FortiOS Exploit, Linux Kernel Wi-Fi Vulns, Infosec Communities, Secure Coding – ASW #216

Mike Shema

1. Crypto trading platform Mango Markets drained of more than $100 million in flash loan attack
   Another cryptocurrency hack that demonstrates how systems can be abused by flaws in their workflows and assumptions -- valid input that's abusing intended functionality with untended consequences.
2. FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684) – Horizon3.ai
   An educational exploit that manipulate HTTP client request headers to bypass authentication. Check out the proof of concept at https://github.com/horizon3ai/CVE-2022-40684
3. [oss-security] Various Linux Kernel WLAN security issues (RCE/DOS) found
   RCEs in the Linux kernel's Wi-Fi stack. More interesting from the perspective of bug density -- several memory handling flaws within the same area of code.
4. Microsoft disputes report on Office 365 Message encryption issue after awarding bug bounty
   An example of handling bug bounty reports that touches on threat models and code vs. configuration. Read the researchers' writeup at https://labs.withsecure.com/advisories/microsoft-office-365-message-encryption-insecure-mode-of-operation
5. Field Guide to the Various Communities of Security
   Infosec is broad, with many specializations and disciplines.
6. ‘We don’t teach developers how to write secure software’ – Linux Foundation’s David A Wheeler on reversing the CVE surge | The Daily Swig
   Continuing our collection of articles on educating developers on secure coding. Check out the educational resources at https://openssf.org/training/courses/ and the "Developing Secure Software" course at https://training.linuxfoundation.org/training/developing-secure-software-lfd121/
7. Flipping the script: when a hacking class gets hacked – Aditya’s Blog
   How to create purposefully insecure environments for teaching -- and how to turn unexpected exploitation into more teaching.
8. Learning Linux Kernel Exploitation – Part 1 – Midas Blog
   The article is a year old, but the content remains educational. Including it as a way to build up references to educational resources within the show notes.

John Kinsella

1. squirrel: “Hacking” developers with a cat feeder
2. Not the onion: Let’s move to 3FA from 2FA!
   I sorta get the point, but I'm going to file this under whack-a-mole. Attackers will just tunnel to the authorized machines.
3. RedHat supports confidential compute in k8s
4. Corey Quinn: Confidential compute is for the tinfoil hat brigade
5. New npm timing attack could lead to supply chain attacks
   This could be one of the more "interesting" timing attacks
6. Does the OWASP top 10 still matter?
   We know our listeners are fans of OWASP, but that top 10 thing - does it still matter?
7. Hyundai/Kia have a new form of security tax…
   Hyundai finally has a fix out for an issue identified a few months ago with lack of engine mobilizers on some of their vehicles. The fix was announced to cost $170, but dealers are marking that up, and charging labor to install. The result is the fix to a security issue that modern car makers know how to prevent costs about $700
8. Fully networked Ford Mustang will be more difficult to hot rod
   As more and more tech controls a modern car, auto makers have to go to more effort to harden and protect that technology and connecting networks. This will annoy some - is there a way to find a balance?
9. Bug in Siemens PLCs lets attackers steal cryptographic keys