The code curation considerations of removing abandoned protocols in OpenSSL, kernel driver lessons from CrowdStrike's crash, choosing isolation primitives, cross-cache attacks made possible by SLUBStick, and more!
Mike Shema
- jbp.io :: CVE-2024-5535: `SSL_select_next_proto` buffer overread
This stands out as a nice side-effect of rewriting (or sometimes refactoring code). A memory safety bug was introduced in 2011, a work-around was created in Android in 2014, and the underlying cause discovered in 2024 during a rewrite to Rust.
Another aspect of this bug is that the feature, NPN, "was abandoned in 2012." Which means the code has been unnecessary for a decade. Or at least could have been disabled by default. It hasn't posed much risk for a long time, but it also likely could have been removed a long time ago. Removing unused and legacy code is one of the best appsec approaches.
- Windows Security best practices for integrating and managing security tools | Microsoft Security Blog
- Our audit of Homebrew | Trail of Bits Blog
- everything curl book: Backdoors and supply chain risks
The book's source is at https://github.com/curl/everything-curl
Nod to Risky Biz News for highlighting this.
- Avoiding downtime: modern alternatives to outdated certificate pinning practices
“Shorter lifetimes and frequent rotations limit the impact of compromised certificates, while certificate transparency allows for real time monitoring and detection of misissued certificates. These advancements are automated, scalable, and robust and eliminate the need for the manual and error-prone process of certificate pinning.”
- EPSS A Visual Exploration of Exploits in the Wild – Cyentia Institute | Data-Driven Cybersecurity Research
- DESIGN: Unfashionably secure: why we use isolated VMs
Another chance to talk about secure design and architecture choices, including trade-offs between security boundaries and operational efficiencies. In this case, it also sounds like a throwback to designs from a decade or so ago -- which isn't bad, but also may not be representative of modern design options.
- Apple Intelligence Foundation Language Models
- Falcon Content Update Remediation and Guidance Hub | CrowdStrike
Using this more as a chance to talk about secure design, kernels, and architecture choices.
Some additional references for discussion:
- What is eBPF? An Introduction and Deep Dive into the eBPF Technology -- validation and avoiding the halting problem
- Apple deprecating macOS kernel extensions (KEXTs) is a great win for security | ZDNET -- Apple's move in 2019 to develop System Extensions as a means to move extensions out of the kernel
John Kinsella
- Consumer Reports begins naming and shaming IOT vendors
"Several manufacturers of common consumer connected devices, including those making locks and faucets, are not taking an essential step to ensure that their products remain secure" CR starts off their rant with. Well this is something I did not expect to see, but very excited to see IOT security getting this much traction.
- SLUBStick: A Cross-Cache attack
Deep but interesting paper. Basically, but using a new timing attack to access and manipulate generic cache, an attacker is able to manipulate the kernel to over-manage (my phrase) the cache so the attacker can more consistently exploit vulnerabilities.
