Securing Non-Election Election Systems, Modernizing AppSec Education – Brian Glas – ASW #247
While much has been written and argued about the security of election systems - the things that do the actual ballot counting - there's other systems that have to be in place and secured before the vote can occur - voter registration databases, ballot delivery systems, etc. Might it be possible to use modern appsec concepts OWASP SAMM to secure them in a more efficient, targeted, cost-effective manner? Brian Glas joins us to talk about this and his ongoing work around providing students with a modern application security education.
Segment Resources:
Brian has over 20 years of experience in various roles in IT and over a decade and a half of that in application development and security. His day job is serving as an Assistant Professor and Department Chair at Union University. He helped build FedEx’s AppSec team, worked on the Trustworthy Computing team at Microsoft, consulted on software security for years, and served as a project lead and active contributor for SAMM v1.1-2.0+ and OWASP Top 10 2017 and 2021. Brian is a contributor to the RABET-V Pilot Program for election related technology. He holds several Cybersecurity and IT certifications and is currently working on his Doctor of Computer Science in Cybersecurity and Information Assurance.
Kubernetes and silentbob strike back, EV charger hacking, fake POCs – ASW #247
It's a busy news week - We explore what happens when people trust plugging cables into their EVs in public, how an APT is leveraging docker and kubernetes to build a botnet, why you should be careful running code from "researchers," and much more
Akira Brand
- WormGPT: New AI Tool Allows Cybercriminals to Launch Sophisticated Cyber Attacks
I include this article to ultimately pose the question - just because ChatGPT and Google Bard have safety measures, does that mean the underlying LLMs are also safe?
- SBOM Everywhere and the Security Tooling Working Group: Providing the Best Security Tools for Open Source Developers
I included this article to introduce us to the Open Source Security Foundation, a conglomerate of individuals that are dedicated to securing open source. This 'SBOM Everywhere' initiative is a newer initiative dedicated to empowering developers to use SBOMs to secure their supply chain.
- Common Vulnerability Scoring System Version 4.0
CVSS version 4.0 is the next generation of the Common Vulnerability Scoring System standard. This document overviews teasers of some of the upcoming changes to CVSS v 4.0, and you can find a full readout of the upcoming changes at https://www.first.org/cvss/v4-0/cvss-v40-presentation.pdf.
John Kinsella
- A CVSS 9.8 in pacemaker-related software
CISA releases an alert about critical vulnerability in the software that gathers and analyzes data from pacemakers. Not a direct attack on the pacemaker, but I suspect a creative malcreant could use this to cause much suffering
- Honeywell also have IIOT vulnerabilites
Everybody's favorite legal-threatening thermostat company also has an industrial arm has disclosed 9 CVEs in their Experion DCS platforms and controllers, used across "agriculture, water, pharmaceutical, and nuclear plants." The vulnerabilities range from information disclosure to DOS weaknesses to RCE.
- Why does a smart lightbulb need to know location?
I like research laid out like this, and while Twitter has it's issues, laying the research out in a Twitter thread I think forces people to write in consumable bite-sized chunks. Neat to see them using Frida to help understand what's going on...I'm sure we've talked about it on previous episodes. https://frida.re/
- Remember Postscript? Ghostscript has a vuln, too.
While I'm happy to say I haven't hand-coded postscript in over 2 decades, it's still very much in use. I'm sure Mike still keeps his resume up to date in postscript (as well as LaTEX), so for people like him who use Ghostscript for rendering their work, this one's for you.
- EV Charger Hacking Poses a ‘Catastrophic’ Risk
Wired has a solid article to get people thinking about what could happen when you pull up to a public charger with your EV, take that plug and shove it into your car to stock up on angry pixies.(possible paywall)
- Cisco ACI has a Multi-Site CloudSec Encryption Information Disclosure Vulnerability
"Multi-site cloudsec encryption information disclosure" never ever sounds like a good thing.
- Anatomy of Silentbob’s Cloud Attack
Aqua's Nautilus researchers have a great 2 part blog looking at work currently happening at a presumable APT to compromise docker and kubernetes systems through a collection of vulnerabilities (including the crowd favorite Jupiter Lab) to build a botnet that we're not sure what it's going to be used for, just yet.
Part two is at https://blog.aquasec.com/teamtnt-reemerged-with-new-aggressive-cloud-campaign
- Stackrot discovered in Linux Kernel
The name doesn't sound good, nor does it's 7.8 CVSS. This use after free vulnerability is expected to have a exploit in coming weeks, so understand it now and patch quickly.
- About POC you just downloaded…
Sometimes you shouldn't just download and run things from the internet without closer inspection.
You definitely shouldn't do so with security-related code, especially when it comes from security researchers, and more especially from security researchers you are not familiar with.
Hey, can you run this for me real quick?
- Stack-based buffer overflow in FortiOS/FortiProxy
We've seen plenty of issues with WAFs and proxies over the years: Safely handling traffic for inspection can be difficult to do right. We've also covered a few issues parsing and supporting HTTP/2.
In this case, those two great flavors come together like peanut butter and...WAF.
- Java untrusted object deserialization RCE in FortiNAC
Fortinet seems to be going through a rough spot with vulnerabilities this year. Up next we have a RCE related to untrusted java object deserialization in their NAC product.
- CISA announces critical vulnerabilities in Rockwell IIOT software
The vulnerability pair includes ability to (mis)control industrial IOT devices.
- BlackLotus UEFI bootkit leaked to github
Here's a chance to see the source code behind one notorious UEFI bootkit. Of interest is the quality of code, it's documentation, organization, and cleanliness. Take a look, and compare it to how some of your source looks!
- Several vulnerabilities fixed and disclosed in Mastodon
I'm posting this one as it shows how that Security tab on a GitHub project can be used...I find many projects leave it there without either using it or disabling it in the project's settings.
