View More ASW Episodes

ASW #222 – Aviv Grafi

Android platform certs leaked, SQL injection to leaked credentials to cross-tenant access in IBM’s Cloud Database, hacking cars through web-based APIs, technical and social considerations when getting into bug bounties, a brief note on memory safety in Android Finding the balance between productivity and security is most successful when it leads to security solutions that help users rather than blames them for security failures. We’ll talk about the security decisions that go into handling potentially malicious files so that users can stay calm and carry on. This segment is sponsored by Votiro. Visit https://securityweekly.com/votiro to learn more about them! Visit https://www.securityweekly...

This episode is sponsored by
Full Show Notes
Segment One

Inoculating Malicious Content: Making File Types Safe to Handle – Aviv Grafi – ASW #222

Finding the balance between productivity and security is most successful when it leads to security solutions that help users rather than blames them for security failures. We'll talk about the security decisions that go into handling potentially malicious files so that users can stay calm and carry on. This segment is sponsored by Votiro. Visit https://securityweekly.com/votiro to learn more about them!

Guest

Aviv Grafi is Founder & CTO of Votiro, an award-winning cybersecurity company that helps organizations accept safe content and data inbound, at scale, through Votiro’s open, API-based content disarm and reconstruction-as-a-service technology. Aviv is the principal software architect for Votiro’s enterprise solution, Votiro Cloud, which protects against known and unknown malware and ransomware in data, regardless of data source or destination.

Prior to co-founding Votiro, Aviv served in an elite intelligence unit of the IDF, nurturing his passion for finding simple solutions to complex security issues. Aviv’s areas of expertise span the cyber product lifecycle—from strategy and development, through go-to market—along with network security, IDS/IPS/firewall internals, defensive programming, enterprise security penetration testing, vulnerability research, and virtualization.

Aviv speaks publicly on these topics as they are relevant in order to raise industry awareness and push for innovative solutions. Aviv holds a B.Sc. in computer science, a B.A. in economics, and an M.B.A. from Tel Aviv University. He is the inventor and principal software architect of Votiro’s enterprise protection solutions.

Announcements

  • Stay up-to-date with us on X (formerly known as Twitter) for the latest show clips and updates! Find us @SecWeekly and stay connected with our cybersecurity community.

Segment Two

Android Platform Certs Leaked, Hell’s Keychain, Web Hacking Cars, Bug Bounty Tips – ASW #222

Android platform certs leaked, SQL injection to leaked credentials to cross-tenant access in IBM's Cloud Database, hacking cars through web-based APIs, technical and social considerations when getting into bug bounties, a brief note on memory safety in Android

Announcements

  • Join our cybersecurity community on Discord! Connect directly with our expert hosts, join discussions with fellow audience members, and customize your notifications to receive alerts every time an episode of your favorite show publishes. Get your invite at securityweekly.com/discord!

List of Articles

Mike Shema

  1. Issue 100: Platform certificates used to sign malware

    Trust chains that mark authorization grants for apps are a hallmark of modern system design, where apps must be signed by an appropriate authority before they're allowed to gain privileges such as system-level privileges or which other apps they can communicate with. So, it's never a good sign when there's evidence of malware executing because it's been signed with a trusted cert.

    Fortunately, it appears to OEMs were able to respond quickly with OTA updates that mitigated the potential misuse of these certs.

    Read more about it in this Wired article.

    Although these leaked platform certificates can't be used to install OTA updates, here's a recent presentation about malicious updaters from the researcher who identified these leaked certs.

  2. Hell’s Keychain: Supply-chain vulnerability in IBM Cloud Databases for PostgreSQL allows potential unauthorized database access

    More cloud provider research from Wiz, this time on IBM's environment for PostgreSQL. Once again, it's a well-written walkthrough. It also touches on some fundamental security principles like hard-coded secrets and network isolation.

    It also starts off with a classic SQL injection that allowed the researchers to create a DB account with elevated privileges (superuser). They created a reverse shell and began collecting information about the system.

    What's interesting at this point is that IBM's monitoring identified this activity. They reached out to the researchers and, presumably after some friendly discussion about rules of engagement, collaborated with them to continue their research. This was a very constructive approach to security that prioritized identifying potential security flaws.

  3. Researchers find bugs allowing access, remote control of cars

    This research shows the security pitfalls of web-enabled hardware -- where the hardware just so happens to be cars. The techniques are straightforward (and clever) web API hacking that involves JWTs and CRLF injections. It's been quite a while since I've seen an interesting CRLF example.

    So, while you won't get any insights on an automotive CAN bus or reverse engineering microcontrollers, you will get some good reminders on the patience in manipulating web authentication and authorization requests. Plus, being able to "remotely start, stop, lock, unlock, honk, flash lights, or locate any vehicle that had the remote functionality enabled" is more impressive than old-school hacks like opening a computer's optical drive tray.

  4. Go SAML library vulnerable to authentication bypass

    The details are light on this one, but boils down to the library mishandling error conditions such that by providing a signed and an unsigned assertion in an XML blob an attacker could make the library believe the unsigned assertion was signed.

    This is one of those articles where I find it more interesting to read through the patch than about the vuln itself. Reading code can help you become a better programmer and help you understand new languages. If you're interested in Go, check out the commit here.

  5. So, you want to get into bug bounties?

    We talk about bug bounties quite often, but we don't talk as much about the process of becoming a bug bounty researcher or the dynamics of working with bounty programs. This article walks through technical and social aspects of the bug bounty world.

  6. Memory Safe Languages in Android 13

    Mentioning this article very quickly to highlight that code written in memory safe languages is becoming predominant in Android. And the reason is largely because new code is being written in these languages rather than C or C++. There's (understandably) very little engineering invested in rewriting existing code. Consequently, there'll likely be memory safety issues in that legacy code to be discovered for years to come, but the trend for this vuln class is happily going down and will dwindle because of the choice to implement new code in safer languages.

  7. Supply Chain Vulnerabilities Put Server Ecosystems at Risk

John Kinsella

  1. More fbsd vulnerabilites

    It interests me how freeBSD security is returning to the spotlight (as I see it) as more focus goes into cracking playstations

  2. Some of my favorite talks from AWS Re:Invent 2022
Show More

Stay in the Know, No Smoke and Mirrors – Join Our Newsletter

Get expert insights and technical breakdowns straight to your inbox.
Join Now

Related Episodes

Related Content

You can skip this ad in 5 seconds