Authz Bypass in Oracle Cloud, Chrome Prototype Pollution, Why Security Products Fail – ASW #213

Announcements

• Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.

• Do you have a specific guest or topic that you want us to cover on one of the shows? Submit your suggestions for guests by visiting https://securityweekly.com/guests and completing the form! We review suggestions monthly and will reach out to you once reviewed!

Hosts

Mike Shema

Tech Lead at Block

1. 1. Notice of Recent Security Incident
   In brief: protect developer endpoints with strong MFA implementations like FIDO2 security keys.
2. 2. AttachMe: critical OCI vulnerability allows unauthorized access to customer cloud storage volumes
   Ouch. The Wiz research team turned their eyes towards Oracle cloud and found a simple, and highly critical, authorization bypass.
3. 3. Twitter discloses it wasn’t logging users out of accounts after password resets
   Working through the security model of login flows -- including account recovery and credential rotation -- requires more discussion than just the type of MFA to support.
4. 4. Tarfile path traversal bug from 2007 still present in 350k open source repos
   Of course this one has to be covered. It's path traversal in Python that's been around for 15 years. Read the research at https://www.trellix.com/en-us/about/newsroom/stories/research/tarfile-exploiting-the-world.html
5. 5. Prototype pollution bug in Chromium bypassed Sanitizer API
   This is a good chance to talk about security boundaries, where to place them, and what their expectations should be for bugs and features.
6. 6. Sony Reintroduced a PS4 Bug on PS5 Which Could Have Led to a Jailbreak
   We've been talking about testing a lot lately, specifically unit and functional testing by developers. This isn't the first time a vuln has been reintroduced, so it's always useful to ask how the fix for the original vuln was tested and how that test was (or wasn't) carried forward through the software's evolution.
7. 7. Why do security products fail?
   Our think piece for the month, which highlights toil, poor UX for devs, and lack of value (aka measurable effectiveness) in security solutions.

John Kinsella

Co-founder & CTO at Cysense

1. 1. Is a Rust rewrite really worth it?
   p99 conf is coming up, and TNS offers a preview of 2 talks which talk through the experience of rewriting code into rust.
2. 2. Does web3 really need it’s own bug bounty platforms?
   TC covered the series A funding of Immunefi, a bug bounty platform for web3 (apparently one of many). But the question that this brings to me: do we really need a separate bounty platform?
3. 3. bgp attack results in $235k crypto loss
   I don't think historically we've seen many bgp attacks have direct financial consequences, but as we have a more automated world and things like the web3 space, these attacks can become more and more costly
4. 4. How to bypass cloudflare bot management
   Great article that digs into figuring out how cloudflare attempts to protect against bots, and how to navigate around those protections
5. 5. So some companies prefer to use less popular languages…
   Interesting article that's on a career site: Many large financial institutions like to use either their own, or public but less popular languages? GS: Slang MS: A+ Bridgewater supossedly has their own thing Jane Street: OCAML unexpected, but interesting...

Tyler Robinson

Director of Offensive Security & Research at Trimarc Security, Founder & CEO at Dark Element

trob#6466

http://darkelement.io/