Application Security Weekly #160

Announcements

• CyberRisk Alliance, in partnership with InfraGard, has launched the Critical Infrastructure Resilience Benchmark study. Measure your readiness for ransomware by completing the survey and getting your score. Visit https://securityweekly.com/CIRB to take the survey

• SC Media debuts its all-new SC digital experience, fully integrated with Security Weekly podcast content and more. The new site increases the scope and scale of original content resources from editorial staff, contributors, and the far-reaching CyberRisk Alliance network. Visit www.scmagazine.com to check out the new look!

Guest

Maggie Jauregui

Offensive Security Researcher at Intel

Maggie Jauregui is a firmware and hardware security researcher for Intel’s Programmable Solutions Group. Maggie is part of the Black Hat USA review board and President of Security BSides Portland, the non-profit organization that puts together BSidesPDX. Throughout her career, Maggie has presented her research and delivered technical training on firmware and low level platform security topics at conferences such as DEF CON, Black Hat, CanSecWest, DerbyCon, NULLCON, hardwear.io, OSFC, and BSidesTLV.

Hosts

Mike Shema

Tech Lead at Block

John Kinsella

Senior Engineering Leader at AWS

@jlk_

Announcements

• Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.

• In an overabundance of caution, we have decided to flip this year’s SW Unlocked to a virtual format. The safety of our listeners and hosts is our number one priority. We will miss seeing you all in person, but we hope you can still join us at Security Weekly Unlocked Virtual! The event will now take place on Thursday, Dec 16 from 9am-6pm ET. You can still register for free at https://securityweekly.com/unlocked.

Hosts

Mike Shema

Tech Lead at Block

1. 1. Reboot of PunkSpider Tool at DEF CON Stirs Debate
   Here's a tool that scans for web vulns and makes the results available to anyone. In fact, it's the second time around for this tool. Even if the tool is new and improved, what about the ecosystem it's operating in? This is a chance to talk about the ways to prepare for a bug bounty and where engineering investments are needed to make the web more secure. Spoiler: it's probably not the decades-old approach of shouting about vulns into the void.
2. 2. A new chapter for Google’s Vulnerability Reward Program
   There's an perennial type of appsec article about how much money companies have spent on a bounty program. Bounty programs can be good investments, but their goal isn't exactly to reach a high score. Here's a baseline from Google, which spent roughly $3,000 per vuln over 10 years. But more important is how they've grown the scope of targets and maturity of the program to cover emerging technologies and some open source projects. Head over to https://bughunters.google.com for a peek at preferred targets. Two that stand out are Fuchsia OS (https://fuchsia.dev/fuchsia-src/concepts/principles/secure) and Envoy (https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/google_vrp).
3. 3. Stray GitHub access token from Shopify earns novice bug bounty hunter $50k
   "Most or All" isn't a very reassuring phrase to have to use in response to how much the security of a company's app is impacted by a bug bounty report. Nor does it help that the mistake was relatively straightforward to identify. But what does help is having a successful interaction with a researcher and an appsec team willing to be transparent about how they respond to and handle security events. It's also a great reminder of the importance of observability and logging for your apps -- there's a big difference in having confidence that unauthorized access hasn't been abused vs. crossing your fingers and hoping for the best. Check out the brief writeup and interaction with Shopify's appsec team at https://hackerone.com/reports/1087489
4. 4. Zimbra 8.8.15 – Webmail Compromise via Email
   This may not be the most exciting target out there, but it's a great educational writeup of XSS and SSRF flaws in the wild. It's also a good lesson (once again, sigh...) of the subtle security issues that can arise from attempting to sanitize HTML and how to combine security issues into attacks with more consequential impacts.
5. 5. Potential remote code execution in PyPI
   The blog post sets the stage early: "There was a vulnerability in GitHub Actions of PyPI’s repository, which allowed a malicious pull request to execute an arbitrary command. This allows an attacker to obtain write permission against the repository, which could lead to arbitrary code execution on pypi.org." Then it goes into details about the flaw and how an attack would (or wouldn't) work. It's another educational writeup and ties into the evergreen theme of supply chain security.
6. 6. Kernel Pwning with eBPF: a Love Story
   We continue a conversation on a common weakness: out of bounds reads and writes. Here's some code whose bitwise ops went sideways on 32-bit values and could lead to command execution. It's a relatively long article that lays out the fundamentals of eBPF before going into the details of finding and exploiting the flaw. Even if kernel hacking isn't your thing, read the first part to understand the principles behind eBPF and how they contribute to security boundaries.
7. 7. Top Routinely Exploited Vulnerabilities
   We just talked about the CWE Top 25 for 2021 in last week's episode. Now CISA is out with the top vulns they've seen exploited for the past year or so. While the focus is slightly different -- CISA highlights specific apps as opposed to weakness -- there's plenty of overlap in terms of what has made those apps insecure. It also seems like another opportunity to talk about patching, threat models, and what kind of influence the specter of "zero-day" should have on both.
8. 8. We need to talk about testing
   If you approach the purpose of testing with the question, “What could possibly go wrong?”, then you're on your way to security-minded thinking and threat modeling. This article goes through several motivations for testing and its importance in conveying confidence in the app's behavior to various stakeholders, including security.

John Kinsella

Senior Engineering Leader at AWS

@jlk_

1. 1. Web applications have become a security liability
   On a previous episode, we discussed a little about if the current focus in application security should be in "legacy" applications, or more around webapp. A study out from F5 and The Cyentia Institute thinks the focus should be more on the webapp side...