- Dailydave - mm4.emwd.com

How many treadmills can you run on at once?
by Dave Aitel 17 Dec '20

17 Dec '20

I wanted everyone to browse here and enjoy this Microsoft Teams vulnerability: https://github.com/oskarsve/ms-teams-rce/blob/main/README.md I also enjoy the discussion <https://twitter.com/taviso/status/1336365194071535617?s=20> it has engendered when it comes to how to measure vulnerabilities that are "in the cloud" or via "Auto-update". It would be good to get clarity on these things. [image: image.png] Measurement is the first step of something else: intermediate analysis. I think we failed, as a community, when we accepted the premise that vulnerabilities could be flattened down to simple numbers, CVSS scores, VEP scores, whatever. Bugs are inherently complex and interlinked. Losing that is losing their essence - you lose the ability to think coherently about them. But if you follow any set of scoring guidelines for vulnerabilities, and the best ones are qualitative, like the Pwnie Awards, you know that even though a massive amount of effort has gone into mitigation, assessment, secure coding frameworks, education, and everything else that makes up the meta-SDL, we are flooded with bugs. The mitigations aren't working. The secure coding frameworks, aren't. For every bug we find and fix a dozen more are written by the developers we thought we trained. It is a natural response to try to hide from this knowledge of failure. To cook the CVE numbers. To take refuge in our stock prices. Let's write another blogpost about catching an APT and give it a funny insulting nickname. Unfortunately without intermediate analysis you cannot do higher level strategy. And the treadmill of the information security technology arena is beyond exhausting. An equally fast treadmill is running next to it for security policy and legal policy and another one for incident response. There's no intermediate analysis happening in any area, so we are left making strategy choices by random chance or luck or the occasional herculean effort. -dave

2 1

Kiroshi Optics
by Dave Aitel 12 Dec '20

12 Dec '20

https://twitter.com/JesseHeinig/status/1336913378564919297 https://twitter.com/ClipperChip/status/1337289319988473856 People seem to think you can use etymology as some clue to deciphering the cyberpunk and cyber philosophy in general. You can read a whole Thomas Rid book <https://www.amazon.com/Rise-Machines-Cybernetic-Thomas-Rid/dp/0393286002> on it, and it's weird when people stress "Cybernetics" as if they've found some long lost hieroglyphic clue when the reality of how everything cyber evolved is staring right at them in flickering neon lights. As Hunter S. Thomson said, "with the right kind of eyes you can go up onto the top floor of any Silicon Valley building and you can almost see the high-water mark. That place where the wave finally broke and rolled back." When I was 20, working at the NSA, I once attended a cypherpunk meeting in DC, with Diffie and others crowded into a brownstone somewhere in one of the nicer parts of the city. The cypherpunk motto is very simple, "Privacy is necessary for an open society in the electronic age. We cannot expect governments, corporations, or other large, faceless organizations to grant us privacy. We must defend our own privacy if we expect to have any. Cypherpunks write code. We know that someone has to write software to defend privacy, and we're going to write it." At 20, in my larval stage, I was so socially awkward that it wrapped around to blithe unfiltered ignorance. During introductions, when they asked me where I worked and I said, "The DoD", they asked me why. I shrugged, "'Cypherpunks write code', and there are are more at the NSA than you might think." And people got over it - I pestered people with technical questions later as I always do, and there were snacks. But everyone in that room was a fighter, striving against an unspoken force on the field we now know as cyber war. Although no genre is "about" anything, to some extent Cyberpunk novels have often had a keen awareness of analyzing what it means to be a human mind. The new game Cyberpunk 2077 is an excellent adaptation of this theme, and avoids playing the horrors of modern life for laughs - where GTA 5 leveraged its open world to poke fun at the system, and Red Dead Redemption allowed you to marvel at the world despite its failures, Cyberpunk 2077 drops you into the scene in first person as a rollercoaster of existential dread takes you on a fast paced journey into tasting every gritty philosophical sandgrain of losing what it means to be a human, to have a mind of your own. William Gibson has said, "Science Fiction is never about the future. It's always about the present." but he also said "The future is already here, it's just unevenly distributed." And in the same sense that chemistry is just really slow applied electromagnetism, Cyberpunk literature, and the new game is exactly that, is a story about how some place's future, Xinjiang's perhaps, is all of our futures. The way that brownstone living room was, if you had the right kind of eyes. -dave

1 0

Worth a listen on your morning drive
by Dave Aitel 11 Dec '20

11 Dec '20

https://www.youtube.com/watch?v=pyE29pX9HBE&feature=emb_logo&ab_channel=The… (text: https://www.internetgovernance.org/2020/11/13/hague-keynote-sovereignty-in-… ) Keynote by Milton Mueller, Professor at the Georgia Institute of Technology (Atlanta, USA) in the School of Public Policy. I lolled at this section which is so true it hurts: Since publishing that book I explored the concepts of sovereignty and cyberspace more deeply. I published a new paper developing an argument about the relationship between the two in International Studies Review last year. Sovereignty is a concept that needs to be rescued from international law, which works with a dead and mummified version of it. Most of what that discipline says about its application to the cyber domain is legally correct but totally useless for solving today’s governance problems. And most of them have no idea how to apply the concept to cyberspace other than to point out, endlessly, that physical layer devices can be assigned to a territory. """

1 0

Gratitude
by Dave Aitel 26 Nov '20

26 Nov '20

So because we are thankful for all the support of every attendee at INFILTRATE for the past ten years (Yes, TEN YEARS!), we are releasing a special featured speakers series for the end of the year. If you are signed up for INFILTRATE 2020, PLAGUE EDITION then you already got an email invite to the first viewing-and-Q&A session with Marco Ivaldi. These talks are great - something I can say because we do our standard INFILTRATE dry-run process with every speaker, and they are making the extra effort to add things to the slides that confused us. And unlike most online events, we are pre-processing the talks to give them crystal clear audio and visuals. We have a couple dozen slots left in our online webinar silo, so if you feel like you deserve and desire to attend the Viewing+Q&A , please let me know. Otherwise, we will release the talks "at some point in the near future". Thanks! Dave Aitel

1 0

Deana Shick on INFILTRATE ONLINE
by Dave Aitel 31 Oct '20

31 Oct '20

Happy Friday! For those of you who enjoy laughing at my video editing job or want to learn about how big companies do vulnerability management "at scale" or what the alternatives are to CVSS, we've recently published a new fifteen minute video: https://vimeo.com/473562240 . -dave

1 0

Things to Watch!
by Dave Aitel 20 Oct '20

20 Oct '20

It's MONDAY, and I wanted to send over the shorts we did with Chris Eng and Ben Edwards. I think there's a lot of value in a robust question and answer session with paper authors. Too often papers are supposed to stand on their own without any real discussion. (PHP IS DOUBLE PLUS UNGOOD) https://vimeo.com/457850389/373c907909 (CVSS, an INTRODUCTION TO FAIL) https://vimeo.com/454453494/330060fbb2 (XXE) https://vimeo.com/464273744 Right now I'm editing the next in the series, which I think you will like, which is a more in-depth discussion on vulnerabilities and prioritization and dinosaurs. -dave

1 0

Identity + Host
by Dave Aitel 22 Sep '20

22 Sep '20

Recently Thomas Dullien wrote a blogpost <http://addxorrol.blogspot.com/2020/07/the-missing-os.html> asking what the OS of the future really looks like, considering the computer of the future is a distributed mega-engine. I would, annoyingly, posit that the algorithms that make sense to understand in that world are those already implemented in the many species of social insects. In that sense, I think there are things missing from his list of the basics of what a datacenter computer contains. At some level, I think the right set of algorithmic support will undergo phase changes as you scale up, but still be viable at small scales: (see this new paper for a detailed example: https://www.biorxiv.org/content/10.1101/2020.08.20.259614v1) I will include Thomas's list below: - Some form of cluster-wide file system. - A horizontally scalable key-value store. - A distributed consistent key-value store. - Some sort of pub/sub message queuing system. - A job scheduler / container orchestrator. I would say some level of ID is missing - large-colony ants have Caste systems for a reason. I think people in general ignore ID because maybe you can make ID and security a micro-service on top of a pub/sub message queuing system? I'm not sure. But in general, the same thing is true for most security analysis systems sold today - they see an infection, they treat a computer/network as infected and respond appropriately. At Immunity/AppGate we've been trying to go the other direction - tying your security directly to your identity. AppGate SDP already does this for network services, but we've also expanded upon that by using a graph database, INNUENDO Agent, a custom Windows Kernel module, and a lot of other excitement to build automated response that looks at your ID as much as it does your computer: CONSTELLATION + AppGate SDP (3m) https://vimeo.com/431931225/add11f4230 CONSTELLATION vs. Ransomware (9m) https://vimeo.com/421712679/d4a1918354 CONSTELLATION vs. Robbinhood (11m) https://vimeo.com/417796331/bb0426f9fb -dave

1 0

R2 Browser Hacking Class Review
by Dave Aitel 14 Aug '20

14 Aug '20

Sometimes we review books on this list, but I spent last week, for seven days in a row, taking the R2-RingZer0-Amy-Burnett Browser Hacking <https://ringzer0.training/advanced-browser-exploitation.html> class. But before I do, I want to point out that 36 Minutes into this video ( https://vimeo.com/442583799) I ask Marco Ivaldi about what it's like to switch from management back into the technical field. "It's hard, but it's very rewarding." Here's my one top tip for making remote classes easier as a student: TURN YOUR FREAKING CAMERA ON. This forces you to pay attention to the trainer. Also: trainers do better when they can see if you are picking up the material. I like the remote format better in many ways than the in-person format. I like seeing everyone else's questions in the Discord. I like being able to take a big break during the day to get food and then come back to the exercises later and get real-time answers to my questions by Amy typing things up on her cellular phone at the local Troy bar. I like continuing to have lungs complete with working alveoli. Also, the Browser Hacking class is effective. Everyone in the class (I was quite nervous since I didn't even know Javascript and last wrote an exploit in 1992AD) can write Chrome and Webkit exploits now. This is a useful feature. Obviously the first half of the class is "This is the giant optimized data structure they invented to allow people to check Gmail super fast" and the second half is "this is what those bug-classes look like in source code, and how you build your exploit primitives and plug them together". I guess my summary is this: Great class. It is well worth the money just to feel the dragon inside you wake up and swallow something whole again. -dave (List Note: I have turned off bounce processing, since it was misfiring and kicking people off the list for no reason.)

1 0

Dino-VSS
by Dave Aitel 11 Aug '20

11 Aug '20

[image: image.png] Bistahieversor or MS08-067? If you had to list out the problems with CVSS it would be like analyzing the anatomical issues of a children's drawing. No part of it fits together properly. Here's a problem: Scoring of threats is not one dimensional, and numbers can't carry the whole story. We need a vulnerability scoring system that's extensible, and programable. But I have an alternative: Take each vulnerability attribute and assign it to a dinosaur part! Is it a client-side? Then it's got legs! Does it need user interaction? Then short stumpy legs. Is it a true remote against a service? Then it's got wings. Is it a root bug? Then it has a big mouth? User-level access? Duckbill. That way, the attributes of the vulnerability reflect themselves as a literal model - a denizen of your Cretatous nightmares. But it rings true - getting attacked by five hundred pre-auth XSS bugs in your web front-end is exactly like getting attacked by a horde of ducks. And of course, vulnerabilities can combine - a LPE + a remote user-level XSS + sandbox escape has legs and teeth. Modeling is better than scoring in every way. Maybe your network is a Animantarx <https://en.wikipedia.org/wiki/Animantarx>, a living citadel, but more likely you're a Diplodocus, a big bag of walking meat getting nibbled to death by ducks. -dave

1 0

WAF Metrics
by Dave Aitel 18 Jul '20

18 Jul '20

So I'm making a video on metrics, of all things, and I wanted to post both this question <https://twitter.com/daveaitel/status/1281629327776522242?s=20>and the best answer so far to the list to see if anyone had any other ideas or followups. -dave [image: image.png] [image: image.png]

7 9

2025

2024

2023

2022

2021

2020

Dailydave