• tl;dr sec
  • Posts
  • [tl;dr sec] #67 - Infra as Code, Cloud Auto-remediation, C.R.E.A.M

[tl;dr sec] #67 - Infra as Code, Cloud Auto-remediation, C.R.E.A.M

[tl;dr sec] #67 - Infra as Code, Cloud Auto-remediation

January 21, 2021

tl;dr sec is a newsletter about AppSec and scaling security, automated bug finding, conference talk and paper summaries, and useful links from around the web. You can subscribe here and see past issues here.

(You can also read this issue on our blog

)

Hey there,

I hope you’ve been doing well!

  RIP Adobe Flash 

I saw this in Tanya Janca’s newsletter and it made me laugh. H/T @Raybeorn for originally sharing.

  2021 Sponsorships Available! 

Shameless plug: I have a number of open slots for sponsors!

If you want to get your job ad or product in front of thousands of security professionals, ranging from ICs to team and org leads, CISOs, VCs, and more at companies ranging from small start-ups to FAANG-sized, you can respond directly to this email 👋

Each issue is sponsored exclusively by one company, and I do ~49 per year, so supplies are limited.

Call in the next 30 minutes and I’ll throw in a set of steak knives* and maybe write you a haiku**.

* Subject to tl;dr sec merch store availability** Infinite supply

Sponsor

  📢 How many third party applications are connected to your SaaS environment? 

AppOmni’s data reveals that enterprises have an average of 42 third party applications connecting to their SaaS environments. Of these applications, 22 haven’t been used for over six months but still have access to sensitive SaaS data. The nature of these connections makes them difficult for IT and security teams to manage and secure. Some are added by end users without security teams ever knowing. AppOmni’s CEO, Brendan O’Connor, details how third party applications can compromise otherwise secure SaaS environments and how security teams can best manage this risk.

📜 In this newsletter...

🔗 Links:

  • Web Security: Swiss Army knife proxy tool

  • Cloud Security: Compliance-as-code and auto-remediation with Lambdas + Cloud Custodian, Scott Piper on Last Week in AWS

  • Infrastructure as Code: Effectively rolling out IaC scanning, musings on threat modeling via IaC, purposefully vulnerable Terraform infrastructure

  • Container Security: Exploring rootless Docker

  • Blue Team: NSA recommendations on how enterprises can securely adopted encrypted DNS (DoH)

  • Red Team: macOS post-exploitation via VSCode extensions

  • Misc: Daniel Miessler on life purpose and maximizing appreciation of life, book on risk communication for security leaders, Pirate Bay founder throws some shade

  • Quote: Inspiring but height-ist thoughts on hiring

  • Cash Rules Everything Around Me: It's hard to speak truth to power when there are large economic consequences

Web Security

projectdiscovery/proxifySwiss Army knife proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go. Supports multiple operations such as request/response dump, filtering and manipulation via DSL language, and upstream HTTP/Socks5 proxy. Includes a replay utility allowing importing into Burp or any other proxy by simply setting the upstream proxy to proxify.

  Cloud Security 

Compliance-as-code and auto-remediation with Cloud CustodianAWS blog post about using Cloud Custodian + Lambdas to enforce compliance-as-code and auto-remediation. Cloud Custodian is an open source, stateless rules engine that offers policy-level execution against multiple kinds of event streams, including CloudWatch Events, CloudTrail events, and more. 

Best Practices for AWS Security - Part 1 with Scott PiperScott Piper joins Corey Quinn on Last Week in AWS to discuss flaws.cloud, the fwd:cloudsec conference, what Scott thinks AWS does and doesn’t do well, and what Scott believes is the best security boundary on AWS. 

Infrastructure as Code

Building an IaC security and governance program step-by-stepBridgecrew’s Guy Eisenkot gives a nice overview of how to roll out an infrastructure as code scanning platform, including various trade-offs: leveraging your existing CI/CD pipeline or code hosting platform, annotating PRs with comments vs blocking the build, setting expectations and SLAs with dev teams, and leveraging approval rules and CODEOWNERS files.

Shifting Threat Modeling Left: Automated Threat Modeling Using TerraformIn this HashiConf Digital 2020 talk, Accurics co-founder Om Moolchandani describes how one can (in theory) extract information like resource (mis)configurations, resource relationships, network relationships, identity access and privilege relationships, trust boundaries, exposure, and more from Terraform code. He then demo’d using their open source tool terrascan.

I think building a model of an environment via analyzing infrastructure as code files (Terraform, CloudFormation, etc.) is a very promising and currently underutilized idea. While this talk references the idea of doing that, based on my read, it does not appear terrascan is currently leaning into this, but is rather scanning for a set of known misconfigurations (like most other existing tools).

Purposefully vulnerable Terraform infrastructure by 

.

Container Security

Exploring Rootless DockerRootless containers have left experimental status in Docker 20.10. Rory McCune describes peaking a bit under the hood to see what’s going on and how it compares to standard Docker re: user namespaces, capabilities, AppArmor, seccomp, and trying to break out.

  Blue Team 

NSA Recommends How Enterprises Can Securely Adopt Encrypted DNSThe NSA published a document explaining the benefits and risks of adopting the encrypted domain name system (DNS) protocol, DNS over HTTPs (DoH), in enterprise environments. Here’s a diagram from the 7 page PDF:

  Red Team 

macOS Post-Exploitation Shenanigans with VSCode ExtensionsMDSec’s Dominic Chell describes the process of creating a malicious VSCode extension on macOS that can be useful post-exploitation. In short: create a repo template with Yeoman, run JXA through osascript, then use Mythic or another C2 for persistence if you want.

  Misc 

Maximizing Appreciation of LifeOne thing I admire about my bud Daniel Miessler is how reflective he is. He’s played an influential role in helping me mentally flesh out what I want tl;dr sec to be, and how I want to navigate my career and life (“If everything were to go perfectly, where would you want to be in 10 years?”). Here’s Daniel’s life purpose 👇 I’m still working on mine. Do you know what yours is?

I enjoy finding patterns in how people pursue meaning, constructing models for how said meaning works, and then creating, discussing, and sharing possible frameworks for improving it.

 

Responding to Community Outrage: Strategies for Effective Risk CommunicationRecommended by Devdatta Akhawe: “One of my favorite books about risk communication for security leaders is actually written in the context of public health/safety.” 

Over the years, Kolmisoppi and The Pirate Bay crew explored no limit of strategies to keep its servers operational and out of the reach of law enforcement and the entertainment industry, even when that meant hiding them in caves and submarines, or even using low-orbit drones to redirect users to hidden regional servers hosting torrent indexes and trackers.

Quote

“If you always hire people who are smaller than you are, we shall become a company of dwarfs.

If, on the other hand, you always hire people who are bigger than you are, we shall become a company of giants.” — David Ogilvy

  Cash Rules Everything Around Me 

An Oscar Winner Made a Khashoggi Documentary. Streaming Services Didn’t Want It.It is fundamentally hard (and unlikely) for global companies to step on any nation state toes that could lead to massive revenue loss.

That’s why, for example, Apple removed the Taiwan flag emoji for Chinese iPhones and all mainland China iCloud users have their data stored by a firm started by the Chinese government (#lolprivacy).

Bryan Fogel’s first documentary, “Icarus,” helped uncover the Russian doping scandal that led to the country’s expulsion from the 2018 Winter Olympics. It also won an Oscar for him and for Netflix, which released the film.

For his second project, he chose another subject with global interest: the killing of Jamal Khashoggi, the Saudi Arabian dissident and Washington Post columnist, and the role that the Saudi crown prince, Mohammed bin Salman, played in it.

But when Fogel reached out to Netflix and many other streaming services, he didn’t hear back.

In January 2019, Netflix pulled an episode of the comedian Hasan Minhaj’s series, “Patriot Act,” when he criticized Prince Mohammed after Mr. Khashoggi’s death. Mr. Hastings later defended the move, saying: “We’re not trying to do ‘truth to power.’ We’re trying to entertain.”

“This is unquestionably political,” said Stephen Galloway, dean of Chapman University’s film school. “It’s disappointing, but these are gigantic companies in a death race for survival. You think Disney would do anything different with Disney+? Would Apple or any of the megacorporations? They have economic imperatives that are hard to ignore, and they have to balance them with issues of free speech.”

Also:

In November, Netflix signed an eight-picture film deal with the Saudi Arabian studio Telfaz11 to produce movies that it said “will aim for broad appeal across both Arab and global audiences.”

The point here is not to wag a finger at one particular company, but rather to point out that with strong economic incentives, you don’t need to be able to “force” someone (person, company, nation) to do something, they’ll do what’s in their best interests.

This has strong implications for:

  • The movies and TV shows we see (and don’t see).

    • China is a massive market, don’t expect big media players to produce critical pieces.

  • Social media communication paradigms and algorithms.

    • More engagement ➡️ more money (and more polarization / rapid spread of fake news).

  • And much more.

I don’t have any answers here. This is hard 🤷

And on that positive note, have a great weekend!

Thanks for reading!

Cheers,

Clint