able to detect "lateral movement" and see the command and control traffic, and when attackers need to "accomplish their mission" they will therefore be detectable. And this is true - for some missions, and for some operational concepts <https://cybersecpolitics.blogspot.com/2020/05/asynchronous-command-and-cont…> that accomplish those missions. But we fail when we don't consider other operational concepts and other missions. Apparently we call the many reasons we fail to turn data into warnings and then into action: "pathologies". Good marketing from XDR companies is a pathology in this space. And that pathology goes to the highest levels - when we have leaders in govt say "We don't see any serious Log4J exploitation" we have to think "Wait, we have almost no visibility for Unix targets though". Even when we have the right telemetry, we don't have the right analysis. I like to probe our pathologies with annoying questions: - What percentage of worms do we see? - What happens when people don't use a C2 but just drop an implant? - Who are the hacker groups focusing only on Unix? - What percentage of 0day do we really even find? - Are we looking only at our adversary's actions, or also our own to make trendlines? But more than that, we are not self-conscious in the way that we should be about our own analytical pathologies. This is because our academic structure for peer review and everything else in this space is pretty busted. Anyways, there's more to the world out there than just lions and antelope and espionage RATs. To see the really interesting things you need a microscope, and the kind of eyes that want to squint through the lenses of microscopes we haven't even built yet. -dave

2 1

RootedCON 2022 Call For Papers is open!
by omarbv＠riseup.net 17 Dec '21

17 Dec '21

______ _ _ ____ ___ _ _ / / _ \ ___ ___ | |_ ___ __| |/ ___/ _ \| \ | | / /| |_) / _ \ / _ \| __/ _ \/ _` | | | | | | \| | / / | _ < (_) | (_) | || __/ (_| | |__| |_| | |\ | /_/ |_| \_\___/ \___/ \__\___|\__,_|\____\___/|_| \_| *** /RootedCON'2022 - Main activity *** -=] About RootedCON RootedCON is a technology congress that will be developed in Madrid (Spain) from 10 - 12 of march 2022. With an estimated seating from 2.500 to 3.000 people, is the most relevant specialized congress that is held in the country, and one of the most relevant in Europe, with attendee profiles ranging from students, Law Enforcenment Agencies to professionals in the technology and information security market and, even, just passionate people. This is our XII edition, after the restrictions pause. And as in every edition, we want it to make it special :) -=] Talk types We will mostly accept two kind of talks: - Fast talks: 20 minutes. - Standard talks: 50 minutes. There will exist a limited number of talks of both types having, even, the possibility of working with the schedule to extend a talk beyond the 20 minutes limit, or to reduce a 50 minutes one. We encourage you to BE ORIGINAL with your proposals. We accept *rare* talks and thematic, on culture or politics (always orbiting around the concepts technological or Information Security). -=] International speakers There is simultaneous Spanish-English and English-Spanish translation on all tracks, so please do not hesitate to inscribe a talk, wherever you are from :) Be sure to indicate the language in which you will give it: [ES] - Spanish [EN] - English =] Topics we are looking for Any interesting topic related to TECHNOLOGY, having examples below and not limited to: - ANY original topic that contributes content to our audience! - APT, botnets and malware. - Obviously, ransomware! - BIO Hacking and alternative disciplines - Any hacking topic in any environment: IP, OT, IoT, Cloud, EDGE, Satellites, Mobiles... - Reverse engineering, debugging, hooking, fuzzing, exploiting, DFIR,... - Financial Tech (FinTech) - Hardware Hacking, Jtag, SWJ, Dap, consoles,... - Videogames, cheats... - Cryptography, steganography, covert channels,... - DEV/SEC/OPS. - DEV: MQTT, AMQP, development patterns, distributed development, CI/CD... - OPS: puppet, jenkins, orchestration, virtualization and containers, artifacts,... - Culture, philosophy and ethics, future, innovation ... the world! -=] Talk submission procedure We will only accept talks submitted throught the official speaker form: https://cfp.rootedcon.com/ (both english and spanish) Any other talk submission will be considered "unofficial" and will not have any guarantee in being selected. -=] Speaker benefits and privileges Every speaker will get these benefits and privileges: - ONE extra ticket for a partner (1 ticket) to attend the event. - Diner with all the speakers, RootedLABS trainees, sponsors and the RootedCON team. - Accommodation (RootedCON carries with the costs, even the partner) - Travelling (RootedCON carries with the speaker's costs) - Full access to all congress areas all the event long. - The possibility of repeating the speech up to three times, one in every track (depending of the final rating). - Some free drinks in the party :) - Potential job offers management. - A gift from the organization. -=] Obligations and duties of the speaker All speakers that inscribed a talk and get selected must: a) Confirm that the talk is TECHNICAL and it is supported with Proof of Concepts (PoC). If PoC are not available, it should be justified.

1 0

Some cool projects - JOERN
by Dave Aitel 09 Dec '21

09 Dec '21

Lately all I've been doing is data science but I've been trying to keep up with some of the cool work happening in the cybers as well. One project I think is especially cool is the Joern Ghidra2CPG project. https://twitter.com/fabsx00/status/1466302205019971586?s=20 https://joern.io/blog/joern-supports-binary/ The theory is that you can use the Ghidra decompiler, then have a code property graph, which they store in a special purpose in-memory graph database (that should probably be ported to A REAL GRAPH DATABASE). Then you can make queries in scala (ugh) against that DB to find bugs. One example is here: https://github.com/joernio/query-database/blob/main/src/main/scala/io/joern… Has anyone else tried using this? It'd be cool instead of doing source sink to do clustering and missing link analysis and MLlib against the graph database. Also a real graph db might be able to scale better... but regardless, this is the kind of cool project I hoped to see when Ghidra first came out! This paper as well seems quite relevant: https://twitter.com/0xadr1an/status/1466518964029169672?s=20 The Convergence of Source Code and Binary Vulnerability Discovery – A Case Study https://www.s3.eurecom.fr/docs/asiaccs22_mantovani.pdf -dave

1 0

Active Directory - a clear and present danger
by Dave Aitel 26 Jul '21

26 Jul '21

So I definitely have a different mental history of active directory than most people, and recently I was doing a Glasshouse podcast with Pablo Breuer <https://www.linkedin.com/in/pablobreuer/> and here <https://youtu.be/Z0d6qNLevUY?t=2714> he says basically the same thing everyone says, which is that it's impossible to move off of technology even when that technology has a history of severe flaws, or a design flaw that means it cannot be secured. This is the current mental stance among CIOs familiar with large companies, or even medium size companies! And I get it! But if leopards keep eating your face, and every hacker in the world keeps recommending you stop giving them a cuddle, and you say "I can't, I have legacy systems in my head that love to hug large dangerous cats" then that stops being the government's problem, in a way. Like when people ask why Cyber Insurance Markets are obvious catastrophic failures, and we point at how they can't really change any meaningful behavior, and they have to insure the total market value of whatever company they are insuring because the cost of risk is basically a sliding scale of whatever the Russian ransomware team thought up that morning over kasha, then everyone gets that surprised face and it's all very annoying. So anyways, that brings us back to AD. AD is a system where any time you hack any computer on the network, you can become the domain controller, and own the whole company. That's just how it works. Every hacker/penetration tester has known that for two decades and the specific incantation on how you do that changes slowly over time, but it's always true. And then at INFILTRATE one year two Microsoft Research team members demonstrated an automation of the lateral movement piece which is now what Bloodhound <https://mcpmag.com/articles/2019/11/13/bloodhound-active-directory-domain-a….>is. So in theory everyone knows this right now, even though they like to blame EternalBlue for all their problems in life. But when you point that out on Twitter <https://twitter.com/dinodaizovi/status/1418909301746327559?s=20>, people ask you what the alternative is, and I have to admit I disagree with DDZ that it's "Zero Trust". That sounds like adding more complexity to a system that is already SO COMPLEX even lifetime specialists not named James Forshaw don't understand the BASICS of the authentication system. Like here's a paper <https://twitter.com/DebugPrivilege/status/1418884269376671755?s=20> that came out today that's in my queue all about Service credentials, and look - no matter how many new auditing tools or visualization thingies or AI anomaly detection alerts you deliver to your customers, if the underlying system is NOT UNDERSTANDABLE BY HUMANS then you can't secure it. I guarantee you that about 80% of the Russian ransomware affialiates understand Service Credentials and delegation better than your current AD management lead. Most of the time your AD ACLs are just you fooling yourself that you have a security boundary where you, in fact, don't. Also, the problem is not NTLM. Everyone stop talking about NTLM. It wouldn't matter if AD was re-implemented to use purely quantum key exchange because only Gandolf can mentally visualize the transitive trust structures implicit in how you configured your AD Forests. Ok so that brings us back to: What do you do instead? And honestly, I don't know. I've enjoyed reading the snippets that Grapl Security <https://www.graplsecurity.com/> has been posting about their setup. As far as I can gather, the TL;DR is just use Google as your directory server and use Chromebooks as much as possible. This is what I do right now - but I'm not sure how scalable this is. Maybe y'all can pitch in on this thread and suggest a solution? Thanks, Dave Aitel

4 3

"Hack the Planet"
by Dave Aitel 20 May '21

20 May '21

[image: image.png] Ok ya'll - you're letting me down. There's a thousand ways you and your friends can use 10k to improve the world - engineering a solution nobody would pay for because it's not something you can put at a booth at RSAC. EVERYONE ON THIS LIST needs to either submit for a grant, or find someone who will submit for a grant. You're telling me not one of those superhackers at Microsoft and Google can find a worthy project? It's Thursday, and there's 5000 people on this list, each of which can destroy whole systems of the world with their minds, but actually all I want now is for them to work up the energy to fill out this google form <https://nostarchfoundation.org/apply-now/>. I have a whole team of very cool people <https://nostarchfoundation.org/our-board/> waiting to help walk you through the process once you do. And the grant recipients that get selected are also going to get mentored by experienced members of the field - the head of the mentorship committee <https://en.wikipedia.org/wiki/Fred_Davis_(entrepreneur)> started a little zine back in the day called Wired and knows basically EVERYONE, and I think the mentorship alone should convince you to submit a grant request. Anyways, typey typey. Get to it. :) -dave P.S. Here's one of last year's submissions <https://nostarchfoundation.org/grant-recipients-by-year/2020-grant-recipien…>, which I quite like. [image: image.png]

1 0

Plausible.
by Dave Aitel 11 Apr '21

11 Apr '21

A while back I was chatting with someone at INFILTRATE, over fried alligator and more alcohol than I probably should have imbibed, and he said, "We're going to make fuzzing obsolete, because we have more CPUs on the problem than anyone can reasonably duplicate, and we're going to exhaust the space". And it's PLAUSIBLE in a way. I've watched a few of the live streams that Brandon Falk does, and you can see how like, for a certain subset of problems throwing more CPU and Power than Zeus at the fuzz problem might actually drain the oceans we all swim in. But lots of plausible stuff is still dead wrong. I spun up a private fuzzer a few weeks ago with some random test harness and popped a bug[1] in a popular browser almost by mistake. Now I'm spending hours and hours pouring over C code trying to find the root cause so I can control it, which since I am so out of practice is not unlike a coal locomotive trying to drive down one of the new Boring Company tunnels, coughing black oily smoke all over those shiny white Teslas. How do you install Ctags again? If you're bored, this Sunday, or any Sunday, you can watch this talk on CONOPS I put together, after spending too much time reading bad cyber policy papers: https://youtu.be/6l28f_x54gM . It might be related, it might not. The world is unknowable, like the results of a fuzzer. Some part of all of this is a lesson that when it comes to bug finding, it's not only ok to be different - to be from a different era, or to think in a different way - it's almost required. Team BigCorp can spin up all the VMs in the world, and if they don't love the same bugclasses you do, they will have optimized away from finding the bugs you find. Also, I want everyone to help publicize this so we can change the world for the better, even if just a bit. Send it to your friends! Think of cool things to do with it! https://twitter.com/NSPFoundation/status/1379849502199144449?s=20 -dave [1] a3ca63d4929c08a18c4418e039557e6d lol, I had trouble getting this hash but in the process found out it hits the default Windows 10 Home (not Pro, because Dwizzle hasn't sent me that yet) as well.

1 0

News Roundups!
by Dave Aitel 01 Feb '21

01 Feb '21

So lately I've been doing little news roundups on the YouTubes.... Yesterday's is here: https://youtu.be/xgiymt_0isY Neal Stephenson, in his most recent book, *Fall*, had a character that was an interesting play on the traditional fantasy "giant" in the sense that she was normal size, but fractally dense. I feel like we are living that kind of time - in the sense that gravity is really a measure of how much stuff is happening at any given place! Anyways, smack that subscribe button the way you hit enter on Bl4sty's sudo exploit on a those Linux boxes you were a "guest" on. :) -dave

1 0

Fully Automated CONOPs Exercise
by Dave Aitel 28 Jan '21

28 Jan '21

So one of my new fav questions to ask policy teams is what they would do if they were told to switch their offensive team entirely to worms. Nothing else. Just worms. What needs to change to make that happen - from op tempo to supply chain to personnel to policy and technological investment. And how would their defensive team need to change strategically if they were facing such an offensive team. It's a fun thing to see people wrap their minds around. :) Also, if you missed it, yesterday's CYBER HOT TAKES are here: https://www.youtube.com/watch?v=hzcmfIgvj7A&t=2s&ab_channel=DaveAitel -dave

3 3

"Severely lacking".
by Dave Aitel 20 Jan '21

20 Jan '21

Recently I read this post from Maddie Stone of Google's Project Zero: https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-re… . In particular, it has a bolded line of "*As a community, our ability to detect 0-days being used in the wild is severely lacking to the point that we can’t draw significant conclusions due to the lack of (and biases in) the data we have collected.*" which is the most honest thing I've read from the defensive community in a long while. Like I feel like it's a good idea to have as a reflexive habit the concept of "What am I looking directly at that I'm not seeing." As a kid I was obsessed with various elements of biology, despite not having the grades to show for it. But as an adult I wish I could go back in time and just blow my own mind with a few short things I've learned. Most of them are obvious in retrospect, such as the following: - Birds are dinosaurs - Genes sometimes travel in-between species, carried by bacteria that infect both of them - 40% of all animals are parasites - Metabolism (and cells) evolved before DNA - Energy Epochs <http://suvratk.blogspot.com/2017/07/olivia-judson-on-energy-expansions-of.h…> are useful predictive tools I mean, for most people on this list the same thing is true for hacking. For me these things might include: - State tables are more important than memory handling - Timing attacks are impossible to explain to people, so they never get fixed - Attack tools tend towards generics - It doesn't matter if they catch you, if they won't ever do the meta-analysis to put the larger picture together -dave

1 0

The Lost Decade of Security Metrics
by Dave Aitel 05 Jan '21

05 Jan '21

A thousand years ago I subscribed to the Security Metrics mailing list. Metrics are important - or rather, I think good decision making is important, and without metrics your decision making is essentially luck. But we haven't seen any progress on this in a decade, and I wanted to talk about the meta-reason why: Oversimplification in the hopes of scaling. There's a theme in security metrics, a deep Wrong, that the community cannot correct, of trying to devolve features in their datasets to a single number. CVSS is the most obvious example, but Sasha's VEP paper here ( https://www.lawfareblog.com/developing-objective-repeatable-scoring-system-…) demonstrates most clearly the categorical example of the oversimplification issue, one that all of FIRST has seemingly fallen into. If I took all the paintings in the world, and ran them through a neural network to score them 1.0 through 10.0, the resulting number would be, like CVSS, useless. Right now on the Metrics mailing list someone is soliciting for a survey where they ask people how they are using CVSS and how useful it might be for them. But the more useful you think CVSS is for you, the less useful it actually is being, since it can only lead you to wasting the little security budget you have. *CVSS is the phrenology of security metrics.* Being simple and easy to use does not make it helpful for rational decision making. If we want to make progress, we have to admit that we cannot join the false-positive and false-negative and throughput numbers of our WAF in any way. They must remain three different numbers. We can perhaps work on visualizing or representing this information differently, but they're in different dimensions and cannot be combined. The same is true for vulnerabilities. The reason security managers are reaching for a yes/no "Is there an exploit available" metric for patch prioritization is that CVSS does not work, and won't ever work, and despite the sunk cost the community has put into it, should be thrown out wholesale. -dave

4 3

"Is it done yet? Boom! Typey Typey!"
by Dave Aitel 31 Dec '20

31 Dec '20

Today is my last day at Immunity. I don't know what to say about it that everyone on this list doesn't already know or that isn't weighed down with embarrassing secrets. At its best Immunity was a family, but also a machine for producing absolute monsters, and not just in the technical arenas. Even when it came to project management, we dropped people in the deep waters of the Marianas Trench and expected them to build bioluminescence on the way down. Because of my history at the NSA, I always believed managers at Immunity had to be as technical or more as anyone in their tree. This is less being a manager than being a Dungeon Master but it's also the only way to grow Ogres. There's a scene in the West Wing when someone tells Donna that her job can't be where she grows into a person, and she says, "Why Not? Why can't it be that thing?" and for a lot of us at Immunity that rung true, with kids and divorces and entire new career fields. I sent one last email to the internal list, but at some level a lot of Immunity is spread out amongst the stars and I wanted to thank everyone at once. It was the honor of a lifetime to work beside you all. We did great things together. -dave

1 0

How many treadmills can you run on at once?
by Dave Aitel 17 Dec '20

17 Dec '20

I wanted everyone to browse here and enjoy this Microsoft Teams vulnerability: https://github.com/oskarsve/ms-teams-rce/blob/main/README.md I also enjoy the discussion <https://twitter.com/taviso/status/1336365194071535617?s=20> it has engendered when it comes to how to measure vulnerabilities that are "in the cloud" or via "Auto-update". It would be good to get clarity on these things. [image: image.png] Measurement is the first step of something else: intermediate analysis. I think we failed, as a community, when we accepted the premise that vulnerabilities could be flattened down to simple numbers, CVSS scores, VEP scores, whatever. Bugs are inherently complex and interlinked. Losing that is losing their essence - you lose the ability to think coherently about them. But if you follow any set of scoring guidelines for vulnerabilities, and the best ones are qualitative, like the Pwnie Awards, you know that even though a massive amount of effort has gone into mitigation, assessment, secure coding frameworks, education, and everything else that makes up the meta-SDL, we are flooded with bugs. The mitigations aren't working. The secure coding frameworks, aren't. For every bug we find and fix a dozen more are written by the developers we thought we trained. It is a natural response to try to hide from this knowledge of failure. To cook the CVE numbers. To take refuge in our stock prices. Let's write another blogpost about catching an APT and give it a funny insulting nickname. Unfortunately without intermediate analysis you cannot do higher level strategy. And the treadmill of the information security technology arena is beyond exhausting. An equally fast treadmill is running next to it for security policy and legal policy and another one for incident response. There's no intermediate analysis happening in any area, so we are left making strategy choices by random chance or luck or the occasional herculean effort. -dave

2 1

Kiroshi Optics
by Dave Aitel 11 Dec '20

11 Dec '20

https://twitter.com/JesseHeinig/status/1336913378564919297 https://twitter.com/ClipperChip/status/1337289319988473856 People seem to think you can use etymology as some clue to deciphering the cyberpunk and cyber philosophy in general. You can read a whole Thomas Rid book <https://www.amazon.com/Rise-Machines-Cybernetic-Thomas-Rid/dp/0393286002> on it, and it's weird when people stress "Cybernetics" as if they've found some long lost hieroglyphic clue when the reality of how everything cyber evolved is staring right at them in flickering neon lights. As Hunter S. Thomson said, "with the right kind of eyes you can go up onto the top floor of any Silicon Valley building and you can almost see the high-water mark. That place where the wave finally broke and rolled back." When I was 20, working at the NSA, I once attended a cypherpunk meeting in DC, with Diffie and others crowded into a brownstone somewhere in one of the nicer parts of the city. The cypherpunk motto is very simple, "Privacy is necessary for an open society in the electronic age. We cannot expect governments, corporations, or other large, faceless organizations to grant us privacy. We must defend our own privacy if we expect to have any. Cypherpunks write code. We know that someone has to write software to defend privacy, and we're going to write it." At 20, in my larval stage, I was so socially awkward that it wrapped around to blithe unfiltered ignorance. During introductions, when they asked me where I worked and I said, "The DoD", they asked me why. I shrugged, "'Cypherpunks write code', and there are are more at the NSA than you might think." And people got over it - I pestered people with technical questions later as I always do, and there were snacks. But everyone in that room was a fighter, striving against an unspoken force on the field we now know as cyber war. Although no genre is "about" anything, to some extent Cyberpunk novels have often had a keen awareness of analyzing what it means to be a human mind. The new game Cyberpunk 2077 is an excellent adaptation of this theme, and avoids playing the horrors of modern life for laughs - where GTA 5 leveraged its open world to poke fun at the system, and Red Dead Redemption allowed you to marvel at the world despite its failures, Cyberpunk 2077 drops you into the scene in first person as a rollercoaster of existential dread takes you on a fast paced journey into tasting every gritty philosophical sandgrain of losing what it means to be a human, to have a mind of your own. William Gibson has said, "Science Fiction is never about the future. It's always about the present." but he also said "The future is already here, it's just unevenly distributed." And in the same sense that chemistry is just really slow applied electromagnetism, Cyberpunk literature, and the new game is exactly that, is a story about how some place's future, Xinjiang's perhaps, is all of our futures. The way that brownstone living room was, if you had the right kind of eyes. -dave

1 0

Worth a listen on your morning drive
by Dave Aitel 11 Dec '20

11 Dec '20

https://www.youtube.com/watch?v=pyE29pX9HBE&feature=emb_logo&ab_channel=The… (text: https://www.internetgovernance.org/2020/11/13/hague-keynote-sovereignty-in-… ) Keynote by Milton Mueller, Professor at the Georgia Institute of Technology (Atlanta, USA) in the School of Public Policy. I lolled at this section which is so true it hurts: Since publishing that book I explored the concepts of sovereignty and cyberspace more deeply. I published a new paper developing an argument about the relationship between the two in International Studies Review last year. Sovereignty is a concept that needs to be rescued from international law, which works with a dead and mummified version of it. Most of what that discipline says about its application to the cyber domain is legally correct but totally useless for solving today’s governance problems. And most of them have no idea how to apply the concept to cyberspace other than to point out, endlessly, that physical layer devices can be assigned to a territory. """

1 0

Gratitude
by Dave Aitel 25 Nov '20

25 Nov '20

So because we are thankful for all the support of every attendee at INFILTRATE for the past ten years (Yes, TEN YEARS!), we are releasing a special featured speakers series for the end of the year. If you are signed up for INFILTRATE 2020, PLAGUE EDITION then you already got an email invite to the first viewing-and-Q&A session with Marco Ivaldi. These talks are great - something I can say because we do our standard INFILTRATE dry-run process with every speaker, and they are making the extra effort to add things to the slides that confused us. And unlike most online events, we are pre-processing the talks to give them crystal clear audio and visuals. We have a couple dozen slots left in our online webinar silo, so if you feel like you deserve and desire to attend the Viewing+Q&A , please let me know. Otherwise, we will release the talks "at some point in the near future". Thanks! Dave Aitel

1 0

Deana Shick on INFILTRATE ONLINE
by Dave Aitel 30 Oct '20

30 Oct '20

Happy Friday! For those of you who enjoy laughing at my video editing job or want to learn about how big companies do vulnerability management "at scale" or what the alternatives are to CVSS, we've recently published a new fifteen minute video: https://vimeo.com/473562240 . -dave

1 0

Things to Watch!
by Dave Aitel 19 Oct '20

19 Oct '20

It's MONDAY, and I wanted to send over the shorts we did with Chris Eng and Ben Edwards. I think there's a lot of value in a robust question and answer session with paper authors. Too often papers are supposed to stand on their own without any real discussion. (PHP IS DOUBLE PLUS UNGOOD) https://vimeo.com/457850389/373c907909 (CVSS, an INTRODUCTION TO FAIL) https://vimeo.com/454453494/330060fbb2 (XXE) https://vimeo.com/464273744 Right now I'm editing the next in the series, which I think you will like, which is a more in-depth discussion on vulnerabilities and prioritization and dinosaurs. -dave

1 0

Identity + Host
by Dave Aitel 21 Sep '20

21 Sep '20

Recently Thomas Dullien wrote a blogpost <http://addxorrol.blogspot.com/2020/07/the-missing-os.html> asking what the OS of the future really looks like, considering the computer of the future is a distributed mega-engine. I would, annoyingly, posit that the algorithms that make sense to understand in that world are those already implemented in the many species of social insects. In that sense, I think there are things missing from his list of the basics of what a datacenter computer contains. At some level, I think the right set of algorithmic support will undergo phase changes as you scale up, but still be viable at small scales: (see this new paper for a detailed example: https://www.biorxiv.org/content/10.1101/2020.08.20.259614v1) I will include Thomas's list below: - Some form of cluster-wide file system. - A horizontally scalable key-value store. - A distributed consistent key-value store. - Some sort of pub/sub message queuing system. - A job scheduler / container orchestrator. I would say some level of ID is missing - large-colony ants have Caste systems for a reason. I think people in general ignore ID because maybe you can make ID and security a micro-service on top of a pub/sub message queuing system? I'm not sure. But in general, the same thing is true for most security analysis systems sold today - they see an infection, they treat a computer/network as infected and respond appropriately. At Immunity/AppGate we've been trying to go the other direction - tying your security directly to your identity. AppGate SDP already does this for network services, but we've also expanded upon that by using a graph database, INNUENDO Agent, a custom Windows Kernel module, and a lot of other excitement to build automated response that looks at your ID as much as it does your computer: CONSTELLATION + AppGate SDP (3m) https://vimeo.com/431931225/add11f4230 CONSTELLATION vs. Ransomware (9m) https://vimeo.com/421712679/d4a1918354 CONSTELLATION vs. Robbinhood (11m) https://vimeo.com/417796331/bb0426f9fb -dave

1 0

R2 Browser Hacking Class Review
by Dave Aitel 13 Aug '20

13 Aug '20

Sometimes we review books on this list, but I spent last week, for seven days in a row, taking the R2-RingZer0-Amy-Burnett Browser Hacking <https://ringzer0.training/advanced-browser-exploitation.html> class. But before I do, I want to point out that 36 Minutes into this video ( https://vimeo.com/442583799) I ask Marco Ivaldi about what it's like to switch from management back into the technical field. "It's hard, but it's very rewarding." Here's my one top tip for making remote classes easier as a student: TURN YOUR FREAKING CAMERA ON. This forces you to pay attention to the trainer. Also: trainers do better when they can see if you are picking up the material. I like the remote format better in many ways than the in-person format. I like seeing everyone else's questions in the Discord. I like being able to take a big break during the day to get food and then come back to the exercises later and get real-time answers to my questions by Amy typing things up on her cellular phone at the local Troy bar. I like continuing to have lungs complete with working alveoli. Also, the Browser Hacking class is effective. Everyone in the class (I was quite nervous since I didn't even know Javascript and last wrote an exploit in 1992AD) can write Chrome and Webkit exploits now. This is a useful feature. Obviously the first half of the class is "This is the giant optimized data structure they invented to allow people to check Gmail super fast" and the second half is "this is what those bug-classes look like in source code, and how you build your exploit primitives and plug them together". I guess my summary is this: Great class. It is well worth the money just to feel the dragon inside you wake up and swallow something whole again. -dave (List Note: I have turned off bounce processing, since it was misfiring and kicking people off the list for no reason.)

1 0

Dino-VSS
by Dave Aitel 10 Aug '20

10 Aug '20

[image: image.png] Bistahieversor or MS08-067? If you had to list out the problems with CVSS it would be like analyzing the anatomical issues of a children's drawing. No part of it fits together properly. Here's a problem: Scoring of threats is not one dimensional, and numbers can't carry the whole story. We need a vulnerability scoring system that's extensible, and programable. But I have an alternative: Take each vulnerability attribute and assign it to a dinosaur part! Is it a client-side? Then it's got legs! Does it need user interaction? Then short stumpy legs. Is it a true remote against a service? Then it's got wings. Is it a root bug? Then it has a big mouth? User-level access? Duckbill. That way, the attributes of the vulnerability reflect themselves as a literal model - a denizen of your Cretatous nightmares. But it rings true - getting attacked by five hundred pre-auth XSS bugs in your web front-end is exactly like getting attacked by a horde of ducks. And of course, vulnerabilities can combine - a LPE + a remote user-level XSS + sandbox escape has legs and teeth. Modeling is better than scoring in every way. Maybe your network is a Animantarx <https://en.wikipedia.org/wiki/Animantarx>, a living citadel, but more likely you're a Diplodocus, a big bag of walking meat getting nibbled to death by ducks. -dave

1 0

WAF Metrics
by Dave Aitel 17 Jul '20

17 Jul '20

So I'm making a video on metrics, of all things, and I wanted to post both this question <https://twitter.com/daveaitel/status/1281629327776522242?s=20>and the best answer so far to the list to see if anyone had any other ideas or followups. -dave [image: image.png] [image: image.png]

7 9

WAFs: HTTP Desynchronization as a Metric
by Dave Aitel 13 Jul '20

13 Jul '20

So one thing people don't have any scope of measuring - (maybe as a set diagram finite states?) - is the difference between two parsers for the same protocol. Ten years ago a lot of the security community had a discussion about "LangSec <http://langsec.org/>" which turns out to have been entirely correct in retrospect. NCCGroup's recently released analysis of the F5 bug is a key example of this principle in action: https://research.nccgroup.com/2020/07/12/understanding-the-root-cause-of-f5… Most people look at HTTP Desync as simply using Content-Length confusion - figuring out ways to make one request look like it's not the same length, and using that for SSRF or XSS or various other attacks. But *ANY DIFFERENCE IN THE PARSERS* leads to critical level attacks. Of course, what this means is that you need to have different emulated parsers for each web server behind you depending on if they are Apache/IIS/NGinx . . . -dave

1 0

Brad gets real!
by Dave Aitel 07 Jul '20

07 Jul '20

https://www.youtube.com/watch?v=F_Kza6fdkSU So I wanted to highlight this talk from Brad Spengler about the state of Linux security. It's a damning report if you read even a little bit between the lines. And on many levels. As Halvar points out, Android deliberately avoided investing what they knew they needed to invest in platform security in the effort to gather significant early market share, even knowing it would harm their user-base in a multitude of ways. And this kind of philosophical trade off taken by companies filters into the Linux security ecosystem, creating Ogres of various sorts, like Calamity Gannon's corruption of various parts of Hyrule. For example, phones often run on an older Linux kernel, which means there is economic incentive to backport features and security fixes to those kernels, or pretend you can. Likewise, much of the effort of the Linux security community is focused on KASLR, which Brad points out, is largely a waste of time. He also talks about Syzkiller, automated exploit generation, and a host of other things. Well worth a listen! -dave

3 4

Data
by Dave Aitel 18 Jun '20

18 Jun '20

I wanted to highlight something that I find funny did not make a much bigger impact: DARPA's release of former INFILTRATE keynoter Bill Arbaugh's dataset of endpoint behavioral data. See here for more information: https://twitter.com/williamarbaugh/status/1273421101469753344?s=20 How else are you supposed to test if your Endpoint Protection DEEEEEEP LEARNING works or does not work, as advertised? My only complaints are: This is not as much data as I would want. You really do want at least a couple months of data. Everyone annoy DARPA about that. :) I don't speak for Immunity anymore, but it IS good to see those who do speak for Trail of Bits making themselves heard: https://blog.trailofbits.com/2020/06/17/advocating-for-change/ -dave

1 0

Code (library) economics
by Konrads Smelkovs 16 Jun '20

16 Jun '20

When I want to code something from scratch, I will often look for libraries that help me achieve it best regardless of language they are written - for common situations Python has a good ecosystem (but web interfaces don't look so great there anymore), if it's enterprise-y, most likely Java (which I'll use via Jython if I can help it), if it's Windows-ish - C# with WinApi calls. Weirdly RubyDNS/EventMachine is good for quick DNS shenanigans. I do this because I don't have an infinite amount of time to re-implement something in my *langage du jour*. Same holds true for people moving code for hacking operations. If an operator wants to search for specific data on a computer, I'm probably best off using Windows Search API and the easiest way to invoke it is via PowerShell <https://gist.github.com/arebee/1928da03047aee4167fabee0f501c72d> - about 20 lines of code seems to do it. I looked at my code for selectively exfiltrating Outlook mailbox contents and discovered it was a bit of OLE Interop code (again - PowerShell, but I concede that C# would be pretty close line-wise). We could of course bring OpenDLP package or ntfs raw copy the entire .ost, but that seems to be heavyweight. A parallel exists for EDRs as well - EDRs like to rely on cool Win8.1+ features and tell customers to upgrade their XP/7 and Win2k3 boxes or not have latest features - they don't want to re-implement same stuff 3 times and could you please have our .NET to 4+ kthx bye. (this is also why network traffic recorders are useful). You can see right now the fad for POC implants has moved away from C to C# to Golang, because all of this makes programmers more productive. as you're paid for operations not tool fetish, why write it in C? Sometimes doing stuff in non-C is harder. Over the last 2 months there's been an explosion of API unhooking articles thanks to great work by F-Secure (ex MWR) <https://labs.f-secure.com/blog/bypassing-windows-defender-runtime-scanning/> and so to keep up with the Joneses any decent toolkit needs now the ability to manipulate loaded libraries which perhaps excludes some choice of languages (I'm not quite sure how to achieve this in PS). Other code economics matter as well. When you're in shellcode territory, the crawl space is small. Once you're in "bootstrap" territory, you have more space (e.g. your Office macro that downloads the kit can be fairly meaty) and you have options to hunt for eggs (e.g. retrieve a hidden attachment from Outlook in which your macro came in). Once you're in the "I can run an exe/dll here" territory, 20 megs is nothing. In one report I read, hackers downloaded and installed VirtualBox to run their toolkit. I think Dave's INNUENDO ran to 40 megs. Once they were done, it was a matter of shutting down the encrypted VM - good luck with forensics. <retransmission> -- Konrads Smelkovs Applied IT sorcery.

1 0

Primordial Fire
by Dave Aitel 15 Jun '20

15 Jun '20

I've moved to a part time contract with AppGate and I'm focused largely on INFILTRATE now, which gives me some time to attend cyber policy briefings. Most cyber policy briefings are the same 200 people, and they tend to be held under Chatham House rules, which means they are not recorded and you can't quote anyone directly. I'm not sure why, since getting someone in Cyber Policy to say anything controversial is as impossible as getting them to think about any kind of change that doesn't involve giving more money to CISA, for some reason. As part of prepping for INFILTRATE, like many of you, I've been attending a suite of online security conferences, from SANS (Zoom+Slack), to Summercon (Youtube), to Matt Suiche's OPCODE <https://www.opcde.com/opcdex/> (Youtube) to today's ACM Program Analysis conference <https://www.youtube.com/watch?v=81V2ifmW-4c> (Youtube), still going on ! That program analysis conference is AMAZING btw. The first talk, by Peter O'Hearn <https://en.wikipedia.org/wiki/Peter_O%27Hearn> is on point, as he starts off with some high level lessons learned trying to transfer his academic work on static analysis into Facebook's efforts, then three quarters of the way through dives like a pelican into the depths of concurrency analytics theory. He talks about what worked and what didn't work and how to scale.... and I dunno how to explain it. It's just a nuclear sub of a talk, rising from the icy sea with advanced technology and primordial fire. INFILTRATE is not going to be a purely virtual conference. A lot of what you do at a good conference is have conversations you can't have over a Chinese teleconference system, sometimes with a beverage of choice. We're going to have a hybrid conference - there's some amazing things about virtual conferences but they're not everything, as I'm sure you're aware. I've also had time to try to catch up with the exploit firehose. This bug <https://github.com/guhe120/Windows-EoP/blob/master/CVE-2020-1281/CVE-2020-1…> in particular - an integer overflow in Variant processing in the core feature of Windows. That would have been an amazing 0day to have. Or maybe not? It's hard to know without writing the exploit, looking at the target space, testing a lot of things. Recently one of the people in a policy conference asked "What is it that makes a government different anyways?" And the answer, of course, is vertical integration. When you find an 0day, it's hard to know anything about it other than it gets you a shell! And there's so much to know - much of which you want to talk about over fried alligator with music just loud enough to keep recording devices guessing. -dave

1 0

FIRST TEST EMAIL WITH NEW SERVER
by Dave Aitel 05 Jun '20

05 Jun '20

HI THERE THIS IS A TEST EMAIL. -dave

1 0

2025

2024

2023

2022

2021

2020

Dailydave