[tl;dr sec] #148 - OWASP Kubernetes Top 10, GraphQL Batching Attacks, Abusing Debugging in Electron Apps
I hope you’ve been doing well!
Over 12,000 Subscribers 🎉
Welcome to the big group of people who joined this week! 👋
I’m excited you’re here, thanks for joining us.
Almost every Thursday for the past few years I’ve tried to share some of the best security blog posts, talks, and tools. And general interesting finds, career advice, and some humor, like:
It’s been quite the road to almost 150 issues, and to be honest I couldn’t have done it without all the kind words and encouragement people have shared.
It’s kept me going when the nights are late and I can hear other people outside having fun while I’m inside crying writing.
So thank you 🙏
Accepting Sponsors for 2023
Well, technically, we’ve already started booking into 2023 🙂
Is it worth it? I’ll let some prior sponsors speak for me:
So far, five start-ups who sponsored tl;dr sec have been acquired. Not too shabby.
Whether you’re a scrappy start-up or security industry staple looking to keep growing, if you’d like to get your product or content in front of thousands of security professionals, reach out to [email protected].
Hope to hear from you 😀
📢 Accelerate mobile security research on the ONLY Arm-native platform
In today’s mobile security and pentesting world, security pros don’t have the time to matrix test countless combinations of phone models and OSs or rely on emulator tools that don’t provide real-world testing and lack advanced security tooling.
The Corellium Virtual Device Platform for iOS and Android opens the door for mobile cybersecurity R&D. It provides on-demand root access to any OS, including the latest iOS releases without needing a jailbreak.
See why enterprises, governments, and educational institutions run their mobile cybersecurity best practices on Corellium.
Corellium builds super cool tech. I’m nerding out a little bit having them as a sponsor 🤓
📜 In this newsletter...
Web Security: Local file inclusion discovery and exploitation tool, GraphQL batching attacks with Burp's Turbo Introder, Burp plugin to cache and automatically refresh JWT tokens
AppSec: Tool to keep your shell command history from leaking secrets, a review of vulnerability databases and scoring methodologies, operationalizing an IaC security program, guide to implementing an effective SAST workflow
Cloud Security: Centralize findings and automate deletion for unused IAM roles, creating automation creds without exposing them to users, how resource-based policies work and how they can be abused, Azure middleware agents now support auto-patching
Container Security: Lazy wrapper for Trivy, a Kubernetes cluster sanitizer, OWASP Kubernetes Top 10
Misc: Generate GIFs from asciicast files, a web scraping and browser automation library, use TouchID to authenticate sudo on macOS, the Museum of Mario, comparing costs across generations, why gas is comparatively cheap in America
A local file inclusion discovery and exploitation tool.
GraphQL Batching Attacks: Turbo Intruder
GraphQL allows multiple queries to be sent to the server in a single request in order to reduce the number of requests that the server has to process.
White Oak Security’s Michael Rand shows how batch queries + Turbo Intruder can be used for more effective brute force attacks; for example: password brute forcing, bypassing MFA, or enumerating object IDs to access sensitive data.
A simple and fast way to secure your shell command history. Show sensitive command summary when opening a new terminal, clear sensitive commands from your shell history, stash your history command before presentations or screen sharing.
An Incomplete Look at Vulnerability Databases & Scoring Methodologies
Deep dive by Chris Hughes on some of the fundamental databases and scoring methodologies currently in use in the industry as well as some that are beginning to emerge as the digital landscape evolves.
He discusses: NVD, CVE, CVSS, the Global Security Database (GSD), Google OSV, and the Sonatype OSS Index.
Crawl, walk, run: Operationalizing your IaC security program
Bridgecrew’s Michael Urbanski shares a general plan for choosing your IaC security path, rolling out your program, and iterating along the way.
A Guide On Implementing An Effective SAST Workflow
Thirty Madison’s Anshuman Bhartiya on setting up a developer-friendly SAST workflow for free using open source tools: Semgrep and OWASP’s Defect Dojo.
He walks through several scenarios (push to the main branch, run on a schedule, when a PR is issued), and useful different scanning modes based on severity of identified issue and rule confidence (monitor only, PR comment, blocking).
How to centralize findings and automate deletion for unused IAM roles
AWS’s Hong Pham describes how to apply resource tags on IAM roles and use Lambda/Step Functions to detect unused IAM roles and to require the owner of the IAM role (identified through tags) to take action.
Creating Automation Credentials Without Exposing Them To Users
2nd Sight Lab’s Teri Radichel continues her Automating Cybersecurity Metrics blog series, covering how to create secrets in AWS Secrets Manager with CloudFormation.
Misconfigured Resource-Based Policies
A resource-based policy is a type of policy that is attached directly to an AWS resource that describes what actions can be performed on it and by whom. Nick Frichette covers the intricacies of how resource-based policies work, and how they can be abused.
The “*” Principal and Risks
More Than Just S3 Buckets
Resource-Based Policy Evaluation Logic
“Not” Policy Elements
Securing Azure middleware agents with new auto-patching capabilities
It turns out when you require your customers to manually patch critical vulnerabilities in software you installed for them that they often don’t know they have, update rates are low. Nice work from Wiz in pushing for auto-patching functionality 👍
📢 Forget everything you know about SSH
Say hello to Tailscale SSH — and say goodbye to managing SSH keys, setting up bastion jump boxes, and unnecessarily exposing your private production devices to the open internet. Never deploy an infrastructure bastion again.
SSH from mobile devices, and across OSes. Tailscale SSH works where Tailscale works. Code from an iPad to your Linux workstation, without having to figure out how to get your private SSH key onto it. Answer an on-call emergency from anywhere, which means you can leave your desk now.
I haven’t played with Tailscale in detail yet, but it’s up there on my list. The response of friends of mine who have has generally been, “Oh wow, this is pretty cool,” and “Hm, worked immediately, nice!”
A Kubernetes cluster sanitizer, by Fernand Galiana. Popeye scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. It sanitizes your cluster based on what’s deployed and not what’s sitting on disk. By scanning your cluster, it detects misconfigurations and helps you to ensure that best practices are in place, thus preventing future headaches.
OWASP Kubernetes Top 10
The list is aimed at helping security practitioners, system administrators, and software developers prioritize risks around the Kubernetes ecosystem. It’s a prioritized list of risks backed by data collected from organizations varying in maturity and complexity.
Insecure Workload Configurations
Supply Chain Vulnerabilities
Overly Permissive RBAC Configurations
Lack of Centralized Policy Enforcement
Inadequate Logging and Monitoring
Broken Authentication Mechanisms
Missing Network Segmentation Controls
Secrets Management Failures
Misconfigured Cluster Components
Outdated and Vulnerable Kubernetes Components
A CLI tool for generating animated GIF files from asciicast v2 files produced by asciinema terminal recorder.
A web scraping and browser automation library for Node.js that helps you build reliable crawlers. Fast.
Use TouchID to Authenticate sudo on macOS
Your TouchID equipped Mac can easily be configured to use your fingerprint to approve sudo commands. You can also use your Apple Watch, if you have it set up to unlock your Mac.
The Museum of Mario
An interactive experience exploring the many eras of Mario. Turn on the audio and click around to find hidden interactions!
Why gas is actually cheap in America
Even though gas feels expensive, when you account for earnings, the U.S. has the cheapest gas in the world. The reason is other countries tax gas more heavily. There’s a chicken and egg problem: gas was cheap, which lead to urban sprawl, but low gas taxes lead to less investment in public transport, which makes people more reliant on driving.
✉️ Wrapping Up
Have questions, comments, or feedback? Just reply directly, I'd love to hear from you.
If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏
Thanks for reading!