Twitter 2FA, Server-Side Prototype Pollution, AI Security & Privacy, Smarter Testing – ASW #230

It's a bad step to tie security to premium features. Plus, SMS-based 2FA is the weakest of the available options. Phone numbers are easier to manage and more portable than authenticator apps, but authenticator apps are almost always better in the long run as long as they can be backed up and recovered in case of a lost device.

This is also a lesson in communications. Even if this is just motivated by reducing costs for text messages, it would have been helpful to launch a campaign that encourages everyone to shift to authenticator apps or at least be clear that users have that alternative to 2FA.

The bigger picture is that, as of December 2020, only about 2.3% of users enabled 2FA in the first place, and 80% of those relied on SMS. Looking at this from an appsec perspective, focusing on SMS ignores the problem that almost every user doesn't even use 2FA in the first place.

Another article walks through how to setup for 2FA. All apps should support 2FA without additional cost to the user.

Really cool, detailed research on identifying flaws in server-side JavaScript apps. It's a good review of prototype pollution and an even better review of crafting safe, reliable payloads. It's possible to DoS a site with this kind of testing. That, of course, means there's a bug to fix. But it's more useful to be able to probe for this kind of vuln without taking down the site for everyone else.

Every pentester likely has one story about a test gone wrong -- a payload shutdown a service or erased data. This article shows how to be deliberate and careful with security testing in order to keep those stories rare.

This is a nice overview of the Top 10 K8s issues from OWASP. It highlights three themes: misconfigurations, lack of visibility, and vulnerability management.

The OWASP cheatsheet has more details. There's also another checklist and a checklist from k8s itself. Eventually, we'll have better default security and less need for long checklists.

OWASP has a new project on AI security and privacy. Right now it has an overview of common attacks against ML models along with pitfalls of training data.

We haven't talked about certifications on the show, but we should! Now Black Hat is getting into the certification business. Their current syllabus for it is half web hacking and half infrastructure hacking. The web hacking basically looks like items from the OWASP Top 10 and Portswigger articles (shout out to directory traversal vulns!). The infrastructure side seems heavy on corp IT, with Active Directory and lateral movement techniques.

It's interesting to see where this kind of cert focuses attention. For example, there's mention of S3 buckets and Docker escapes, along with "common security weaknesses" in the cloud.

More details at https://secops.group/blackhat-certified-pentester-bcpen/

Fuzz Faster U Fool (ffuf) is a Go-based web fuzzer that turns wordlists and patterns into HTTP requests to find directories, virtual hosts, usernames, and otherwise fuzz parameter names and values. While its pronunciation may be mysterious, its utility in discovering resources makes it a top choice for bug bounty researchers. The fuzzer might find unprotected pages, bypasses against weak security checks and poor regexes, misconfigurations, and exploitable flaws.

Additional resources:

• How to use ffuf - Hacker Toolbox
• Everything you need to know about FFUF

p.s. here at ASW we pronounce it to rhyme with tough, just like Billy Ocean

It feels like a time of reckoning is coming for npm.

This somewhat controversial article argues that CISOs aren't doing the basics right, resulting in breach after breach. The author gives several points as to what CISOs could be doing better and makes some...strongly worded arguments in the process.

Dole recently experienced a cyber incident that was identified as ransomware. While it is unclear based on their statement how much this incident has impacted their operations, other sources say that Dole had to shut down one of their plants for a day, impacting the availability of their salad products in grocery stores.

Adobe's pivoting to a model where they try to focus their security testing on types of attacks that are being seen. That sounds simple, but to do it with intention across a line of products like Adobe has is impressive.

Moreso, though - is the also mentioned Adobe Trust Center. They're providing access to customers who sign an NDA to be able to review the pentest results and security whitepapers for various products.

This will be interesting to watch: The maintainer of the Fish shell is planning on a "port" (not a rewrite - definitely not a rewrite) of fish from C++ to Rust, pointing to things such as memory safety and...c++ header files?

Anyways - the reason this will be interesting is it's being well planned (https://github.com/fish-shell/fish-shell/blob/master/doc_internal/fish-riir-plan.md), is happening in public, and they're already cognizant of a few issues - not everyone on the existing team knows Rust (or perhaps wants to learn), bugs may be introduced, and it will probably require pausing feature development while the port is worked on.

To me, browser cookies don't have a positive connotation?