- Dailydave - mm4.emwd.com

General Relativity is Not Evenly Distributed
by Dave Aitel 11 Feb '22

11 Feb '22

[image: image.png] If cities were 100% accurately represented by video games, Miami would of course be *GTA: Vice City*, a story of simplistic corruption garishly lit and stuck in 2002 forever. It's traditional to hate on Miami, right until you make some crypto money and decide to move there into a condominium with a stunning view and an equally stunning lack of maintenance or foresight around rising water tables. Seattle, on the other hand, is *Cyberpunk 2077*, a city run by cybernetically enhanced corpos who get to work by walking past endless discarded refuse and homeless tent cities heated with literal barrel campfires - on my way to the airport yesterday we drove through some thick fog, which the Uber driver explained to me was just "a fire under the bridge" with the same level of casual interest he would apply to a sale at a JC Penny's. Traveling between these two cities imposes arbitrage costs on your consciousness itself, extracting profit from your inability to look away from what seems like an obvious oncoming disaster. What happens when the ocean goes up another foot, and nobody can get flood insurance? you ask yourself, as people around you wave you off. How come such a progressive city can't serve its people's needs, or at the very least pick up their trash? you wonder, while running past a well worn armchair next to the freeway that, rain or shine, serves as someone's impromptu throne. While the humanity in you rages against the system, the hacker in you realizes that knowing the past and processing it to produce the future can be as useless and predictable as an earthworm's digestion. Hackers live in a realm between spaces and times, looking at the hidden connections and occasionally playing a chord on the threads. -dave

1 0

Cyber Threat Intelligence vs Megafauna
by Dave Aitel 07 Feb '22

07 Feb '22

https://twitter.com/SecurePeacock/status/1486156096259637250?s=20 [image: image.png] So I wanted to respond to this post which starts "If someone exploits an 0day they still have to setup C2 - this is where TTPs are generated that Blue Teams can win against". And I think for the past year I've gone on a huge journey of discovery, annoying my Cyber Threat Intelligence friends to no end as I ask annoying questions like "After you put some random non-googlable name up, like PLATINUM, can you just add a little flag so I know what country you're talking about?"" [image: image.png] (Argh. The whole point of codenames is they are UNIQUE and easy to search for. This is like naming your OS "Windows" I guess.) Anyways, imagine if seventeenth century biologists were reporting to the newly established Royal Society and they were talking about counting all the animals and doing studies on animals and of course what they used to do that were the various animals that kings and whatnot had gotten stuffed and sent to them. I feel like you would find out that almost all animals had fur and were easily shot by muskets or stabbed with spears! I guess my point here being: Cyber Threat Intelligence is in a very hard place right now, despite soaring revenues and many exciting trophies on the wall. What you hear, over and over again, is that yes, detecting exploitation is hard, but you will be able to detect "lateral movement" and see the command and control traffic, and when attackers need to "accomplish their mission" they will therefore be detectable. And this is true - for some missions, and for some operational concepts <https://cybersecpolitics.blogspot.com/2020/05/asynchronous-command-and-cont…> that accomplish those missions. But we fail when we don't consider other operational concepts and other missions. Apparently we call the many reasons we fail to turn data into warnings and then into action: "pathologies". Good marketing from XDR companies is a pathology in this space. And that pathology goes to the highest levels - when we have leaders in govt say "We don't see any serious Log4J exploitation" we have to think "Wait, we have almost no visibility for Unix targets though". Even when we have the right telemetry, we don't have the right analysis. I like to probe our pathologies with annoying questions: - What percentage of worms do we see? - What happens when people don't use a C2 but just drop an implant? - Who are the hacker groups focusing only on Unix? - What percentage of 0day do we really even find? - Are we looking only at our adversary's actions, or also our own to make trendlines? But more than that, we are not self-conscious in the way that we should be about our own analytical pathologies. This is because our academic structure for peer review and everything else in this space is pretty busted. Anyways, there's more to the world out there than just lions and antelope and espionage RATs. To see the really interesting things you need a microscope, and the kind of eyes that want to squint through the lenses of microscopes we haven't even built yet. -dave

2 1

RootedCON 2022 Call For Papers is open!
by omarbv＠riseup.net 17 Dec '21

17 Dec '21

______ _ _ ____ ___ _ _ / / _ \ ___ ___ | |_ ___ __| |/ ___/ _ \| \ | | / /| |_) / _ \ / _ \| __/ _ \/ _` | | | | | | \| | / / | _ < (_) | (_) | || __/ (_| | |__| |_| | |\ | /_/ |_| \_\___/ \___/ \__\___|\__,_|\____\___/|_| \_| *** /RootedCON'2022 - Main activity *** -=] About RootedCON RootedCON is a technology congress that will be developed in Madrid (Spain) from 10 - 12 of march 2022. With an estimated seating from 2.500 to 3.000 people, is the most relevant specialized congress that is held in the country, and one of the most relevant in Europe, with attendee profiles ranging from students, Law Enforcenment Agencies to professionals in the technology and information security market and, even, just passionate people. This is our XII edition, after the restrictions pause. And as in every edition, we want it to make it special :) -=] Talk types We will mostly accept two kind of talks: - Fast talks: 20 minutes. - Standard talks: 50 minutes. There will exist a limited number of talks of both types having, even, the possibility of working with the schedule to extend a talk beyond the 20 minutes limit, or to reduce a 50 minutes one. We encourage you to BE ORIGINAL with your proposals. We accept *rare* talks and thematic, on culture or politics (always orbiting around the concepts technological or Information Security). -=] International speakers There is simultaneous Spanish-English and English-Spanish translation on all tracks, so please do not hesitate to inscribe a talk, wherever you are from :) Be sure to indicate the language in which you will give it: [ES] - Spanish [EN] - English =] Topics we are looking for Any interesting topic related to TECHNOLOGY, having examples below and not limited to: - ANY original topic that contributes content to our audience! - APT, botnets and malware. - Obviously, ransomware! - BIO Hacking and alternative disciplines - Any hacking topic in any environment: IP, OT, IoT, Cloud, EDGE, Satellites, Mobiles... - Reverse engineering, debugging, hooking, fuzzing, exploiting, DFIR,... - Financial Tech (FinTech) - Hardware Hacking, Jtag, SWJ, Dap, consoles,... - Videogames, cheats... - Cryptography, steganography, covert channels,... - DEV/SEC/OPS. - DEV: MQTT, AMQP, development patterns, distributed development, CI/CD... - OPS: puppet, jenkins, orchestration, virtualization and containers, artifacts,... - Culture, philosophy and ethics, future, innovation ... the world! -=] Talk submission procedure We will only accept talks submitted throught the official speaker form: https://cfp.rootedcon.com/ (both english and spanish) Any other talk submission will be considered "unofficial" and will not have any guarantee in being selected. -=] Speaker benefits and privileges Every speaker will get these benefits and privileges: - ONE extra ticket for a partner (1 ticket) to attend the event. - Diner with all the speakers, RootedLABS trainees, sponsors and the RootedCON team. - Accommodation (RootedCON carries with the costs, even the partner) - Travelling (RootedCON carries with the speaker's costs) - Full access to all congress areas all the event long. - The possibility of repeating the speech up to three times, one in every track (depending of the final rating). - Some free drinks in the party :) - Potential job offers management. - A gift from the organization. -=] Obligations and duties of the speaker All speakers that inscribed a talk and get selected must: a) Confirm that the talk is TECHNICAL and it is supported with Proof of Concepts (PoC). If PoC are not available, it should be justified.

1 0

Some cool projects - JOERN
by Dave Aitel 09 Dec '21

09 Dec '21

Lately all I've been doing is data science but I've been trying to keep up with some of the cool work happening in the cybers as well. One project I think is especially cool is the Joern Ghidra2CPG project. https://twitter.com/fabsx00/status/1466302205019971586?s=20 https://joern.io/blog/joern-supports-binary/ The theory is that you can use the Ghidra decompiler, then have a code property graph, which they store in a special purpose in-memory graph database (that should probably be ported to A REAL GRAPH DATABASE). Then you can make queries in scala (ugh) against that DB to find bugs. One example is here: https://github.com/joernio/query-database/blob/main/src/main/scala/io/joern… Has anyone else tried using this? It'd be cool instead of doing source sink to do clustering and missing link analysis and MLlib against the graph database. Also a real graph db might be able to scale better... but regardless, this is the kind of cool project I hoped to see when Ghidra first came out! This paper as well seems quite relevant: https://twitter.com/0xadr1an/status/1466518964029169672?s=20 The Convergence of Source Code and Binary Vulnerability Discovery – A Case Study https://www.s3.eurecom.fr/docs/asiaccs22_mantovani.pdf -dave

1 0

Active Directory - a clear and present danger
by Dave Aitel 26 Jul '21

26 Jul '21

So I definitely have a different mental history of active directory than most people, and recently I was doing a Glasshouse podcast with Pablo Breuer <https://www.linkedin.com/in/pablobreuer/> and here <https://youtu.be/Z0d6qNLevUY?t=2714> he says basically the same thing everyone says, which is that it's impossible to move off of technology even when that technology has a history of severe flaws, or a design flaw that means it cannot be secured. This is the current mental stance among CIOs familiar with large companies, or even medium size companies! And I get it! But if leopards keep eating your face, and every hacker in the world keeps recommending you stop giving them a cuddle, and you say "I can't, I have legacy systems in my head that love to hug large dangerous cats" then that stops being the government's problem, in a way. Like when people ask why Cyber Insurance Markets are obvious catastrophic failures, and we point at how they can't really change any meaningful behavior, and they have to insure the total market value of whatever company they are insuring because the cost of risk is basically a sliding scale of whatever the Russian ransomware team thought up that morning over kasha, then everyone gets that surprised face and it's all very annoying. So anyways, that brings us back to AD. AD is a system where any time you hack any computer on the network, you can become the domain controller, and own the whole company. That's just how it works. Every hacker/penetration tester has known that for two decades and the specific incantation on how you do that changes slowly over time, but it's always true. And then at INFILTRATE one year two Microsoft Research team members demonstrated an automation of the lateral movement piece which is now what Bloodhound <https://mcpmag.com/articles/2019/11/13/bloodhound-active-directory-domain-a….>is. So in theory everyone knows this right now, even though they like to blame EternalBlue for all their problems in life. But when you point that out on Twitter <https://twitter.com/dinodaizovi/status/1418909301746327559?s=20>, people ask you what the alternative is, and I have to admit I disagree with DDZ that it's "Zero Trust". That sounds like adding more complexity to a system that is already SO COMPLEX even lifetime specialists not named James Forshaw don't understand the BASICS of the authentication system. Like here's a paper <https://twitter.com/DebugPrivilege/status/1418884269376671755?s=20> that came out today that's in my queue all about Service credentials, and look - no matter how many new auditing tools or visualization thingies or AI anomaly detection alerts you deliver to your customers, if the underlying system is NOT UNDERSTANDABLE BY HUMANS then you can't secure it. I guarantee you that about 80% of the Russian ransomware affialiates understand Service Credentials and delegation better than your current AD management lead. Most of the time your AD ACLs are just you fooling yourself that you have a security boundary where you, in fact, don't. Also, the problem is not NTLM. Everyone stop talking about NTLM. It wouldn't matter if AD was re-implemented to use purely quantum key exchange because only Gandolf can mentally visualize the transitive trust structures implicit in how you configured your AD Forests. Ok so that brings us back to: What do you do instead? And honestly, I don't know. I've enjoyed reading the snippets that Grapl Security <https://www.graplsecurity.com/> has been posting about their setup. As far as I can gather, the TL;DR is just use Google as your directory server and use Chromebooks as much as possible. This is what I do right now - but I'm not sure how scalable this is. Maybe y'all can pitch in on this thread and suggest a solution? Thanks, Dave Aitel

4 3

"Hack the Planet"
by Dave Aitel 20 May '21

20 May '21

[image: image.png] Ok ya'll - you're letting me down. There's a thousand ways you and your friends can use 10k to improve the world - engineering a solution nobody would pay for because it's not something you can put at a booth at RSAC. EVERYONE ON THIS LIST needs to either submit for a grant, or find someone who will submit for a grant. You're telling me not one of those superhackers at Microsoft and Google can find a worthy project? It's Thursday, and there's 5000 people on this list, each of which can destroy whole systems of the world with their minds, but actually all I want now is for them to work up the energy to fill out this google form <https://nostarchfoundation.org/apply-now/>. I have a whole team of very cool people <https://nostarchfoundation.org/our-board/> waiting to help walk you through the process once you do. And the grant recipients that get selected are also going to get mentored by experienced members of the field - the head of the mentorship committee <https://en.wikipedia.org/wiki/Fred_Davis_(entrepreneur)> started a little zine back in the day called Wired and knows basically EVERYONE, and I think the mentorship alone should convince you to submit a grant request. Anyways, typey typey. Get to it. :) -dave P.S. Here's one of last year's submissions <https://nostarchfoundation.org/grant-recipients-by-year/2020-grant-recipien…>, which I quite like. [image: image.png]

1 0

Plausible.
by Dave Aitel 11 Apr '21

11 Apr '21

A while back I was chatting with someone at INFILTRATE, over fried alligator and more alcohol than I probably should have imbibed, and he said, "We're going to make fuzzing obsolete, because we have more CPUs on the problem than anyone can reasonably duplicate, and we're going to exhaust the space". And it's PLAUSIBLE in a way. I've watched a few of the live streams that Brandon Falk does, and you can see how like, for a certain subset of problems throwing more CPU and Power than Zeus at the fuzz problem might actually drain the oceans we all swim in. But lots of plausible stuff is still dead wrong. I spun up a private fuzzer a few weeks ago with some random test harness and popped a bug[1] in a popular browser almost by mistake. Now I'm spending hours and hours pouring over C code trying to find the root cause so I can control it, which since I am so out of practice is not unlike a coal locomotive trying to drive down one of the new Boring Company tunnels, coughing black oily smoke all over those shiny white Teslas. How do you install Ctags again? If you're bored, this Sunday, or any Sunday, you can watch this talk on CONOPS I put together, after spending too much time reading bad cyber policy papers: https://youtu.be/6l28f_x54gM . It might be related, it might not. The world is unknowable, like the results of a fuzzer. Some part of all of this is a lesson that when it comes to bug finding, it's not only ok to be different - to be from a different era, or to think in a different way - it's almost required. Team BigCorp can spin up all the VMs in the world, and if they don't love the same bugclasses you do, they will have optimized away from finding the bugs you find. Also, I want everyone to help publicize this so we can change the world for the better, even if just a bit. Send it to your friends! Think of cool things to do with it! https://twitter.com/NSPFoundation/status/1379849502199144449?s=20 -dave [1] a3ca63d4929c08a18c4418e039557e6d lol, I had trouble getting this hash but in the process found out it hits the default Windows 10 Home (not Pro, because Dwizzle hasn't sent me that yet) as well.

1 0

News Roundups!
by Dave Aitel 01 Feb '21

01 Feb '21

So lately I've been doing little news roundups on the YouTubes.... Yesterday's is here: https://youtu.be/xgiymt_0isY Neal Stephenson, in his most recent book, *Fall*, had a character that was an interesting play on the traditional fantasy "giant" in the sense that she was normal size, but fractally dense. I feel like we are living that kind of time - in the sense that gravity is really a measure of how much stuff is happening at any given place! Anyways, smack that subscribe button the way you hit enter on Bl4sty's sudo exploit on a those Linux boxes you were a "guest" on. :) -dave

1 0

Fully Automated CONOPs Exercise
by Dave Aitel 28 Jan '21

28 Jan '21

So one of my new fav questions to ask policy teams is what they would do if they were told to switch their offensive team entirely to worms. Nothing else. Just worms. What needs to change to make that happen - from op tempo to supply chain to personnel to policy and technological investment. And how would their defensive team need to change strategically if they were facing such an offensive team. It's a fun thing to see people wrap their minds around. :) Also, if you missed it, yesterday's CYBER HOT TAKES are here: https://www.youtube.com/watch?v=hzcmfIgvj7A&t=2s&ab_channel=DaveAitel -dave

3 3

"Severely lacking".
by Dave Aitel 20 Jan '21

20 Jan '21

Recently I read this post from Maddie Stone of Google's Project Zero: https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-re… . In particular, it has a bolded line of "*As a community, our ability to detect 0-days being used in the wild is severely lacking to the point that we can’t draw significant conclusions due to the lack of (and biases in) the data we have collected.*" which is the most honest thing I've read from the defensive community in a long while. Like I feel like it's a good idea to have as a reflexive habit the concept of "What am I looking directly at that I'm not seeing." As a kid I was obsessed with various elements of biology, despite not having the grades to show for it. But as an adult I wish I could go back in time and just blow my own mind with a few short things I've learned. Most of them are obvious in retrospect, such as the following: - Birds are dinosaurs - Genes sometimes travel in-between species, carried by bacteria that infect both of them - 40% of all animals are parasites - Metabolism (and cells) evolved before DNA - Energy Epochs <http://suvratk.blogspot.com/2017/07/olivia-judson-on-energy-expansions-of.h…> are useful predictive tools I mean, for most people on this list the same thing is true for hacking. For me these things might include: - State tables are more important than memory handling - Timing attacks are impossible to explain to people, so they never get fixed - Attack tools tend towards generics - It doesn't matter if they catch you, if they won't ever do the meta-analysis to put the larger picture together -dave

1 0

2025

2024

2023

2022

2021

2020

Dailydave