[tl;dr sec] #167 - SBOM, Scaling Security Alert Management, Mitigating RBAC-Based PrivEsc in Kubernetes

Hey there,

I hope you’ve been doing well!

Come say “How ya?” at OWASP Dublin

If you’re going to be attending OWASP Global AppSec in Dublin, you can hang out with some of my cool colleagues!

Fall in love all over again with open source security tools at a Happy Hour Mixer, co-hosted with Jit, on Tuesday Feb 14 (Valentine’s Day).

You can also check out our Expert Panel with some awesome folks who will be discussing scaling security programs and running highly effective AppSec/ProdSec teams.

Hope to see you there!

Moar Staff Security Engineer Stories

I’m thrilled to announce that Rami McCarthy has rounded up two new stories you can read now:

• Jonathan Fisher from Praetorian Labs on “Staff Level” work in a consulting team

• Anthony Barbieri, Principal Security Architecter at Grainger, on his experience at the intersection of enterprise and solution architecture, and “innersourcing” as a lever for Staff+ Impact

If you’re Staff or Principal level and you’d like to share your story too, feel free to reach out to Rami!

Software Bill of Materials (SBOM)

eclipse/jbom
Generates Runtime and Static SBOMs for local and remote Java apps.

eBay/sbom-scorecard
When generating first-party SBOMs, it’s hard to know if you’re generating something good (e.g. rich metadata that you can query later) or not. This tool hopes to quantify what a well-generated SBOM looks like.

Fast and Furious: Doubling Down on SBOM Drift
Anchore’s Josh Bressers describes how an application’s dependencies, as analyzed by Syft, change from your initial direct dependencies, to transitive dependencies after npm install, to adding a container image, etc.

AppSec

Vulnerabilities due to XML files processing: XXE in C# applications in theory and in practice
PVS-Studio’s Sergey Vasiliev provides an overview of XXE, relevant C# components, an example vulnerability, and how to protect your code.

aws-samples/automated-security-helper
A tool that simply wraps a number of other open source tools, including git-secrets, bandit, Semgrep, Grype, Syft, nbconvert, npm-audit, checkov, cdk-nag and cfn-nag.

Using Semgrep with Jupyter Notebook files
NCC Group’s Jose Selvi describes using Semgrep’s “extract” mode to scan Python code in Jupyter Notebooks. Extract mode can be used to analyze specific parts of a file that may be in another language, like Bash in a Dockerfile or GitHub Action workflow, JavaScript in HTML, etc.

Semgrep initially wasn’t quite doing what Jose wanted for this use case, so he submitted a PR adding that functionality! Huzzah, the power of open source 🙌

Web Security

Checkmarx/capital
By Checkmarx: A built-to-be-vulnerable API application based on the OWASP top 10 API vulnerabilities. Use c{api}tal to learn, train and exploit API Security vulnerabilities within your own API Security CTF.

Ransacking your password reset tokens
Positive Security’s Lukas Euler describes how the popular Ruby library “Ransack” can be abused to exfiltrate sensitive data via character by character brute-force. They compromised multiple applications this way and found hundreds more via Common Crawl that could be vulnerable.

Truffle Security is proud to host a new XSSHunter
Truffle Security has partnered with the creator of XSSHunter, Mandatory, to stand up a new version of the popular open-source blind cross-site scripting detection platform that comes with a number of privacy and feature enhancements. Enhancements include:

• CORS analysis

• Detection of secrets on the page the payload fires

• Detection of exposed .git directory

• Privacy features that reduce the risk of accidental data breach

• Google SSO login to prevent the use of passwords

Cloud Security

AWS Could Do More About SSO Device Auth Phishing
Great overview by Rami McCarthy about SSO device auth phishing, what AWS should and could do, and what you can do to protect your org.

Tampering User Attributes In AWS Cognito User Pools
Doyensec’s Francesco Lacerenza and Mohamed Ouad share another CloudSec tidbit: In AWS Cognito, App Integrations (Clients) have default read/write permissions on User Attributes. Consequently, authenticated users are able to edit their own attributes by using the access token (JWT) and AWS CLI, which could let a user escalate their privileges or access another user’s data.

tinystacks/precloud
An open source CLI that runs checks on infrastructure as code to catch potential deployment issues before deploying. It contains rules that check for names, quotas, and resource-specific constraints and it works by comparing resources in CDK diffs and Terraform Plans against the state of your cloud account.

EmojiDeploy: Smile! Your Azure web service just got RCE’d ._.
Ermetic’s Liv Matan describes the process of finding an RCE affecting services such as Function Apps, App Service and Logic Apps on Azure cloud and other cloud sovereigns.

What I found interesting about this write-up is the nuances around bypassing the server’s origin check, experimenting with how browsers treat special characters, and dealing with Same Origin Policy preflight requests.

Solving for Cloud Security at Scale with Chris Farris
Chris Farris joins Corey Quinn on Last Week in AWS to discuss how he wound up in the world of DevRel at Turbot and what he sees for the future of multi-cloud security practitioners.

Container Security

groundcover-com/caretta
An instant Kubernetes service dependency map, right to your Grafana. Carreta leverages eBPF to efficiently map all service network interactions in a Kubernetes cluster, and Grafana to query and visualize the collected data.

Mitigating RBAC-Based Privilege Escalation in Popular Kubernetes Platforms
Previously, Prisma Cloud and Unit 42 released a report examining the use of powerful credentials in popular Kubernetes platforms (AKS, EKS, GKE, and more), which found most platforms install privileged infrastructure components that could be abused for privilege escalation.

In this post, Palo Alto Networks’s Yuval Avrahami walks through the different mitigations the platforms implemented to address privilege escalation and powerful permissions in Kubernetes.

Blue Team

Trends and Top Cybersecurity Takeaways from 2022
entinelOne shares attack trends based on telemetry from tens of millions of endpoints, covering the top ransomware variants, initial infection vectors, emerging malware, most used commodity tooling and techniques, notable cybercrime toolkits, and more.

Employee-facing Mutual TLS
Follow-up post by Armen Tashjian on Pinterest’s device authentication and compliance initiative, describing how they’ve implemented employee-facing mutual TLS with a custom identity provider in a way that results in a positive user experience.

Elevating Security Alert Management Using Automation
Josh Liburdi describes the Brex Detection and Response Team’s approach to managing and automating security alerts at scale. Covered topics include:

• Requirements for Scaling Alerts

• Blueprint for a Loosely Coupled Alert Management System

• Contextual Suppression and Deduplication

• Artisanal and Mass-Produced Automation

• Labeling, Metrics, and You

• Choosing Impactful Metrics

Machine Learning

Never write a commit message again (with the help of GPT-3)
A post describing gptcommit, a new tool that uses the official completions API from OpenAI to summarize the changes in each file.

Summary: Andrej Kaparthy on Lex Fridman’s Podcast (Late 2022)
Daniel Miessler’s summary of this podcast.

Misc

Super Agent
A browser extension which lets you decide which cookies you want and don’t want, auto-accepts cookie pop-ups for you, and warns you whenever it finds a website not respecting your preferences.

awslabs/smithy
A protocol-agnostic interface definition language and set of tools for generating clients, servers, and documentation for any programming language.

MrBeast helps thousand people with eyesight issues see again
Wow, awesome. Also, America: where YouTube influencers provide healthcare that our government won’t 🦅 #JusticeIsBlind #SoIsFreedom

All the (open) world’s a stage: how the video game Fallout became a backdrop for live Shakespeare shows
Apparently a group is rehearsing and performing live Shakespeare plays within Fallout. I love this.

Need help with students who’ve turned my class into a dating service
Academia Stack Exchange post. At some university, senior engineering students have created an app that aggregates the diversity data the university publishes, and then lists courses that would be easy for engineering majors to excel in in which the majority of the class is young women. Drama ensues.

How to Be 18 Years Old Again for Only $2 Million a Year
His routine is unbelievable.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I'd love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,

Clint