[tl;dr sec] #105 - DevSecOps, Ransomware & S3, Falco Labs
Effectively shifting left, protecting your S3 buckets from ransomware, exercises to learn Falco in your browser.
I hope you’ve been doing well!
Last weekend I attended a superspreader event my cousin’s wedding at the University of Notre Dame, which is where they met.
My parents also met at Notre Dame, and it was fun going around campus seeing the dorms they used to live in, the pond they used to walk around, and hear stories of the bitter winters. Here’s me in front of the Golden Dome:
Fun fact: Notre Dame has a giant mural called Touchdown Jesus, so called because Jesus is raising his arms in the air and is visible from the football stadium. America!
Work with Me? 🙌
One of my favorite things about tl;dr sec is all of the things I’ve learned from you, dear reader. The posts you’ve written and tools you’ve made have inspired me and make me smarter, so I’d love to work with people from this community.
My security research team at r2c is looking for people passionate about codifying the world’s security domain knowledge into Semgrep rules that can help companies raise their security bar and eliminate classes of vulnerabilities. If you love digging into new technologies, languages and frameworks, grokking the security risks, and then sharing your knowledge via blog posts, talks, and open source contributions, we’d love to chat with you!
What is Semgrep? It’s the open source static analysis tool Snowflake, Slack, Figma, and Dropbox are standardizing their code scanning on. Or as AppSec educator and long time OWASP member Jim Manico described it, “The future of static analysis.”
You can apply here, or respond directly to me, happy to answer questions!
📢 5 Benefits of Detection-as-Code
The “Everything-as-Code” evolution is changing how security teams write, test and harden detections. By adopting universal coding languages like Python, and managing detections through standard CI/CD workflows, security teams can produce high-fidelity alerts tuned to their specific environment. Learn how Panther integrates this approach into a scalable platform for threat detection and response.
We actually use Panther at my company and we’ve enjoyed it so far. It’s nice to be able to easily tune detections and create new ones as they’re in Python, ensure the detections work via unit tests, and not have to manage the infrastructure.
📜 In this newsletter...
AppSec: Risk-based security decision making at Netflix, tool to detect default creds, bypassing required reviews using GitHub Actions
DevSecOps: NIST on microservices with a service mesh, building an end-to-end DevSecOps pipeline on AWS, how to effectively shift left
Web Security: Easily integrate CLI tools with Burp via the Piper extension, XSS challenges
Cloud Security: Analyzing the Twitch leak from a security consultant POV, what to do with an inherited AWS account, visualize CloudFormation stacks, the threat of ransomware to S3 buckets, inside an AWS pricing meeting
Container Security: Context discovery tool for Kubernetes, hands-on Falco labs, k8s RBAC tool, k8s security checklist
Blue Team: osquery 5, now with EndpointSecurity on macOS
Misc: Logging best practices, search open tabs in Chrome, Super Mario 64 on iOS, why airlines need business travel to return
Risk-Based Security Decision Making at Netflix
A lot of the cool kids these days are talking about maturing risk discussions from handwavy “I feel like this is probably bad” to more quantitative measures. This talk by Netflix’s Prashanthi Koutha and Shannon Morrison will be FAIRly interesting. H/T Travis McPeak.
By LARES’s Zach Grace: A tool for detecting default and backdoor credentials. By default scans for HTTP(S) default credentials, but also supports the MSSQL, MySQL, Postgres, SSH, SNMP, MongoDB, and FTP protocols.
Bypassing required reviews using GitHub Actions
Cider Security’s Omer Gil found that a user with write permissions on a repo can create a GitHub Action that uses the GitHub API to approve their own pull request, bypassing required reviewer settings. Because Actions are enabled by default, even if your repo isn’t currently using GitHub Actions, a malicious user could still do this attack.
The caveat here is that the malicious user needs to have write permissions on the repo, which should be a highly trusted user, though they could be compromised.
DevSecOps for Microservices-based App with Service Mesh
NIST whitepaper discussing 1) a reference platform (e.g. Kubernetes) for implementing DevSecOps primitives, 2) organizational preparedness and key primitives, and 3) implementing the DevSecOps primitives.
Building an end-to-end Kubernetes-based DevSecOps software factory on AWS
AWS’s Srinivas Manepalli describes an architecture using AWS services and mostly open source tools to build a secure software development pipeline that includes finding secrets, SCA, SAST, DAST, RASP, and aggregates vulnerability findings into a single pane of glass.
Piper is a Burp Suite extension that makes it easy to “pipe” CLI tool functionality into Burp. This repo by Dominique Righetto contains a number of his useful Piper scripts, like extracting web API endpoints, pretty printing JWTs, extracting single page app unsafe patterns, and more.
Victor Grenu analyzes the Twitch leak from an AWS Security Consultant perspective
1442 unique AWS AccountIDs, a lot of in-house security tooling, tech stack used, IAM, InfoSec security maturity, and more.
CLI tool to visualise CloudFormation/SAM/CDK stacks as visjs networks, draw.io or ascii-art diagrams.
The Threat of Ransomware to S3 Buckets
Ermetic’s Lior Zatlavi describes research they did into the susceptibility of various AWS environments to S3 ransomware. The post does a nice job listing risk factors (risky permission combinations), mitigations (e.g. MFA delete, object locking, bucket versioning), and key findings. Yikes:
kdigger: a Context Discovery Tool for Kubernetes
Quarkslab’s Mahé Tardy has open sourced kdigger, a tool that automates many standard steps when pentesting Kubernetes from inside a pod. He’s also released minik8s-ctf, a beginner-friendly CTF about Kubernetes security.
Falco Hands-on Labs
Learn to use Falco, the runtime container security monitoring tool, via several labs, all in your browser! Labs include: detecting threats such as a container running an interactive shell or an unauthorized process, defining custom rules, and taking automated actions when threats are detected.
A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity. Examples include:
Create a RBAC graph of the actively running workload on all namespaces
Analyze RBAC permissions and highlight overly permissive principals, risky permissions
Generate RBAC policy from Kubernetes audit events
Kubernetes Security Checklist and Requirements
A checklist by Vinum Security covering authentication and authorization, secrets, cluster config, auditing and logging, OS config, network security, secure configuration of workloads, and securely building images.
Announcing osquery 5: Now with EndpointSecurity on macOS
Trail of Bits’ Sharvil Shah describes the new osquery release, including the EndpointSecurity process event capturing on macOS they added. When combined with the required entitlements, the EndpointSecurity framework enables user-mode processes to subscribe to events of interest from the macOS kernel in real time, replacing the need for kernel extensions.
Log after, not before
Separate parameters and messages
Distinguish between WARNING and ERROR
INFO is for business, DEBUG for technology
Why airlines need business travel to return
In short, business travelers heavily subsidize economy class travelers. Some groups estimate that somewhere between 19% and 36% of business trips will never return, leading airlines to cut flights, ground more of their fleets, and buy fewer new planes.
✉️ Wrapping Up
Have questions, comments, or feedback? Just reply directly, I'd love to hear from you.
If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏
Thanks for reading!