Skype Hangs Up, Android Backdoors, Jailbreak Research, Pretend AirTags, Wallbleed – ASW #321

So long and thanks for all the e2ee!

Cheap devices that carry more security risks for users. A chance to talk about supply chain, trust marks, and how Android can still protect users.

Also check out the article from HUMAN Security.

We were excited to cover when Rust made its first inroads into the Linux kernel development. And were quick to point out that that journey took dozens of people working for close to a year just to get sufficient tooling in place.

Here's an example of how that tooling development continues.

Back in episode 320 we talked with Daniel Stenberg about why the Curl project remains steadfastly in C. One of his points was that Rust was (and perhaps remains) still immature for the needs of such a wide-ranging project. He also pointed out how 60% of curl's security issues were due to a flaw other than memory safety.

Curl will remain in C likely forever, but we'll see Rust continue to be adopted for new projects and slowly make more inroads to large projects like the Linux kernel, Microsoft Windows, and browsers. It's still comparatively early days for the language, let alone its adoption.

Cool research showing how to use an arbitrary Bluetooth device as an AirTag tracker with a combination of protocol knowledge and cryptography.

Fortunately, it's also an example that the AirTag design is resilient enough so that Apple is able to fix this and not have to throw away the whole thing.

The W3C is sharing advice on eradicating XSS now. More specifically, this is a collection of six talks from Google about their experience with deploying Content Security Policy and Trusted Types.

Check out the videos on YouTube.

The OpenSSF now has a "free, 2-hour, self-paced, e-Learning course.”

OWASP has also been broadening its training material around personas for builder, breaker, defender, and manager. It'll be interesting to follow what new content pops up this year to see what the latest trends are. Fingers crossed it'll be more strategic or actionable than just "shift left" slogans.

I love this research for so many reasons. On a technical front, it's about protocols and parsing and messing with length fields -- classic, effective techniques.

In addition to be a great technical writeup, it's also an important topic in terms of reverse engineering a system designed to enforce censorship. And the researchers were apparently able to leverage this vuln for two years!

From an appsec view, I see jailbreaks and prompt injections like the XSS of LLMs. For XSS, there has been (and likely will still be) research to identify broad classes of how and where it manifests, from unexpected vectors like cookies and headers to DOM elements to nth-order appearances in log viewers. But these classes have known frameworks and secure design methods for context-specific output encoding to inoculate them.

On the LLM side, jailbreaks and prompt injection techniques still remain fun CTF exercises. The spirit of this paper isn't to preclude research or more creative thinking; it's to make sure one attack class doesn't consume too much focus at the expense of identifying new classes. It's more about crafting better ways to measure the effectiveness of current controls (or impacts of attacks) and looking for new inspiration.

Also think of it in terms of the Top 10 Web Hacking Techniques of 2024 that we talked about with James Kettle back in episode 318. Yes, it's possible to get an XSS or SQL injection attack on that list, but doing so requires demonstrating something new and innovative -- even though the targets technologies can be old and creaky!

Check out the blog post it was based on and prior research on evaluating adversarial ML.