[tl;dr sec] #153 - Postgres' Insecure Defaults, SBOM, Prototype Pollution

Hey there,

I hope you’ve been doing well!

🎉 Announcing: Semgrep Supply Chain

I wanted to let you know about something pretty cool my colleagues have been working hard on that just launched this week: Semgrep Supply Chain.

What’s unique about it is we use Semgrep’s code analysis capabilities to find not just that you have a dependency at a version with a known CVE, but that your code is actually calling the vulnerable methods(s) in that library.

We’ve found in practice this reduces alerts by ~98%. So you can use your political capital on getting developers to update the dependencies that matter.

You can read an announcement blog post here or see a reachability example here.

A Bathroom I Wouldn’t Enjoy

I’m all for modern design and transparency in most things, but I think I’ve found my limit.

AppSec

controlplaneio/truffleproc
Hunt secrets in process memory (TruffleHog & gdb mashup), by ControlPlane.

How Palantir Manages Continuous Vulnerability Scanning at Scale
Palantir has developed a container vulnerability scanner that’s been integrated into their continuous deployment platform, and they use it to adhere to strict CVE SLAs. They use three major scanners today: Trivy, ClamAV, and Jfrog Xray. If a container or artifact scan fails a security check, it can be marked as recalled and can no longer be deployed.

Web Security

What I learnt from reading 220* IDOR bug reports
What nynan learned from scraping every IDOR report from HackerOne.

What is prototype poisoning? Prototype bugs explained!
Christoffer Jerkeby covers what prototype poisoning is, its impact, finding it with static and dynamic testing, and an overview of related work.

Of course, see also the OG prototype pollution work by Olivier Arteau, his NorthSec 2018 talk and paper.

Prototype Pollution Primer for Pentesters and Programmers
WithSecure’s Ben Berkowitz and Phil Sofia describe what JavaScript prototypes are, how they can get polluted, break down the structure of prototype pollution attacks into two stages (pollution and exploitation), demonstrate how to exploit the most recent version (v 3.6.0) of jQuery’s ajax() function in the process.

There’s also a companion HTML demo page where you can experiment with payloads and follow along with the sections in real time.

See also BlackFan/client-side-prototype-pollution, a list of examples of libraries that are vulnerable to prototype pollution and useful script gadgets that can be used to demonstrate the impact.

Database Security

The Majority of PostgreSQL Servers on the Internet are Insecure
Whoa, some epic results from bit.io’s Jonathan Mortensen et al. Also, this is a great example of a fairly thorough examination of an area, and detailed methodology write-up. I love reading posts like this.

• At most 15% of the approximately 820,000 PostgreSQL servers listening on the Internet require encryption. In fact, only 36% even support encryption.

• Most popular Postgres SQL clients will accept unencrypted connections without a warning.

• Almost 12,000 (4.0%) of the certificates were expired, and more than 128,000 (43.3%) of the certificates were self-signed.

Don’t make databases available on the public internet
Impressive fast follow by Tailscale’s Dave Anderson on the above issue (Tailscale is also sponsoring tl;dr sec this week, woo!). They’ve open sourced a TLS-enforcing Postgres proxy. Great example of attacking an issue categorically instead of piecemeal.

Cloud Security

Cloud Architecture Diagrams as Code
Create diagrams for AWS, GCP, Azure, a data ETL pipeline and more.

Encryption in AWS and Multi-Account Access
CloudQuery’s Jason Kao discusses how to encrypt everything in multi-account AWS environments and how to make encryption decisions. tl;dr:

• For resources that may be shared across multiple accounts, use Customer Managed KMS Keys.

• For resources that require encryption with FIPS 140-2 Level 3, have specific audit requirements, or cannot be stored in a shared environment, either use CloudHSM directly or AWS KMS with a custom key store backed by AWS CloudHSM clusters.

How to automatically build forensic kernel modules for Amazon Linux EC2 instances
This post walks through the EC2 forensic module factory solution to deploy automation to build forensic kernel modules that are required for EC2 incident response automation. Capture volatile memory with a tool like Linux Memory Extractor (LiME), and analyze the memory with a tool like Volatility2.

Container Security

controlplaneio/badrobot
By ControlPlane: A Kubernetes Operator audit tool that statically analyzes manifests for high risk configurations such as lack of security restrictions on the deployed controller and the permissions of an associated ClusterRole. The risk analysis is primarily focused on the likelihood that a compromised Operator would be able to obtain full cluster permissions.

Kubernetes Multi-tenancy
This official Kubernetes docs page provides an overview of available configuration options and best practices for cluster multi-tenancy (e.g. multiple teams within an organization, or multiple customers). Topics: control plane isolation, data plane isolation, additional considerations (e.g. priority and fairness, quality of service, etc.), and implementations.

iximiuz/awesome-container-tinkering
A list of awesome tools to tinker with containers, by Ivan Velichko. Categories:

• Container runtimes

• Image builders, viewers, editors

• Development environments

• Container networking tools

• Interesting GitHub organizations

Politics / Privacy

Former Uber security chief convicted of covering up 2016 data breach
I will write more about this next week. I’ve interacted with Joe Sullivan a few times in person, and I believe he’s a good man who always aims to do the right thing.

This Controversial Artist Matches Influencer Photos With Surveillance Footage
Belgian artist Dries Depoorter created a controversial new online exhibit, The Follower, which combines facial recognition and surveillance camera footage to determine where influencer photos were taken. This was one artist, imagine what China is doing.

Software Bill of Materials (SBOM)

ckotzbauer/sbom-operator
By Christian Kotzbauer: Catalogue all images of a Kubernetes cluster to multiple targets with Syft. Currently Git, Dependency Track, OCI-Registry and ConfigMaps are supported.

devops-kung-fu/bomber
By DJ Schleen and Nick Hopkins: Tool to scans SBoMs for security vulnerabilities. Uses OSV as the default provider, and it supports the SPDX, CycloneDX, and Syft formats.

The SBOM frenzy is premature
Mark Curphey describes some SBOM caveats.

5 tools for generating SBOM - Which is the best tool?
MergeBase’s Julius Musseau shares a comparison of five tools (CycloneDx, Syft, Microsoft’s tool, Fossa, Snyk) for how well they generate an SBOM both with and without source code available. Recommendation:

Machine Learning

A flower woman by 1500+ artists
Same prompt (“A woman with flowers in her hair in a courtyard, in the style of”), 1,500 artists.

DVC: Data Version Control
Open-source version control for machine learning projects. DVC tracks ML models and data sets, and is built to make ML models shareable and reproducible. It’s designed to handle large files, data sets, machine learning models, and metrics as well as code.

Secure your machine learning with Semgrep
To strengthen the machine learning ecosystem, Trail of Bits’s Suha Hussain has analyzed the source code of libraries and identified some common problematic patterns. They’ved turn those patterns into 11 newly released Semgrep rules so it’s easy to find and fix those potential bugs.

Prompt injection attacks against GPT-3
Neat post by Simon Willison. Prompt injection is basically SQL injection but for GPT-3 prompts. The way you use the GPT-3 API is by assembling prompts by concatenating strings together, often user input with a pre-written prompt string. This attack could leak prompts, cause unexpected behavior, etc.

Viral Post Generator
Given what you did today, some inspirational advice, and desired cringe level, this site uses AI to write the perfect LinkedIn post. Too real 😂

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I'd love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,

Clint