- Dailydave - mm4.emwd.com

Dino-VSS
by Dave Aitel 10 Aug '20

10 Aug '20

[image: image.png] Bistahieversor or MS08-067? If you had to list out the problems with CVSS it would be like analyzing the anatomical issues of a children's drawing. No part of it fits together properly. Here's a problem: Scoring of threats is not one dimensional, and numbers can't carry the whole story. We need a vulnerability scoring system that's extensible, and programable. But I have an alternative: Take each vulnerability attribute and assign it to a dinosaur part! Is it a client-side? Then it's got legs! Does it need user interaction? Then short stumpy legs. Is it a true remote against a service? Then it's got wings. Is it a root bug? Then it has a big mouth? User-level access? Duckbill. That way, the attributes of the vulnerability reflect themselves as a literal model - a denizen of your Cretatous nightmares. But it rings true - getting attacked by five hundred pre-auth XSS bugs in your web front-end is exactly like getting attacked by a horde of ducks. And of course, vulnerabilities can combine - a LPE + a remote user-level XSS + sandbox escape has legs and teeth. Modeling is better than scoring in every way. Maybe your network is a Animantarx <https://en.wikipedia.org/wiki/Animantarx>, a living citadel, but more likely you're a Diplodocus, a big bag of walking meat getting nibbled to death by ducks. -dave

1 0

WAF Metrics
by Dave Aitel 17 Jul '20

17 Jul '20

So I'm making a video on metrics, of all things, and I wanted to post both this question <https://twitter.com/daveaitel/status/1281629327776522242?s=20>and the best answer so far to the list to see if anyone had any other ideas or followups. -dave [image: image.png] [image: image.png]

7 9

WAFs: HTTP Desynchronization as a Metric
by Dave Aitel 13 Jul '20

13 Jul '20

So one thing people don't have any scope of measuring - (maybe as a set diagram finite states?) - is the difference between two parsers for the same protocol. Ten years ago a lot of the security community had a discussion about "LangSec <http://langsec.org/>" which turns out to have been entirely correct in retrospect. NCCGroup's recently released analysis of the F5 bug is a key example of this principle in action: https://research.nccgroup.com/2020/07/12/understanding-the-root-cause-of-f5… Most people look at HTTP Desync as simply using Content-Length confusion - figuring out ways to make one request look like it's not the same length, and using that for SSRF or XSS or various other attacks. But *ANY DIFFERENCE IN THE PARSERS* leads to critical level attacks. Of course, what this means is that you need to have different emulated parsers for each web server behind you depending on if they are Apache/IIS/NGinx . . . -dave

1 0

Brad gets real!
by Dave Aitel 06 Jul '20

06 Jul '20

https://www.youtube.com/watch?v=F_Kza6fdkSU So I wanted to highlight this talk from Brad Spengler about the state of Linux security. It's a damning report if you read even a little bit between the lines. And on many levels. As Halvar points out, Android deliberately avoided investing what they knew they needed to invest in platform security in the effort to gather significant early market share, even knowing it would harm their user-base in a multitude of ways. And this kind of philosophical trade off taken by companies filters into the Linux security ecosystem, creating Ogres of various sorts, like Calamity Gannon's corruption of various parts of Hyrule. For example, phones often run on an older Linux kernel, which means there is economic incentive to backport features and security fixes to those kernels, or pretend you can. Likewise, much of the effort of the Linux security community is focused on KASLR, which Brad points out, is largely a waste of time. He also talks about Syzkiller, automated exploit generation, and a host of other things. Well worth a listen! -dave

3 4

Data
by Dave Aitel 18 Jun '20

18 Jun '20

I wanted to highlight something that I find funny did not make a much bigger impact: DARPA's release of former INFILTRATE keynoter Bill Arbaugh's dataset of endpoint behavioral data. See here for more information: https://twitter.com/williamarbaugh/status/1273421101469753344?s=20 How else are you supposed to test if your Endpoint Protection DEEEEEEP LEARNING works or does not work, as advertised? My only complaints are: This is not as much data as I would want. You really do want at least a couple months of data. Everyone annoy DARPA about that. :) I don't speak for Immunity anymore, but it IS good to see those who do speak for Trail of Bits making themselves heard: https://blog.trailofbits.com/2020/06/17/advocating-for-change/ -dave

1 0

Code (library) economics
by Konrads Smelkovs 15 Jun '20

15 Jun '20

When I want to code something from scratch, I will often look for libraries that help me achieve it best regardless of language they are written - for common situations Python has a good ecosystem (but web interfaces don't look so great there anymore), if it's enterprise-y, most likely Java (which I'll use via Jython if I can help it), if it's Windows-ish - C# with WinApi calls. Weirdly RubyDNS/EventMachine is good for quick DNS shenanigans. I do this because I don't have an infinite amount of time to re-implement something in my *langage du jour*. Same holds true for people moving code for hacking operations. If an operator wants to search for specific data on a computer, I'm probably best off using Windows Search API and the easiest way to invoke it is via PowerShell <https://gist.github.com/arebee/1928da03047aee4167fabee0f501c72d> - about 20 lines of code seems to do it. I looked at my code for selectively exfiltrating Outlook mailbox contents and discovered it was a bit of OLE Interop code (again - PowerShell, but I concede that C# would be pretty close line-wise). We could of course bring OpenDLP package or ntfs raw copy the entire .ost, but that seems to be heavyweight. A parallel exists for EDRs as well - EDRs like to rely on cool Win8.1+ features and tell customers to upgrade their XP/7 and Win2k3 boxes or not have latest features - they don't want to re-implement same stuff 3 times and could you please have our .NET to 4+ kthx bye. (this is also why network traffic recorders are useful). You can see right now the fad for POC implants has moved away from C to C# to Golang, because all of this makes programmers more productive. as you're paid for operations not tool fetish, why write it in C? Sometimes doing stuff in non-C is harder. Over the last 2 months there's been an explosion of API unhooking articles thanks to great work by F-Secure (ex MWR) <https://labs.f-secure.com/blog/bypassing-windows-defender-runtime-scanning/> and so to keep up with the Joneses any decent toolkit needs now the ability to manipulate loaded libraries which perhaps excludes some choice of languages (I'm not quite sure how to achieve this in PS). Other code economics matter as well. When you're in shellcode territory, the crawl space is small. Once you're in "bootstrap" territory, you have more space (e.g. your Office macro that downloads the kit can be fairly meaty) and you have options to hunt for eggs (e.g. retrieve a hidden attachment from Outlook in which your macro came in). Once you're in the "I can run an exe/dll here" territory, 20 megs is nothing. In one report I read, hackers downloaded and installed VirtualBox to run their toolkit. I think Dave's INNUENDO ran to 40 megs. Once they were done, it was a matter of shutting down the encrypted VM - good luck with forensics. <retransmission> -- Konrads Smelkovs Applied IT sorcery.

1 0

Primordial Fire
by Dave Aitel 15 Jun '20

15 Jun '20

I've moved to a part time contract with AppGate and I'm focused largely on INFILTRATE now, which gives me some time to attend cyber policy briefings. Most cyber policy briefings are the same 200 people, and they tend to be held under Chatham House rules, which means they are not recorded and you can't quote anyone directly. I'm not sure why, since getting someone in Cyber Policy to say anything controversial is as impossible as getting them to think about any kind of change that doesn't involve giving more money to CISA, for some reason. As part of prepping for INFILTRATE, like many of you, I've been attending a suite of online security conferences, from SANS (Zoom+Slack), to Summercon (Youtube), to Matt Suiche's OPCODE <https://www.opcde.com/opcdex/> (Youtube) to today's ACM Program Analysis conference <https://www.youtube.com/watch?v=81V2ifmW-4c> (Youtube), still going on ! That program analysis conference is AMAZING btw. The first talk, by Peter O'Hearn <https://en.wikipedia.org/wiki/Peter_O%27Hearn> is on point, as he starts off with some high level lessons learned trying to transfer his academic work on static analysis into Facebook's efforts, then three quarters of the way through dives like a pelican into the depths of concurrency analytics theory. He talks about what worked and what didn't work and how to scale.... and I dunno how to explain it. It's just a nuclear sub of a talk, rising from the icy sea with advanced technology and primordial fire. INFILTRATE is not going to be a purely virtual conference. A lot of what you do at a good conference is have conversations you can't have over a Chinese teleconference system, sometimes with a beverage of choice. We're going to have a hybrid conference - there's some amazing things about virtual conferences but they're not everything, as I'm sure you're aware. I've also had time to try to catch up with the exploit firehose. This bug <https://github.com/guhe120/Windows-EoP/blob/master/CVE-2020-1281/CVE-2020-1…> in particular - an integer overflow in Variant processing in the core feature of Windows. That would have been an amazing 0day to have. Or maybe not? It's hard to know without writing the exploit, looking at the target space, testing a lot of things. Recently one of the people in a policy conference asked "What is it that makes a government different anyways?" And the answer, of course, is vertical integration. When you find an 0day, it's hard to know anything about it other than it gets you a shell! And there's so much to know - much of which you want to talk about over fried alligator with music just loud enough to keep recording devices guessing. -dave

1 0

FIRST TEST EMAIL WITH NEW SERVER
by Dave Aitel 05 Jun '20

05 Jun '20

HI THERE THIS IS A TEST EMAIL. -dave

1 0

2025

2024

2023

2022

2021

2020

Dailydave