tl;dr sec

Academic rigor, industry practicality. We write about security automation, scaling application security, and automated bug finding techniques.

Posts by Year

2020 51
2019 24

2020

[tl;dr sec] #57 - Bug Bounty Lessons Learned, Content Value Hierarchy, CloudSecDocs

7 minute read

1 year of a private bug bounty program, how to create high value content, and a great resource for cloud-native technologies.

Stratechery: Aggregation Theory

1 minute read

Ben Thompson describes how properties of the Internet enable companies providing the best user experience to win, which leads to a virtuous but anti-competit...

[tl;dr sec] #56 - State of Exploit Development, Hacking Apple, flaws.cloud dataset

8 minute read

Stats on vulnerability discovery, CVE publication, and patches, lengthy write-up of 3 month Apple bug bounty hackathon, and flaws.cloud logs published.

[tl;dr sec] #55 - Detection as Code, Vault Authentication Bugs, Fingerprinting Exploit Developers

9 minute read

Why we should embrace Detection as Code, write-up of two complex AuthN bugs in Vault, tracking exploit developers by their work.

[tl;dr sec] #54 - Complexity in Capital, Communicating a Breach, Offensive Terraform

8 minute read

I contributed to an article in Forbes, how to communicate when you’ve been hacked, Terraform to spin up offensive infrastructure.

A framework for effective corporate communication after cyber security incidents

1 minute read

This paper lays out a framework for how organizations should communicate after a security incident.

[tl;dr sec] #53 - OneFuzz, Program Analysis, Ring Alarm Teardown

8 minute read

Microsoft releases self-hosted fuzzing-as-a-service platform, several solid program analysis resources, detailed teardown of Ring’s hardware and attack surfa...

[tl;dr sec] #52 - Prioritizing 3rd Party Vulnerabilities to Fix, LangSec History, Distilled Compliance Controls

11 minute read

How to prioritize vulnerabilities in your dependencies, some history and context around LangSec, and a set of common controls across 10+ standards.

Peeling the Web Application Security Onion Without Tears

2 minute read

Lessons from Adobe in how building reusable, secure-by-default services and infrastructure improves your security and reduces compliance burden.

[tl;dr sec] #51 - Continuous Cloud Monitoring, Web Browser for Hackers, How GitHub Threat Models

9 minute read

Monitor your cloud environment and automatically detect drift, a scriptable browser and bending JavaScript to your will, GitHub’s threat modeling process.

[tl;dr sec] #50 - Engineering Empathy, Golang Security, Bardcore

10 minute read

Applying engineering lessons learned to AppSec teams, common Golang bugs, and medieval covers of modern pop songs take the Internet by storm.

[tl;dr sec] #49 - Web Cache Entanglement, Finding a Mentor, Build Tools Around Workflows

10 minute read

New cache research by James Kettle, how to effectively reach out and build mentor relationships, tools should support workflows, not vice versa.

[tl;dr sec] #48 - Automating Recon Summary, GraphQL Tools, DEF CON 2020 Live Notes

12 minute read

My summary of Daniel Miessler’s talk on automating recon, 2 tools to help with testing GraphQL, quick notes for ~20 DEF CON talks.

Mechanizing the Methodology: How to find vulnerabilities while you’re doing other things

5 minute read

Daniel Miessler describes how to automate your OSINT and recon processes so you can find more and better bugs with less manual effort.

[tl;dr sec] #47 - Automating Recon, Podcasts, and Lateral Movement / Privilege Escalation in GCP

8 minute read

Daniel Miessler on automating your recon workflow, I was on a few podcasts, how to compromise GCP orgs via cloud API lateral movement & privilege escalat...

[tl;dr sec] #46 - Grokking CSP, Automating Threat Model ➡️ Security Tests, Unknown Blob ➡️ Plaintext

11 minute read

How to go from no CSP to a solid CSP, automatically creating baseline security tests from a threat model, tools to automagically decode random blobs.

Content Security Policy: Going From Idea to Afterthought

2 minute read

GitHub security engineer Neil Matatall gives an overview of CSP: how it works, how to go from no CSP to a solid CSP, and how GitHub implements CSP.

[tl;dr sec] #45 - Bucket Brigade, ReDoS Cheat-sheet, Understanding OAuth

9 minute read

Protecting your public S3 buckets, how to find, prevent, and fix regular expression DoS, and walk step-by-step through the OAuth flow.

[tl;dr sec] #44 - Formal Methods, New Web Security Mechanisms, Have GPT-3 Code for You

11 minute read

Using lightweight formal methods in the real world, new web mitigations for injection vulns and isolation capabilities, GPT-3 is magic.

Container Security

1 minute read

A collection of container security resources and tools, organized by category.

PLTalk: Practical Formal Methods with Hillel Wayne

17 minute read

Jean Yang, Hongyi Hu, and Hillel Wayne discuss making programming languages/model checking more accessible, give an overview of TLA+ and Alloy, and successfu...

[tl;dr sec] #43 - Continuous AppSec Scanning, Threat Modeling, Career Advice from Feynman

11 minute read

How to continuously discover, monitor, and assess your web assets, threat modeling + agile, Richard Feynman on the problems you choose to tackle.

[tl;dr sec] #42 - tl;dr sec Search, Towards Trusted Sensing, Root Causes of Procrastination

11 minute read

tl;dr sec now supports search, snapshotting VMs at scale in a way malware can’t evade, reflections on why we procrastinate.

[tl;dr sec] #41 - Threat Modeling Kubernetes, Secret Scanner Benchmark, OWASP Software Component Verification Standard

9 minute read

Overview of current work threat modeling Kubernetes, a repo to test your secret scanning, and v1 of OWASP’s standard on identifying/reducing supply chain risk.

How Uber Continuously Monitors the Security of its AWS Environment

3 minute read

Uber describes their continuous cloud monitoring service and the workflows and process design that makes it successfully adopted by engineering teams.

[tl;dr sec] #40 - Uber’s Continuous AWS Monitoring, AWS’s Hands-off Deployments, Auto-remove Unneeded Feature Flags

10 minute read

Uber continuous AWS monitoring tool and process, how AWS does safe, fast, continuous deployment, tool to auto-delete no longer needed feature flags.

[tl;dr sec] #39 - Evidence Based Security, Web Security, and Program Analysis

14 minute read

Measuring the effectiveness of your security controls, web security tools and slides, auto-converting between Java/C++/Python and integrating formal methods.

[tl;dr sec] #38 - Threat Modeling for Devs, Attacking JWTs, On Accepting Ads

12 minute read

Effectively teaching devs threat modeling, forging and cracking JWTs, and some radical transparency about our process of deciding to accept sponsors.

On Accepting Sponsors

7 minute read

tl;dr sec’s goals, values, and our thought process behind accepting sponsors. Sponsors will be clearly demarcated and will not affect the rest of the content.

[tl;dr sec] #37 - Kubernetes, SAST Snark, and Malware Targeting Open Source Supply Chain

12 minute read

Using Kubernetes + OPA, Twitter SAST snark & lessons learned, malware discovered on GitHub targeting the open source supply chain.

[tl;dr sec] #36 - AWS Security Maturity Roadmap, Fuzzing, Dynamic Infra for Security Testing

11 minute read

An AWS Security Maturity Roadmap for 2020, fuzzing the Windows kernel & differential crypto fuzzing, easily spin up a cloud env for security testing

[tl;dr sec] #35 - Careers in Security, Testing OAuth, Session Management with Burp

12 minute read

Building a successful career in security and how to specialize, testing OAuth implementations, and a Burp plugin for handling session management.

[tl;dr sec] #34 - Game Theory + 0days, Kubernetes Hacking Practice, AWS Least Privilege

14 minute read

Game theory applied to finding and disclosing 0days, Kubernetes training labs, rightsize your AWS IAM policies to Terraform.

[tl;dr sec] #33 - Splunk’s Attack Range, Detecting Compromised Cloud Creds, Azure AD for Red Teamers

8 minute read

Set up your own range to practice attacking & detection, detection strategies for compromised cloud creds, intro to Azure AD for red teamers.

[tl;dr sec] #32 - Security + Empathy, Chrome Extension Security, Attacking Azure AD

9 minute read

Gusto CISO Flee on building a positive security culture, protecting from/attacking with Chrome extensions, pivot through Azure AD.

[tl;dr sec] #31 - Instrument with Frida, Free Course on Attacking Apps in AWS/Azure, VM with 8 C&C Frameworks

9 minute read

Use Frida from a Burp extension or web interface, continuous cloud security, fighting misinformation at scale.

[tl;dr sec] #30 - Securing Your Home Network, ATT&CK for Kubernetes, Google on Building Secure Systems

10 minute read

How to secure your home WiFi network, Microsoft releases ATT&CK matrix for Kubernetes, free 550+ page book by Google’s SREs on building secure systems.

[tl;dr sec] #29 - Testing GraphQL, Bug Bounty Programs, & AWS Service Control Policy Best Practices

7 minute read

Tool for testing GraphQL endpoints, how to run a great bug bounty program, restricting your AWS account with Service Control Policies, hardening Linux.

[tl;dr sec] #28 - 25 Years of Fuzzing, Secrets Management, Security Questionnaires

10 minute read

Some history and overview of fuzzing, preventing/detecting/remediating leaked secrets, static analysis, macOS security, reflections on privacy post COVID-19.

Lightning in a Bottle: 25 Years of Fuzzing

1 minute read

Richard Johnson describes the history of fuzzing, the primary types of fuzzing, modern tools and advancements, SDLC integration, and more.

[tl;dr sec] #27 - AppSec Weekly, SOC2 Starting Seven, Save Encryption

11 minute read

I was on Application Security Weekly #100, a no-nonsense guide to becoming SOC2 compliant, fight a bill that may kill encryption, compensation resources.

[tl;dr sec] #26 - Learnings from Duo, Auto-healing Clouds, Fuzzing

10 minute read

Jon Oberheide on Duo, self-healing AWS environments, Google’s fuzzer benchmarking and CIFuzz, securing Windows & MS accounts at scale.

Learnings from Duo

11 minute read

Jon Oberheide on Duo’s story, from conception through acquisition, and the important lessons he learned along the way.

[tl;dr sec] #25 - BSidesSF and RSA, Demystifying Container Security, Your Privacy Online

10 minute read

Round-up of BSidesSF and RSA + my updated slides, overview of container security, pen testing K8s walkthrough, maintaining privacy online.

[tl;dr sec] #24 - BSidesSF/RSA, tl;dr sec Mascot, REST API Fuzzing, AWS Auto-remediation

10 minute read

I’m speaking at BSidesSF and RSA 2020, tl;dr sec stickers, stateful fuzzing of Swagger APIs, auto-remediate AWS issues, canary pro-tips, red team cheatsheets.

[tl;dr sec] #23 - OSINT, Automatic Exploit Generation, Cloud Security

14 minute read

OSINT tools, tips, & tricks, presentations on automatically find and exploiting bugs, a code-aware grep, how to assess another company’s security posture.

[tl;dr sec] #22 - Post AppSec Cali, K8s Security Monitoring at Scale

12 minute read

DevSecOps talks & tools from AppSec Cali, PoCs to decrypt WhatsApp messages, Kubernetes monitoring and CTF, Python static analysis tools.

[tl;dr sec] #21 - AppSec Cali, Bezos’s Phone, Fuzzing

12 minute read

I’m speaking at AppSec Cali 2020, details on Bezos’s phone being hacked, fuzzing talks and tools, Java deserialization, K8s and GraphQL tools.

What I Learned Watching All 44 AppSec Cali 2019 Talks

239 minute read

Detailed summaries of ~32 hours of talks, searchable and grouped by category, to supercharge your security program 🚀

Startup Security: Starting a Security Program at a Startup

15 minute read

How to be successful as the first security hire at a startup, what should inform your priorities, where to focus to make an immediate impact, and time sinks ...

[tl;dr sec] #19 - Epic Post Next Week, Beyond Beyond Corp, Cloud Security Tools

14 minute read

Google’s BeyondProd and code provenance whitepapers, tools to scan Terraform scripts / CloudFormation templates, getting into security resources.