👵 Mrs. Doubtfire: The Musical

I'm writing this after just getting back from watching Mrs. Doubtfire: The Musical.

If you’re not familiar, this was originally a 1993 movie starring Robin Williams, as a man who gets divorced, and ends up playing a Scottish nanny to spend time with his kids.

I must confess, before seeing it, I definitely chalked it up as, “Things I never thought would be / don't need to be a musical,” but it was actually pretty good.

While he’s no Robin Williams, the lead was great at doing a bunch of different accents and characters.

There were some fun scenes of him creating a song on the fly using a looping machine, dancing in a body suit + bathing suit for his ex’s clothing brand launch, and of course a scene in which he has to change in and out of costume in seconds, including the face mask.

What’s your favorite Foo: The Musical you’ve seen? Or what would be crazy that you think should be made?

Sponsor

📣 SSO Lulls Enterprises Into a False Sense Of Security, Study Finds

As organizations increasingly rely on Single Sign-On (SSO) for centralized authentication, Identity Providers (IdPs) have become prime targets for threat actors. 

Teleport's latest research paper, "Defending Against Identity Provider (IdP) Compromise," developed with security researchers at Doyensec, explores the current threat landscape, reviews key hardening and configuration strategies for protecting systems and data from an IdP compromise, and offers a detailed checklist for implementing your defense strategy with Teleport for defending core infrastructure from IdP breaches.

👉️ Learn more 👈

AppSec

Bypassing Okta’s Passwordless MFA: Technical Analysis and Detection
Rezonate’s Ron Marom walks through how OktaTerrify and OktaInk (security tools previously included in tl;dr sec, developed by Ceri Coburn) can be used to bypass Okta's passwordless MFA, Okta FastPass.

OktaTerrify, running on the attacker’s machine, intercepts token exchanges and emulates Okta FastPass, while OktaInk, running on the victim’s machine, creates valid FastPass tokens accepted by Okta's backend.

Binary secret scanning helped us prevent (what might have been) the worst supply chain attack you can imagine
JFrog’s Andrey Polkovnichenko, Brian Moussalli and Shachar Menashe found a leaked GitHub access token (PAT) with admin privileges to Python's core repositories in a public Docker container, which could have allowed an attacker to insert malicious code into any Python package or even the language itself. The access token initially slipped through because it was in a compiled Python file (__pycache__/build.cpython-311.pyc).

💡 Secrets can leak in all sorts of sneaky ways beyond just direct source code files: compiled code like in this case, .env files that accidentally get committed, Dockerfiles whose commands subtly copy the current working directory into the image (including .env files or other creds), etc. 😅

Phantom Secrets: Undetected Secrets Expose Major Corporations
Aqua’s Yakir Kadkoda and Ilay Goldman scanned the top 100 organizations on GitHub, ranked by stars, which together have >50K repos, and found that nearly 18% of secrets are missed by traditional scanning tools.

They deep dive into why secrets may not be discovered, highlighting the difference between git clone and git clone --mirror , and outline four different strategies to retrieve SCM cached view commits. Here there be dragons.

💡 This post is a great example of taking a specific topic, going deep, teaching some technical nuance (e.g. git internals), finding a bunch of subtle cases, and applying a methodology at scale. Highly recommend reading.

Sponsor

📣Apple's Spyware Warning Highlights the Need for Robust Mobile Protection – Apathy is No Longer an Option

Apple has notified people of commercial spyware attacks twice in the last three months, but post-infection notifications aren't enough. Spyware attacks can be detected in real-time and iVerify has identified 2.5 infected mobile devices per thousand scanned. This indicates an infection rate of 2.5 million devices globally! iVerify’s advanced mobile EDR solutions combine threat detection and mobile forensics with automated response and remediation to protect against mobile malware, unpatched vulnerabilities, smishing, and credential theft.

👉 Learn more from iVerify's research team 👈

2.5 infected mobile devices per thousand, yikes! 😅 The Trail of Bits and spin-off folks know their stuff.

Cloud Security

Attack Paths Into VMs in the Cloud
Research by Palo Alto Unit 42 reveals that 11% of cloud hosts exposed to the internet have critical or high-severity vulnerabilities. In this article, Jay Chen explores various attack paths, such as startup script manipulation, SSH key push, direct code execution, SSH over middleware, and serial console access, across AWS, Azure, and Google Cloud Platform, and provides mitigation strategies.

AWS OIDC Provider Enumeration
Rami McCarthy has built a PoC based on Nick Frichette‘s research that enumerates AWS account IDs that have the GitHub Actions OIDC provider configured, leveraging the known_aws_accounts repository. Rami identified 34 accounts across 29 vendors with the OIDC provider configured.

💡 I like the quick prototyping and bias to action in this blog post, a nice example of testing a hypothesis quickly.

AWS without Access Keys
Moss Lilley explains how to use OIDC tokens for secure AWS resource access without traditional access keys. By configuring Fly.io as an Identity Provider in AWS IAM, you can link it to IAM roles and use the Role ARN to get short-lived AWS credentials through AWS STS. This streamlines the process and eliminates the need for keypair management, thus reducing the risk of exploitation.

💡 This is a great example of a platform making thoughtful and clever choices that significantly improves the security posture of their users, and has a great UX. Love it!

Container Security

Sneaky write hook: git clone to root on k8s node
Imre Rad describes an unpatched security vulnerability affecting the gitRepo volume driver on Kubernetes. This flaw can be exploited to execute commands via a specially crafted Git repository (using a post-checkout git hook), potentially gaining root access on a Kubernetes node. There’s a PR out for a fix that should land in Kubernetes 1.31.

See also Fun With GitRepo Volumes by Rory McCune for more on exploiting and mitigating this issue.

Securing the Container World with Policies: acjs and ctrdac
Google’s Imre Rad announces two new open source projects. acjs, a Kubernetes admission controller, uses JavaScript for flexible policy management and can function as both a validating and mutating webhook. ctrdac is an adapter for using admission controllers with Docker/containerd (outside of Kubernetes clusters).

The post provides examples of how these tools can be used to reject privileged containers, verify image provenance, and mitigate specific vulnerabilities like the gitRepo volume driver issue.

Supply Chain

ratify-project/ratify
An artifact ratification framework for Kubernetes that verifies artifact security metadata and only allows deployments that comply with predefined policies.

Chainguard Enhances Security with OSV Advisory Feed
Chainguard announces the publication of its security advisory feed in the Open Source Vulnerabilities (OSV) format, a standardized and machine-readable format for vulnerability information.

RoguePuppet – A Critical Puppet Forge Supply Chain Vulnerability
Adnan Khanwalks through a GitHub Action misconfiguration within Puppet Labs' public repositories that could have allowed attackers to obtain an API key used to push official modules to Puppet Forge. The vulnerability: using pull_request_target in a GitHub Action that also includes a call to bundle lock, which will execute any system commands within Gemfiles if they are present.

Adnan, like the gentleman and scholar he is, will be releasing the tool (Gato-X) he found this issue with along with his talks at DEF CON and BlackHat with John Stawinski.

How to create a multi clusters secure supply chain (SLSA 3) in 10min
Jean-Philippe Gouin provides a step-by-step guide to creating a secure multi-cluster Kubernetes supply chain while adhering to SLSA L3, using tools like Kind for cluster setup, Argo Workflow and Argo Event for orchestration, Kpack for building OCI images, vCluster for isolation, Syft for generating SBOMs, and Cosign for signing artifacts and generating attestations.

The process involves using two Kubernetes clusters—one for builds and one for running applications—with all scripts available on GitHub.

Blue Team

blackorbird/APT_REPORT
A big collection of reports and IOCs for over 50 APTs, by blackorbird.

incidentalhq/incidental
By Sanj Ambalavanar: An open-source incident management platform that integrates with Slack.

Impair Defenses [T1562.012]: Detect Linux Audit Logs Tampering
Aleksandar Matev describes methods to detect unauthorized changes to Linux auditd rules and configurations, which attackers may do to disable logging and conceal their actions. He also shares auditd rules and Splunk queries to help identify these changes and ensure the reliability of audit logs.

Monitoring for Suspicious GitHub Activity with Google Security Operations
David French details how to ingest GitHub audit logs into Google Security Operations to monitor and detect suspicious activities in a GitHub Enterprise environment. He shares 26 YARA-L rules for detecting anomalies, such as a high number of cloned private repositories, installation of GitHub applications within an organization, the audit log stream being modified or destroyed, 2FA being disabled, and more.

Red Team

pumpbin/pumpbin
By b1nhack: An implant generation platform written in Rust that supports the Extism plugin system. It also generates encrypted implants with randomized data, ensuring each implant is unique.

Getting Started with Exploit Development
DAY[0] shares a detailed guide to getting started with exploit development, focusing on turning memory corruption bugs into arbitrary code execution, recommending resources like Pwn College, ROP Emporium, Open Security Training, and more.

Silently Install Chrome Extension For Persistence
This article explains how to silently install any Chrome extension and avoid common indicators of compromise (IOCs). The method avoids using command line parameters or registry edits, and ensures persistence by adding the extension ID to the JSON blob in the Secure Preferences file and recalculating the HMAC hashes using the user SID and a hardcoded seed.

AI + Security

Introducing Substrate — An Open-source Framework for Human Understanding, Meaning, and Progress
An ambitious vision by my bud Daniel Miessler on an open-source framework designed to catalog and visualize human ideas, problems, beliefs, models, frames, solutions, arguments, and more, one of the goals being to strengthen our shared understanding of reality, and hopefully allow us to disagree with each other in a far healthier way.

If you want more on how Daniel integrates AI into his life, he’s doing the next iteration of his course Augmented next Friday.

Introducing RedFlag: Using AI to Scale Addepar's Offensive Security Team
Addepar’s Thomas Greenwood and Blane Honeycutt describe RedFlag, a new open source tool that uses AI to identify high-risk code changes. It analyzes each PR in a bi-weekly Platform Release Candidate (RC), enriches it with related Jira ticket information, and determines if it’s worth a manual security review.

RedFlag allows them to review 100s of PRs and determine what needs to be tested in ~10 minutes, generates a security test plan and outlines specific attack vectors and risky code for high risk PRs, and can automatically add designated reviewers.

eyeballvul: a future-proof benchmark for vulnerability detection in the wild
A paper by Timothée Chauvin, describing a new benchmark created to evaluate the vulnerability detection capabilities of long-context models on entire codebases. It currently contains over 24,000 vulnerabilities across 6,000+ revisions and 5,000+ repositories, and is sourced and updated weekly from the stream of published vulnerabilities in open-source repositories (OSV).

💡 This is very cool work, and is a great example of where we should be heading in AI: less “yeah, errrr, it mostly works in my one-off experiments #vibes” and more, “I have a rigorous dataset demonstrating in which contexts my approach works, and how much different factors affect the results.” LLLM4Vuln below also has a nice data-driven approach.

LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs' Vulnerability Reasoning
This paper aims to decouple LLMs' vulnerability reasoning capability from their other capabilities (e.g. seeking additional info via function calling, retrieving vulnerability knowledge like via RAG, etc.). and proposes a unified evaluation framework named LLM4Vuln.

They had GPT-4, Mixtral, and Code Llama analyze 75 ground-truth smart contract vulnerabilities as well as 4,950 different scenarios, and identified 9 zero-day vulnerabilities in two pilot bug bounty programs, earning >$1,000. The paper also examines the varying effects of knowledge enhancement, context supplementation, prompt schemes, and models.

Misc

• Pattern of Brain Damage Is Pervasive in Navy SEALs Who Died by Suicide - Basically repeated exposure to blasts eventually causes long term damage

• How Dropout went from CollegeHumor to media powerhouse - Focused on streaming, delighting watchers, not trying to hit crazy growth targets, treating employees well. The CEO sounds like a good dude.

• Ali Abdaal - The Pursuit of Wealth: Barista to Billionaire - Andrew Wilkinson - Fascinating perspective on how comparative and unhappy some of the ultra wealthy are.

• Daniel Miessler on How the Far-left Will Elect Trump in November 2024 - The far-left is pushing a horribly negative view of the US that most moderates reject.

• Plutchik’s Wheel of Emotions - Psychologist Robert Plutchik thought that there are 8 basic emotions: joy, trust, fear, surprise, sadness, anticipation, anger, and disgust. This page breaks it down visually.

• Chinese hackers are increasingly deploying ransomware to obfuscate their operations.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint
@clintgibler