[tl;dr sec] #26 - Learnings from Duo, Auto-healing Clouds, Fuzzing

Hey,

I hope you’ve been doing well.

I’m excited to say this issue includes a new talk summary! The past few issues I’d been too busy with work, conferences, and checking in with loved ones so they know I’m still alive.

Oh also, the BSidesSF 2020 videos are live!

Cloud Security

AWS Automated Remediation - Part 1: Security Groups
Nathan Getty describes a customized system to automatically remediating high risk findings. This post discusses automatically removing open security groups, the second focuses on open S3 buckets.

Continuous compliance monitoring with Chef InSpec and AWS Security Hub
“How to run a Chef InSpec scan with AWS Systems Manager and Systems Manager Run Command across your managed instances. InSpec is an open-source runtime framework that lets you create human-readable profiles to define security, compliance, and policy requirements and then test your EC2 instances against those profiles. InSpec profiles can also be used to make sure certain network ports aren’t reachable, to verify that certain packages are not installed, and/or to confirm that certain processes are running on your instances.”

Introducing AWS Config Conformance Packs
“The latest addition to the AWS Config service: conformance packs. Conformance packs help you manage configuration compliance of your AWS resources at scale – from policy definition to auditing and aggregated reporting, using a common framework and packaging model.” The post also discusses adding custom rules, remediations (which can be automatically applied), and deploying a cross-organization conformance pack.

GitOps Security with k8s-security-configwatch
“K8s-security-configwatch is a Github Action that reviews the changes in your Kubernetes configuration files, highlighting those that can affect the security of the cluster. Reviewers can then take special care in those areas and ensure that the right eyes are validating every PR.” Detects changes done on Kubernetes SecurityContext objects, PodSecurityContext objects and the host namespaces settings.”

toniblyx / my-arsenal-of-aws-security-tools
Epic list of AWS security tools for defensive, offensive, auditing, DFIR, etc. Includes the tool name, URL, a concise description, number of stars, and useful metadata like last commit, number of open issues, etc. 🔥 

AWS Security Fundamentals (Second Edition)
A free, self-paced course by AWS that teaches “fundamental AWS cloud security concepts, including AWS access control, data encryption methods, and how network access to your AWS infrastructure can be secured.”

On-Demand Container Scanning API
Jerry Gamblin announced https://scan.vulnerablecontainers.org/, an open Python API which for now has two public endpoints: #1 provides a trivy report of all open vulnerabilities and #2 provides a list of open CVEs for the specified container.

Kubernetes Attack Surface
Slides on Kubernetes’ attack surface and a number of links to related work and useful tools.

Web Security

Exploiting an SSRF: Trials and Tribulations
Bug bounty walkthrough of bypassing a whitelist and other challenges in getting a PoC to work.

six2dez / wahh_extras
A number of extras from the Web Application Hacker’s handbook, including answers to prompts and relevant source code.

DNS Rebinding: Stealing WiFi creds through your solar panel inverter
Fun example of the impact of DNS rebinding in the real world, with a nice shout out to NCC Group’s DNS rebinding framework Singularity.

Blue Team

DoD Enterprise DevSecOps Ask Me Anything Sessions
I didn’t expect to come across a DoD page on DevSecOps, but hey. Contains a series of audio recordings, slide decks, and some maturity review, container hardening, and other docs.

Keeping Windows Secure
BlueHat IL 2020 talk by David Weston, Director of OS Security at Microsoft, on how to secure Windows at scale. I haven’t reviewed this talk in detail yet, but the slides look 💯 video 

Microsoft: 99.9% of compromised accounts did not use multi-factor authentication
Microsoft RSA presentation (slides) with some interesting results:

• 99.9% of the compromised accounts they track don’t use 2FA.

• Only 11% of enterprise accounts use MFA

• On average, around 0.5% of all accounts get compromised each month (1.2 million in January 2020)

• 40% of the compromised accounts are due to password spraying, another 40% are due to credential stuffing

• The vast majority of password spraying and password replay attacks target older legacy authentication protocols, such as SMTP, IMAP, POP, and others.

Advancing DevSecOps Into the Future
Post by Gunter Ollmann, CSO of Microsoft’s Cloud and AI Security Division, that concisely describes a number of the DevSecOps trends I’ve observed, and describes some forward thinking ideas, like communications between external tools and the apps they protect, the importance of standardizing threat and behavior nomenclatures, and the future potential of AI, both by attackers in rapidly exploiting environments, and by defenders in automatically detecting and patching issues. Gunter and I chatted a bit about this post on LinkedIn, which you can see here.

Fuzzing

Google Launches Free Fuzzer Benchmarking Service
Google released FuzzBench, fuzzer benchmarking as a service.

CIFuzz

Targeted Greybox Fuzzing with Static Lookahead Analysis
ICSE 2020 paper by Valentin Wüstholz and Maria Christakis:

Misc

youkaclub / youka-desktop
Karaoke for any song in any language. You can dance if you want to, you can leave COVID-19 behind 🕺💃 

IoTGoat - A Deliberately Insecure Firmware Based On OpenWrt
The built-in vulnerabilities are based on OWASP’s IoT Top 10 project.

SpiderFoot tutorials
17 ASCIIcasts on using the OSINT framework SpiderFoot, including researching data breaches, scraping names, emails, and phone numbers, etc.

An Introduction to Starkiller
A multi-user GUI for interfacing with the Empire C2 server.

International Women’s Day 2020: Building a Modern Security Team
One of my favorite parties this RSA was at Cloudflare - cool people, good food, and a rooftop bar with a nice view. I had the opportunity to meet more of the Cloudflare security team, and I was impressed by how genuine and kind everyone was. This article by Susan Chiang and Joe Sullivan has a number of concrete, actionable tips on their lessons learned building a diverse team and inclusive culture. Here’s one point that especially stuck out to me:

📚 New Summary: Learnings from Duo

I had the very fortunate opportunity this RSA to see Jon Oberheide give a frank, open, unrecorded talk of his experiences co-founding Duo through having it be acquired (shoutout to Haroon Meer for organizing).

With Jon’s permission, I’m sharing my notes.

The talk was dense with insights and useful takeaways, so I highly reading the full summary. Here are some of the key points:

Two of Duo’s values include engineering the business, treating the business like the product itself, constantly iterating on and improving it, and to be kinder than necessary.

In the beginning, the founders thought they’d build some advanced new security technology. Then they talked with customers, and realized account takeover was a core, recurring problem. Don’t just build something because it’s intellectually interesting, build something that solves a real problem.

To build a big, successful company, a) go after a big existing market, ideally b) with a weak incumbent.

• Attack this big, boring, immediate market opportunity while building towards a long term vision.

• Don’t try to create a new category if possible.

• Taking existing allocated budget is way easier than convincing businesses to allocate new budget.

Write down what you want to be. What do you want to be known for? How do you want to be viewed by customers in the market?

Design your go to market engine early. A smooth, fast, well-tuned customer journey can utterly disrupt the slow, high friction processes of your competitors. Can you have customers see value in the first 60 seconds of using your product? Can you help them start getting wins and have a “wow” moment in the first hour?

Duo hired for attitude and aptitude over experience. “No brilliant jerks.”

Teach empathy and communicate your company values in stories: those stick with people better than slogans on the wall.

You may be a founder, but it’s not your company. You have a lot of shareholders, and even more stakeholders. It’s important to stand up for the best interests of the company and the employees.

As you’re building a company, there will be many challenging decisions that will test your values. Doing the right thing will pay off in the long term.

Read the 👉 full summary here 👈

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I'd love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,

Clint