Fuzzing Like It’s 1999 – ASW #178

The log4j vuln remains a high-profile event that is as much due to the pervasiveness of affected Java deployments as it is the shifting status of the vuln's apparent impacts. Having to patch the patch and trying to figure out how to prioritize the latest vuln information is challenging for situations like this when teams might already be feeling burned out by the initial response exercises they had to go through. For now, it seems like 2.15.0 plus disabling the Lookups feature remains the safest immediate course of action, with deploying to 2.17.0 as the preferred version to get to as part of your regular release schedule. This is also a chance to repeat the caution to avoid falling into a reactive "BugOps" practice where you're only chasing the most up-to-date info about a specific package (log4j) instead of having a strategic approach to application hardening and network controls that could give you more breathing room by reducing the potential impact of such bugs. And, of course, it's an annual reminder of how important an app asset inventory is -- even though maintaining an accurate one isn't simple to do. Find out more details about the various exploit techniques, underlying vulns, and presence of log4j in these additional articles: - https://www.blumira.com/analysis-log4shell-local-trigger/ - https://www.fastly.com/blog/new-data-and-insights-into-log4shell-attacks-cve-2021-44228 - https://security.googleblog.com/2021/12/understanding-impact-of-apache-log4j.html

There are basically three things to investigate for any outage - Is there a DNS problem? - Did we make a config change? - Is us-east-1 down? This postmortem from AWS describes their recent us-east-1 outage. While the outage itself was not the byproduct of a breach or security event, it's a good reminder that availability in the CIA triad is a security topic for appsec and DevOps teams to create threat models for. It's also a good reminder that even if your apps are resilient to outages, your internal tooling and messaging might not be. When an outage like this impacts your ability to authenticate or communicate, it's important to evaluate how that impacts your org and what you should do about it.

There's more to appsec than supply chain issues! (We had the high profile event at the end of 2020 that every still talks about, the one that rhymes with polar fins. And 2021 is ending on the spectacularly unpleasant realization about how logging text leads to data exfiltration and deserialization attacks in Java.) Here's a very deep dive into hardware security concepts and a detailed review of the state of FPGA security and analysis. As we've said before, you don't have to be a hardware expert or even working on hardware to benefit from reading about these topics. Reading about how other disciplines create and handle threat models can be inspiration for your own apps. At the very least, it's a good way to learn from others about how to communicate and explain technical topics -- that's a skill that serves appsec well.

Nothing too exciting or insightful to cover on this article. It does, however, provide a data point on bug bounty payouts, which is something we've touched on throughout the year. As a reminder, a bug bounty program shouldn't be the first step in your appsec program. But when your program does reach a mature enough state to have resolved most obvious issues and can triage incoming reports, learning from other programs is useful to designing your own.

We'll close the year with another article from Phil Venables. This time it's an update on "megatrends" that should be informing an org's risk management. While they might not all be relevant to your org, the callouts on "the API Economy" and "Complexity Management" are more than likely universally applicable. This articles doesn't go into depth on these areas or how they could be addressed, but that's not its goal -- it's highlighting areas that should be considered within your strategic planning as you look ahead to a new year of your appsec program, threat modeling, and addressing attack classes.

I'm going to highlight these crypto coin articles over coming weeks. There's an ongoing (and increasing) trend of both blockchains as well as crypto exchanges getting hacked. As the "future" of finance - it's not a good look.