PunkSpider, Bug Bounties, RCE in PyPI, Kernel Pwning With eBPF, & Top Vulns From CISA – ASW #160

Here's a tool that scans for web vulns and makes the results available to anyone. In fact, it's the second time around for this tool. Even if the tool is new and improved, what about the ecosystem it's operating in? This is a chance to talk about the ways to prepare for a bug bounty and where engineering investments are needed to make the web more secure. Spoiler: it's probably not the decades-old approach of shouting about vulns into the void.

There's an perennial type of appsec article about how much money companies have spent on a bounty program. Bounty programs can be good investments, but their goal isn't exactly to reach a high score. Here's a baseline from Google, which spent roughly $3,000 per vuln over 10 years. But more important is how they've grown the scope of targets and maturity of the program to cover emerging technologies and some open source projects. Head over to https://bughunters.google.com for a peek at preferred targets. Two that stand out are Fuchsia OS (https://fuchsia.dev/fuchsia-src/concepts/principles/secure) and Envoy (https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/google_vrp).

"Most or All" isn't a very reassuring phrase to have to use in response to how much the security of a company's app is impacted by a bug bounty report. Nor does it help that the mistake was relatively straightforward to identify. But what does help is having a successful interaction with a researcher and an appsec team willing to be transparent about how they respond to and handle security events. It's also a great reminder of the importance of observability and logging for your apps -- there's a big difference in having confidence that unauthorized access hasn't been abused vs. crossing your fingers and hoping for the best. Check out the brief writeup and interaction with Shopify's appsec team at https://hackerone.com/reports/1087489

This may not be the most exciting target out there, but it's a great educational writeup of XSS and SSRF flaws in the wild. It's also a good lesson (once again, sigh...) of the subtle security issues that can arise from attempting to sanitize HTML and how to combine security issues into attacks with more consequential impacts.

The blog post sets the stage early: "There was a vulnerability in GitHub Actions of PyPI’s repository, which allowed a malicious pull request to execute an arbitrary command. This allows an attacker to obtain write permission against the repository, which could lead to arbitrary code execution on pypi.org." Then it goes into details about the flaw and how an attack would (or wouldn't) work. It's another educational writeup and ties into the evergreen theme of supply chain security.

We continue a conversation on a common weakness: out of bounds reads and writes. Here's some code whose bitwise ops went sideways on 32-bit values and could lead to command execution. It's a relatively long article that lays out the fundamentals of eBPF before going into the details of finding and exploiting the flaw. Even if kernel hacking isn't your thing, read the first part to understand the principles behind eBPF and how they contribute to security boundaries.

We just talked about the CWE Top 25 for 2021 in last week's episode. Now CISA is out with the top vulns they've seen exploited for the past year or so. While the focus is slightly different -- CISA highlights specific apps as opposed to weakness -- there's plenty of overlap in terms of what has made those apps insecure. It also seems like another opportunity to talk about patching, threat models, and what kind of influence the specter of "zero-day" should have on both.

If you approach the purpose of testing with the question, “What could possibly go wrong?”, then you're on your way to security-minded thinking and threat modeling. This article goes through several motivations for testing and its importance in conveying confidence in the app's behavior to various stakeholders, including security.

On a previous episode, we discussed a little about if the current focus in application security should be in "legacy" applications, or more around webapp. A study out from F5 and The Cyentia Institute thinks the focus should be more on the webapp side...