• tl;dr sec
  • Posts
  • [tl;dr sec] #233 - Awesome Detection Engineering, Security GPTs, How to Build a Cybersecurity Start-up

[tl;dr sec] #233 - Awesome Detection Engineering, Security GPTs, How to Build a Cybersecurity Start-up

Repo of detection engineering resources, Jason Haddix's security GPTs, 3 successful founders on building a security company

Author

Clint Gibler
May 30, 2024

Hey there,

I hope you’ve been doing well!

📦️ What’s in the box?

I was supposed to fly back from Florida → San Francisco yesterday, but my flight was canceled due to bad weather.

So I was checking into my hotel to spend the night, and as I was signing the standard waiver, I noticed it said that if you wanted to store something securely, the front desk has safety deposit boxes.

“Oh, does this mean there are no safety deposit boxes in the room?” I asked.

“That’s correct,” the receptionist said.

“Ah OK, no problem,” I replied.

“But if you’ve got something really important, that you want to keep secure, you can bring it up here. You know, if you have some…” she tilted her head to the side and clicked her tongue. “Some…” a wink and another tongue click.

I must confess, I don’t know what she meant, but I tried to play it cool, nodding knowingly, like I did. 11/10, would stay again 😂 

P.S. You can check delays and cancellations by airport by airline and origin/destination airport on FlightAware, they also have a Misery Map of live flight delays, and the FAA lists when an airport is closed or flights are being held (Ground Stop) due to weather.

Security can add asymmetric costs on our orgs, just as our orgs can incur outsized costs on us.

Rami McCarthy’s new guest post discusses this problem, with examples and tips for mitigating it, and very useful supporting links.

Excellent post, 👉️ read it here 👈️ 

Sponsor

📣 WorkOS, enterprise-grade auth trusted by Vercel, Perplexity, and Webflow

WorkOS is a modern identity platform that supports SSO, SCIM, user management, and RBAC. 

It recently acquired Warrant, a Fine Grained Authorization service based on Zanzibar, designed by Google to power Google Docs and YouTube. Warrant enables fast authorization checks at an enormous scale while maintaining a flexible model that can be adapted to even the most complex use cases.

The APIs are flexible and easy-to-use, allowing you to finish integrations in minutes.

If you need enterprise features like SSO, consider WorkOS—a drop-in replacement for Auth0. Best of all, it's free up to 1 million MAUs.

👉️ Get started for free 👈️

Congrats on the acquisition! Neat that Warrant is open source, based on Google’s Zanzibar, and can do permission checks locally 🤘

Entrepreneurship

13/14 cybersecurity acquisitions in the last 6 quarters are Israel-based
Crazy stat shared by Aleph’s Tomer Diari. Congrats to Cider Security (Palo Alto Networks), Axis, Lightspin (Cisco), Laminar (Rubrik), Ermetic (Tenable), Bionic (Crowdstrike), Perimeter 81 (Check Point) , Talon (Palo Alto Networks), Dig Security (Palo Alto Networks), Spera Security (Okta), Avalor Security (Zscaler), Flow Security, Gem Security (Wiz).

See Bessemer Venture Partners’ Cybersecurity trends in 2024 for more.

More Love, Less War
12min talk by Thinkst’s Haroon Meer on how focusing on customer love enabled them to bootstrap to $19M in ARR with <40 people and no outbound sales.

Clint Notes™️: their customer love page is powerful evidence when companies are doing a PoC, when customers change jobs they often bring Thinkst into their new company (they’ve had single people bring them in to 9 companies), they relentlessly focus on user workflows and UX, high quality swag and packaging, deliver on your promises, if you optimize for love you can get get in a positive reinforcement loop (customers appreciate it and you want to delight them more, you attract the right employees).

See also their blog Small Things Done Well.

Idea to Realization: Cybersecurity Entrepreneurship
BlackHat USA 2023 talk by Jon Oberheide on lessons learned from building Duo. Excellent talk on building the right product, culture and values, being in a hyper growth environment, and more. I saw an early version of this talk and wrote a detailed summary here. I still periodically reference lessons from this talk, thanks Jon! 🙏 (P.S. I’ve chatted with Jon a few times in person, super nice guy)

A Q&A with a16z's Zane Lackey: Unlocking the Secrets of Cybersecurity Entrepreneurship
BlackHat USA 2023 by my bud Zane Lackey on his perspective going from CISO to founder to total baddie VC. When DevSecOps was first becoming a thing, I watched one of Zane’s talks from like 5 years prior, and found it was still ahead of talks at the time.

If you want to watch some great panels on scaling security with Zane, me, and other cool folks, you can see this BSidesSF one or this DevSecCon one.

Sponsor

📣 What’s in your AI? 🤖💣

If a training dataset or model contained illegal information (like LAION-5B) or a disclosed and exploited vulnerability (like the Ray AI ShadowRay exploit), where would you go to determine if you’re exposed?  How can you get ahead of US and EU AI supply chain regulation?  Artificial Intelligence Bills of Materials (AIBOMs) are emerging as the future for inventorying AI components, and Manifest is building for that future. Check out our AIBOM whitepaper and join our pilot program to define the future of AIBOMs.

Adding AI to everything is all the rage these days, so it’s great to see resources on securing it. I’m curious to learn more about AIBOMs and where things are headed 🤔

Cloud Security

GoogleCloudPlatform/assured-workloads-terraform
Some Terraform to assist in using Assured Workloads, a Google product aimed at helping companies apply security controls that fulfill baselines for a compliance statute or regulation. Controls include mechanisms to enforce data residency, data sovereignty, personnel access, and more.

The Best Way to Start with AWS Security Hub
Rich Mogull gives a nice walk through of setting up AWS Security Hub in a low-cost way (disable Security Standards), and highlights its three primary capabilities: collecting events and results from nearly any other AWS security service, working as a Cloud Security Posture Management (CSPM) tool, and consolidating events and findings across accounts and regions in an Organization.

Publicly Exposed AWS Document DB Snapshots
Rami McCarthy walks through the process of scanning for publicly exposed AWS Document DB snapshots, finding one exposing personal and payment info for millions of Cinemark Brazil customers.

Rami also includes a really nice overview section of other researchers’ deep dives into publicly exposed AWS resources, including EBS, AMIs, RDS, and ECR Registry. Key takeaway: “There is a lot of juice left to squeeze in taking existing research and applying it to new services!” +1 from me on that.

Unmasking Adversary Cloud Defense Evasion Strategies: Modify Cloud Compute Infrastructure Part 2
For the Modify Cloud Compute Infrastructure techniques from the MITRE ATT&CK Cloud Matrix ('Create Snapshot', ‘Create Cloud Instance’, ‘Delete Cloud Instance’, ‘Revert Cloud Instance’ and ‘Modify Cloud Compute Configurations’), Permiso lists the AWS, GCP, and Azure logs that could detect them, and gives some high level/generic mitigation advice. Feels kind of like a post written for SEO.

Supply Chain

Pinned GitHub Actions
GitHub recommends pinning Actions to a full length commit SHA as it is currently the only way to use an Action as an immutable release. ControlPlane’s Fabian Kammel presents data that as of May 2024, only 2% of the top 10,000 GitHub repos (by stars) do so.

To automatically replace all tags and branches (these aren’t immutable) in your GitHub Actions with their corresponding checksum, you can use Stacklok’s frizbee, and you can use Renovate to easily update pinned Actions.

Introducing Siren by OpenSSF
Siren is a new threat intelligence sharing list hosted by OpenSSF, designed to aggregate and disseminate threat intelligence specific to open source projects, providing a secure and transparent environment for sharing Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs). The platform offers real-time updates on emerging threats, follows clear guidelines for intelligence sharing, and encourages community-driven contributions.

Malicious PyPI packages targeting highly specific MacOS machines
Datadog’s Sebastian Obregoso and Christophe Tafani-Dereeper describe a cluster of malicious PyPI packages, discovered using GuardDog, an OSS project the uses Semgrep and heuristics to identify malicious dependencies.

Interesting tradecraft, looks like this malware is super targeted: “The malware searches for a secret file matching a specific path pattern (e.g. /Library/Application Support/t*/*O*/*) and confirms it is the correct one using a one-way hashing function. This path acts as a secret key to decrypt the second-stage payload, making it close to impossible to determine the payload URL without knowing the secret file path.”

Blue Team

infosecB/awesome-detection-engineering
By Brendan Chamberlain et al: A collection of detection engineering resources across: Concepts & Frameworks, Detection Content & Signatures, Logging, Monitoring & Data Sources, and General Resources.

Ask Reddit: What's the worst case of insider threat incidents you have seen?
Oof, stories of terrible security misconfigurations, IP theft, and other shenanigans.

What is a Threat Cluster?
The Vertex Project explains that a threat cluster is a set of related malicious activity presumed to be carried out by an individual or group of individuals acting in concert, which over time, as you learn more (how they operate, if their primary goal is espionage or profit), may get labeled a “threat group,” like Lazarus or Volt Typhoon.

The post walks through how graphing the relationship between TTPs (URLs, domains, malware, …) can help you understand a threat cluster, and potentially merge it with other threat clusters or a threat group.

Fuzzing

GJDuck/RRFuzz
Program Environment Fuzzing (EFuzz) is a new type of fuzzer that can fuzz just about anything, including: network servers/clients, GUI apps, editors, compilers, databases, any other Linux user-mode software, etc.

Unlike existing fuzzers, which only fuzz a specific input source (like AFL), EFuzz fuzzes the entire interaction between the subject and its environment, including all files (configuration, cache, resource, fonts, etc.), sockets (session manager, accessibility service, name service, etc.), user interactions via the windowing system, special files, devices, and standard streams.

Introducing Ruzzy, a coverage-guided Ruby fuzzer
Trail of Bits’ Matt Schwager introduces Ruzzy, a coverage-guided fuzzer for Ruby code and Ruby C extensions, inspired by Google's Atheris, a Python fuzzer, both use libFuzzer for their coverage instrumentation and fuzzing engine.

I enjoyed the details on writing fuzz harnesses in Ruby such that the C/C++ fuzzing code can call it, compiling Ruby C extensions with libFuzzer, and the arcane wizardry in reviewing Ruby’s source code to figure out how to get real-time coverage info from Ruby code into libFuzzer.

Coverage Guided Fuzzing - Extending Instrumentation to Hunt Down Bugs Faster!
Include Security’s Bruno Oliveira provides a nice overview of coverage guided fuzzing, and the power of extending the instrumentation to track the real-time stack trace of a target program and using historical vulnerability identification data (e.g. what files/functions have previously had vulnerabilities? Where is the “dangerous” code?) to guide the fuzzing process.

Bruno walks through using Fuzzili, a JavaScript engine fuzzer by Google’s Project Zero, on JerryScript as an example.

AI + Security

Jason Haddix’s Security GPTs for NahamCon
Several work-in-progress custom GPTs, including a XSS mutation bot, acquisition and recon bot, bug bounty report bot, and overall cybersecurity bot.

Large Language Model guided Protocol Fuzzing
NDSS 2024 paper by Ruijie Meng, Martin Mirchev, Marcel Böhme, and Abhik Roychoudhury. This paper describes ChatAFL (GitHub), a protocol fuzzer that constructs grammars for each message type in a protocol, and then mutates messages or predicts the next messages in a message sequence via interactions with LLMs. The fuzzer uses the LLM to:

  1. Extract a machine-readable grammar for a protocol that is used for structure-aware mutation.

  2. Increase the diversity of messages in the recorded message sequences that are used as initial seeds.

  3. Break out of a coverage plateau, where the LLM is prompted to generate messages to reach new states.

Compared to AFLNET and NSFUZZ, ChatAFL covers ~45% more state transitions, ~26% more states, ~6% more code, and discovered nine distinct and previously unknown vulnerabilities vs three and four for AFLNET and NSFUZZ. Neat work 🙌 

AI red-teaming tools helped X-Force break into a major tech manufacturer 'in 8 hours'
Article on The Register, interviewing Chris Thompson, global head of X-Force Red, about how their AI automation helped them compromise "the largest manufacturer of a key computer component in the world."

This is headline-y and grabs your attention, but I think there’s key technical info missing to actually evaluate how interesting this is. Probably because the article is for a mainstream, non technical audience.

1) Breaking into a major tech manufacturer in 8 hours. This sounds impressive, but from my consulting days at NCC Group, if I had $1 for every time a colleague got Domain Admin on a red team before lunch on the first day, I could buy multiple avocado toasts in San Francisco (and a house if I didn’t buy the toast #BoomerLogic).

2) What we actually want to know is: how much more effective did the AI automation make the testers?

  • Ideally you’d want something like: we had the same testers assess 10 (ideally more) companies with and 10 without our AI automation. They were able to achieve OUTCOME X% faster or in Y% more of the tests with AI.

  • Or even breaking it down to specific tasks: testers got A% better attack surface coverage in B% less time, found C% higher criticality bugs, etc.

  • Another challenge is different companies, even within the same industry, may have wildly different security maturity/posture, so you’d want to account for that, for example, by normalizing your AI automation stats by the historical pen test (or bug bounty) results each company has had (e.g. number of findings x criticality results). That is, you don’t want to say “our AI automation is awesome” when your sample set targets just had a weak security posture.

3) It’s unclear from the article how much of the automation was traditional automation vs AI, so of the “automation” lift, how much was AI? For example, the automation could make testers 50% more effective, but 45% of that were from non-AI related automation.

4) It’s unclear from the article exactly how the AI automation helped, what tasks it performed or workflows it streamlined.

Welp, this section is almost as long as the original article 😅 

To be clear, X-Force Red has some very talented people and I’m sure their AI automation is helpful. I’d love to learn more technical details about it.

I wrote this because I think as a security professional it’s important to think critically about exciting news articles you see, and ask yourself what info or data you’d want to see to back up a given claim. Maybe it’s the former PhD student in me who’s used to reading papers and belligerently questioning methodology and claimed results 🤓 

By the way— do you like longer blurbs like this?

If so, feel free to reach out directly and let me know, I always really appreciate feedback 🙏 

AI

Privacy and things going wrong

OpenAI’s new safety committee is made up of all insiders
“Quartz notes that, besides Sutskever, Kokotajlo, Leike and Krueger, at least five of OpenAI’s most safety-conscious employees have either quit or been pushed out since late last year.”

“OpenAI’s Superalignment team, responsible for developing ways to govern and steer “superintelligent” AI systems, was promised 20% of the company’s compute resources — but rarely received a fraction of that.”

Auto-generating tests

Prompting

Misc

Misc

New ZAP gRPC Add-on
Amit Panwar announces that the popular web security testing tool ZAP now has an Add-on designed to streamline testing of gRPC endpoints, offers tools for encoding and decoding Protobuf messages, and can be combined with existing ZAP functionality. Shout-out to Crash Override who sponsored this work.

See blackboxprotobuf by NCC Group for a similar Burp extension.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint
@clintgibler