[tl;dr sec] #120 - Supply Chain & Hardening CI, Automate Yourself out of Oncall Burnout, Eliminating Subdomain Takeovers
A thoughtful redesign of CI to mitigate harm from malicious dependencies, how to automate your IR playbooks, tool to eliminate dangling Elastic IP takeovers.
I hope you’ve been doing well!
An Academic’s Love Language
For example, you may often tell your partner how much you love them, but to them, physical affection is how they feel loved. And your partner may buy you presents to show their affection, but you’d perhaps prefer they helped with chores around the house.
Worth thinking about.
As a former academic, I know there are particular phrases so wonderful for us that they can instantly double our heart rate.
So for all the current and former academics out there:
Look for future content like this in the upcoming companion newsletter, tl;dr romance.
Semgrep’s February 2022 Updates
Last week we announced a whole bunch of things:
Semgrep is now 2x-3x faster.
Better taint tracking and fancy program analysis features.
More languages: C#, Kotlin, Scala, C++, Dockerfile, Hack, Solidity.
Developer Feedback: Developers can now easily provide feedback about any rule that fired on their PR, so you can see what’s working and what to improve.
A new full-screen Editor to more easily write rules in your browser.
Read more about it here.
Also, want to work with me? r2c is remote-friendly and hiring! 🙌
📢 2022 Cloud-Native Security and Usage Report from Sysdig
Did you know 75% of containers have critical vulnerabilities that are patchable? Get real-world practical insights from Sysdig’s 2022 Cloud-Native Security and Usage Report to help as you work to develop best practices for securing and monitoring your cloud-native environments.
📜 In this newsletter...
AppSec: Static analysis tool for Clojure, what BeyondCorp actually is and why it's so hard
Web Security: Portswigger's top 10 web hacking techniques of 2021, prototype pollution scanner
Cloud Security: Cloud Security RoadMap, DevOps the Hard Way, eliminating dangling elastic IP takeovers
Supply Chain: GitBOM, compromising NPM packages via expired owner email domains, a pluggable framework for supply chain security, building a hardened CI on self-hosted GitHub Action runners and GKE
Container Security: Homebrew for Kubernetes
Blue Team: Tool to analyze the memory of compromised Linux systems, automating yourself out of oncall burnout
Network Security: SSH into your private machines from anywhere with Cloudflare Tunnel
Politics / Privacy: Tracking your spouse with AirTags, what if China weaponized TikTok for subverting values, we're closer to Bradbury's dystopia than Orwell's or Huxley's
Misc: How to recover sensitive info from pixelated text, the history of Valentine's day
Aphorism: A gut punch to take action from Epictetus
A CLI SAST (static application security testing) tool to find vulnerable Clojure code via rules that use a simple pattern language.
BeyondCorp is dead, long live BeyondCorp
Tailscale’s Maya Kaczorowski describes what zero trust architecture / BeyondCorp actually mean (beyond the hype), how difficult it is (even Google isn’t fully BeyondCorp), the importance of device trust, and what an ideal solution looks like.
Top 10 web hacking techniques of 2021
Another annual round-up by Portswigger. Several on HTTP Request Smuggling, as well as fuzzing for XSS, JSON interoperability vulnerabilities, cache poisoning at scale, attacking HTTP/2, and more. #1: Dependency Confusion.
Cloud Security Podcast: Cloud Security RoadMap with Scott Piper
Ashish Rajan interviews Summit Route’s Scott Piper on his Cloud Security Podcast, covering what to prioritize as a start-up, challenges for medium to large companies, continuous compliance, getting started in cloud security, and more.
If you’re interested in cloud security, I’d give Ashish’s Cloud Security Podcast a look, he interviews a number of super solid people, and has recently been doing series on AWS, GCP, and Azure security.
Free labs, documentation, and diagrams for setting up an environment that is using DevOps technologies and practices for deploying apps and cloud services/cloud infrastructure to AWS, by Mike Levan.
Eliminating Dangling Elastic IP Takeovers with Ghostbuster
When you create a DNS record pointing to an IP but don’t remove the DNS record after the EC2 instance has been destroyed or given a new IP, you become vulnerable to subdomain takeover attacks. Assetnote’s Shubham Shah describes Ghostbuster, a new tool they’re releasing that can detect these dangling Elastic IP addresses.
Ghostbuster works by enumerating all the elastic/public IPs associated with every AWS account you own, and then checking if there are any DNS records pointing to elastic IPs that you don’t own in any of your AWS accounts.
A minimalistic scheme for build tools to:
Build a compact artifact tree, tracking every source code file incorporated into each built artifact.
Embed a unique, content-addressable reference for that artifact tree, the GitBOM identifier, into the artifact at build time.
“Zero-Days” Without Incident - Compromising Angular via Expired npm Publisher Email Domains
Fun fact: Email addresses for all maintainers on npm are public. Matthew Bryant shows how you can use this for nefarious ends.
Scrape all npm package maintainer email addresses.
Filter to custom owned domains (e.g. [email protected]).
See which of those domains are expired or expiring.
Register those domains and use it to reset the victim user’s
Backdoor their repo, profit $$$.
Defense Against Novel Threats: Redesigning CI at Mercari
Mercari’s Michael Findlater describes how they’ve rearchitected their CI to protect against malicious third-party dependencies. The post gives a nice overview of aspects to consider, like disallowing CI config modification without review, limiting CI egress to prevent exfiltration of data, running jobs ephemerally in clean, isolated environments, integrating with secret management tools, and more. They use self-hosted GitHub Action runners on GKE.
One key point, which I’ve called out a number of times in effective security engineering work from various companies, is they worked closely with Developer Experience teams to ensure it doesn’t slow down development, fits in nicely to existing dev processes, etc.
They’ve also integrated some default setup into a microservice-starter-kit Terraform module that’s used for new microservices, likely leading to easier, widespread adoption 👌
Please allow me to shamelessly include a slide from my BSidesSF 2020 talk How to 10X Your Security:
Homebrew for Kubernetes.
How we automated ourselves out of on-call burnout… and you can too!
Segment’s Prima Virani describes how in 6 months they’ve partially or fully automated approximately 85% of their incident response playbooks using Twilio’s SOCless tool, which basically aims to make it easy to convert workflows to a series of Lambdas handling each step.
The post contains a number of useful hardening steps the Segment team took, and some good advice:
Sort alerts by frequency and automate the most frequent alerts first for maximum impact.
It’s better to partially cover many alerts instead of entirely automating one playbook, as oftentimes an automation can close out a response before later manual steps are reached.
Communicate outcomes at every step so humans know where to pick up, and so you can easily troubleshoot errors.
📢 The best lessons come from experience. 7 cybersecurity leaders share their tales
In this exclusive eBook from JupiterOne, seven cybersecurity leaders share their stories of failure and success, roadmaps you can use to improve your cybersecurity programs, and their visions for the future of cybersecurity.
SSH into your private machines from anywhere, for free, using Cloudflare Tunnel
Guide by Ben Butterworth to using Cloudflare Tunnel, which will filter traffic to your machines through Cloudflare’s network, including authenticating you.
Politics / Privacy
I Used Apple AirTags, Tiles and a GPS Tracker to Watch My Husband’s Every Move
A NY Times reporter tests 3 location tracking tools, with permission, on her husband. Even when you know they’re there, they’re not easy to find.
Never Use Text Pixelation To Redact Sensitive Information
Bishop Fox’s Dan Petro discusses why pixelation is a bad approach for redacting sensitive info in images, and releases a tool, Unredacter, that reverses redacted pixelized text back into its unredacted form.
Valentine’s Day: The Wild, Pagan History Behind the Romantic Holiday
Some interesting history behind the modern celebration of consumerism love.
Shared by Steph Smith:
✉️ Wrapping Up
Have questions, comments, or feedback? Just reply directly, I'd love to hear from you.
If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏
Thanks for reading!