[tl;dr sec] #96 - Learn Reverse Engineering, Cloud Security Orienteering, Kernel Pwning with eBPF

Hey there,

I hope you’ve been doing well!

An Auspicious Visit

I’ve been quite cautious the past year and change, with most of my outside the house activities being taking walks or going on hikes, going to the grocery store, and staring pensively out the window, like a cat.

But last weekend my brother visited from Utah with his wives partner, and it was awesome catching up.

I hope you and yours are doing well, and here’s to an eventual back to normal ✊

Conferences

DEF CON 29 Videos
2021 videos are posted.

All of the 2021 Pwnie Awards
In this Twitter thread by Dhiraj Mishra.

Top Hacks from Black Hat and DEF CON 2021
The Daily Swig’s John Leyden nicely references a number of presentations, including attacking Let’s Encrypt, FragAttacks, request smuggling with HTTP/2, moar Microsoft Exchange bugs by Orange Tsai, hacking humans using AI as a service, hacking rooms in a capsule hotel, e-books that compromise your Kindle, and more.

AppSec

End-to-End Encryption through Kafka
Ockam’s Mrinal Wadhwa describes how two programs can send end-to-end encrypted messages over the network, via a cloud service, through Kafka. The programs will mutually authenticate each other and have a cryptographic guarantee that the integrity, authenticity, and confidentiality of their messages is protected end-to-end. Ockam seems neat: Apache 2 Rust and Elixir libraries to make E2EE easier. More open source secure primitives ftw 👍

Securing XML implementations across the web
Mattermost’s Juho Nurminen found XML round-trip parsing errors in four popular XML parsing libraries (in Ruby, NPM, Java, and .NET), and was able to confirm authentication bypasses in major SAML implementations and web applications for two of them. Juho doesn’t hold back:

Free as in Beer: Creating a Low-Cost Static Analysis Program
Slack’s Erin Browning and Tim Faraci have built out static analysis programs at multiple companies, using commercial and open source tools. In this DEF CON AppSec Village talk (slides), they discuss why at Slack they’re building their program around Semgrep.

Cloud Security

GCP Goat
An intentionally vulnerable GCP environment to learn and practice GCP security, by Joshua Jebaraj.

Cloud Security Orienteering
Excellent DEF CON Cloud Village talk by Cedar’s Rami McCarthy on how to rapidly find the information necessary to familiarize yourself with a new cloud environment, dig in to identify the risks that matter, and put together remediation plans that address short, medium, and long term goals.

AWS Organizations - Checklist for 2021
Chris Farris provides a great checklist of what you should do when setting up a new AWS Organization from scratch.

Building an AWS Perimeter
Whitepaper by AWS covering perimeter objectives, identity, resource, and network boundaries, preventing access to internal credentials, and cross-region requests.

Container Security

Threat Hunting with Kubernetes Audit Logs
Square’s Ramesh Ramani walks through the basics of Kubernetes audit logs and how one can use these audit logs effectively to hunt for attackers in Kubernetes clusters. Ramesh covers specific log fields to focus on and why.

nevalla/lens-resource-map-extension
An extension for Lens - The Kubernetes IDE that displays Kubernetes resources and their relations as a real-time force-directed graph, by Lauri Nevala.

Blue Team

Protect domains that do not send email
Make sure that domains that do not send email cannot be used for spoofing, using SPF and DMARC.

Red Team

Kernel Pwning with eBPF: a Love Story
Grapl’s Valentina Palmiotti covers eBPF basics & verifier internals, exploiting CVE-2021-3490 for local privilege escalation, debugging eBPF bytecode, exploitation techniques for DoS, info leak, and LPE, and weaknesses still in eBPF. Super detailed write-up 🤘.

Reverse Engineering

Reverse Engineering for Beginners
New free workshop by Guardicore’s Ophir Harpaz covering an x86 overview, a short intro to IDA, and a number of exercises with hints.

Reverse Engineering Workshops by Malware Unicorn
Malware Unicorn’s workshops include reverse engineering 101 and 102, PE injection, macOS Dylib Injection, anti-analysis techniques, and more.

Android App Reverse Engineering 101
Maddie Stone’s workshop focuses on static analysis, covering DEX bytecode, native libraries, obfuscation, and more.

Politics / Privacy

OpenMined

Apple confirms it will begin scanning iCloud Photos for child abuse images
iOS will start scanning pictures on your device to look for known bad images. It tries to do this in a privacy preserving-ish way, but some security professionals view this as a step in the direction of giving law enforcement backdoors. More: Wired, Stratechery, must read Alex Stamos thread.

The Pentagon Is Experimenting With Using Artificial Intelligence To “See Days In Advance”
Basically they’re feeding ML/AI real-time data gathered by a network of sensors around the globe, including “commercially available information.” The AI can detect changes, and will trigger additional intelligence gathering to take a closer look at what might be ongoing in a location. Well on our way to Westworld Season 3.

Misc

The Jessica Simulation: Love and loss in the age of A.I.
By Jason Fagone. Your partner passes away before their time. You upload their text messages, email, and other communications to Project December, which is powered by GPT-3. Soon, you’re talking to “them” again. Wow, this was quite a read.

Rising Seas Are Coming For Big Tech Campuses. Who Will Pay To Protect Them?
Some pretty neat visualizations by NPR. Basically, a number of Bay Area communities around Google, Facebook, and others are likely going to get flooded due to global warming. Mitigations will be expensive, but who will pay for it?

Open Source Alternatives
A curated list of 200+ open source alternatives to tools that businesses require in day-to-day operations.

How the explosive growth in satellites could impact life on Earth
Satellites can be used for a variety of purposes, including: counting the number of cars in retail parking lots (like Walmart, Home Depot, etc.), monitoring activity at metal processing and storage facilities to predict metal prices and related trends, analyzing car numbers at certain hospitals to predict future pandemics, identifying and preventing illegal deforestation, assessing disasters like floods and oil leaks, provide Internet to the world, and more.

Downsides: potential surveillance abuse, space debris falling to Earth, potential interference with astronomers and current weather prediction services.

Twitter

Man, what a story.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I'd love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint