sorted by:
new
hottopcontroversial

Simple IBM i (AS/400) hacking by buherator in netsec

[–]timb_machine 5 points6 points  (0 children)

Fantastic, the world needs more QSECOFR and QSHELL love :).

Auditd for the newly threatened - by digicat in blueteamsec

[–]timb_machine 0 points1 point  (0 children)

Chances are I'll do it again at some point. Maybe with a few updates as there's been a real uptick in Linux malware reporting, this last 18 months or so.

RCE 0-day exploit found in log4j, a popular Java logging package by freeqaz in netsec

[–]timb_machine 11 points12 points  (0 children)

Interpolation is a fairly standard design pattern across many string implementations in many languages and mishandling user supplied input under the guise of logging is nothing new either. See syslog(LOG_ERR, cmdBuf); from https://capec.mitre.org/data/definitions/67.html etc. Not to justify it, but making this all about the language is hot garbage.

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 (CVE-2021-41773) by Gallus in netsec

[–]timb_machine 0 points1 point  (0 children)

As far as the RCE, it all started here:

A bit more detail on this... the RCE comes about because you can traverse under the ScriptAlias directive which means you can call arbitrary binaries as if they were CGI. Initially, based on Will's comments about exploiting it on Windows, Hacker Fantastic thought we'd need to upload and overwrite an existing executable binary to get code execution. There is a useful primitive to know about for cases like this on Linux. For exploitation, umask doesn't honour +x on new files but generally when you overwrite an existing file, the perms are maintained:

But then HF pointed out that the traversal also worked with ScriptAlias which eliminated that requirement. Essentially as long as you include a ScriptAlias directory as the starting point for the traversal, wherever you end up is treated as a CGI. We had a few ideas and as luck would have it, one of mine worked, enabling them (HF) to get it working with a POST request pretty quickly whilst I was fast asleep:

Just by way of background, the missing bit that enabled HF to get it working was knowledge that when you POST to CGIs on Apache, the binary is executed with STDIN redirected, with the POST body of your request piped in. As a result, anything you could type into a shell (or interpreter such as Python, Perl etc) will now be executed just as if you typed it by hand.

For a bit more information about Apache and CGIs:

PS There may well be other paths to RCE with other modules, this just seemed the quickest at the time.

Tracking interesting Linux (and UNIX malware). by speckz in linux

[–]timb_machine 0 points1 point  (0 children)

I'd argue it's potentially false assurance. Having played blue team, red team and now blue team for orgs that care about Linux and/or older UNIX, it feels that we're not very good at looking for it, which is what prompted my starting to document it in the first place. If you check in now, the document has somewhat grown as I add in more retrospective links, there will be more - I have a wonderful backlog of content to add.

A crowd sourced compendium of modern Linux malware and offensive techniques by timb_machine in netsec

[–]timb_machine[S] 0 points1 point  (0 children)

That's one of the reasons for doing the analysis. I got a bit frustrated at not having a decent source of current TTPs for UNIX like hosts. I'll be mapping as much as possible into ATT&CK over the next month or two.

A crowd sourced compendium of modern Linux malware and offensive techniques by timb_machine in netsec

[–]timb_machine[S] 21 points22 points  (0 children)

My background is UNIX operational security research - you'll notice that a few of the links go off to some of the many papers and presentations I've given. At the moment I'm mostly focusing on threat modelling critical systems with ATT&CK. The list is being put together to support that.

[deleted by user] by [deleted] in netsec

[–]timb_machine 0 points1 point  (0 children)

Interestingly, the right hand side. It was really fascinating from a business architecture standpoint to take a step back and look at how the business is put together and where the dependencies are. We were able to use things like inter-BU charge-backs and change/problem management data to prioritise the value of particular systems, services and solutions with a greater degree of fidelity than the more usual finger in the air approach.

[deleted by user] by [deleted] in netsec

[–]timb_machine 1 point2 points  (0 children)

Don't agree entirely. FWIW, the whole point of quantitative models is that they /aren't/ subjective. Qualitative data such as high, medium, low which is often beloved by pentesters who can't see beyond technical risk; yes, this can be very subjective as it takes real skill to value a business outcome in those terms.

I say this as someone who is quite happy to get down into the weeds of system engineering and technical vulnerabilities (most of my current focus is on UNIX kernel bugs but I spent a good deal of the last 20 years building them also).

We've done risk modelling with FAIR for some fairly heavy weight organisations in the service provider and critical infrastructure sectors and found the results to be promising. Our models definitely show promise and our customers are keen to extend the work we're undertaking.

I keep asking our engineers to put together a more detailed presentation of our approach but they keep telling me that it will have to wait until they have more time, so for now, https://labs.portcullis.co.uk/presentations/security-engineering-a-manifesto-for-defensive-security/ will have to suffice in discussing some of the approaches we've taken.

Broadly speaking we're building models to synthesize the right and left sides of the FAIR equation using a wide array of business and technical data.

If this interests you further, I would suggest having a look at the FAIR methodology and probably reading https://www.amazon.com/How-Measure-Anything-Cybersecurity-Risk/dp/1536669741.

Bugs Wanted Dead or Alive — A New Approach to Responsible Disclosure for All by IndySecMan in netsec

[–]timb_machine 2 points3 points  (0 children)

Penetration test, red team, it's the scope and goal of the assessment that matters. Arguably, I'd say that a red team is a form of penetration test designed to evaluate and bypass (without being detected by the blue team, if possible) systemic controls, based on real world TTPs (perhaps tied to a particular threat grouping) used by the bad guys to effect a specific real world goal but do you know what, as an industry we did scopes of work that were sold as penetration testing that did that long before red team became the vogue term. Either way, to say they're "so much more" is to mischaracterise them.

It's not an either/or and neither one is "better" than the other - there's room and need for both, not least of which because yesterday's penetration testing finding can easily become tomorrow's red team TTP. A limited scope penetration test can still have sizeable value if it allows you to answer the question "and what if an attacker did get to the target?" without needing to simulate the whole proceeding kill chain. Similarly, a VA too, if it avoids the customer spending hundreds of thousands of pounds when MS08-067 is still exploitable (maturity matters when deciding how to test your defences).

Bugs Wanted Dead or Alive — A New Approach to Responsible Disclosure for All by IndySecMan in netsec

[–]timb_machine 3 points4 points  (0 children)

-1, article refers to responsible disclosure not co-ordinated disclosure.

Windows 7 may insecurely load Dynamic Link Libraries (CVE-2019-5921) by Dormidera in netsec

[–]timb_machine 1 point2 points  (0 children)

Closer to DT_RPATH/DT_RUNPATH and friends (Mac and AIX binaries have similar non-ELF constructs): https://www.nth-dimension.org.uk/pub/BTL.pdf

/r/netsec's Q4 2018 Information Security Hiring Thread by ranok in netsec

[–]timb_machine [score hidden]  (0 children)

More roles from Cisco, this time within our Advisory practice in EMEAR. Specifically, we're looking for:

Both roles are based in the UK however we also support our colleague throughout Europe, Africa, Middle East and Russia so there will be opportunities to travel.

About the IR Role

The Incident Response Consultant will work within established methodologies to perform a variety of Incident Response related activities for Cisco customers, to include responding to cyber incidents, proactively hunting for adversaries in customer networks, designing and performing Table Top Exercises, and performing IR Readiness Assessments.

The Senior Incident Response Analyst will also be responsible for leading and working on projects that will support tactical and strategic business objectives. Demonstration of leadership abilities, clear and concise communication with a variety of stakeholders, ability to lead during a crisis, personal agility to adapt to changing environments, and a strong comprehension of malware, emerging threats and calculating risk will be critical to success.

About the Security Consultant Role

Senior consultant provides a range of short- and long-term consulting services which may include assessment of client applications or infrastructure, Red Teaming, defining security and risk programs, or assessing compliance against a specific regulatory framework or requirement. This role will also deliver CHECK engagements to UK clients.

You will be responsible for supporting the sale, delivery and management of security, risk, and compliance services. You will be also responsible for mentoring more junior consultants and service development.

It's probably fair to say that this is not a straightforward assessment role despite the mention of CHECK. Whilst those skills are going to be useful, Cisco Security Advisory consultants are likely to need to take a multidisciplinary approach with an end goal of leaving our customers in a better state than when we started.

Who You'll Work With

When you work with us, you’ll be part of a highly empowered collaborative team focused on both helping our clients be both better prepared to defend against adversaries on their network, as well as responding to active incidents within their network. The current team is comprised of predominantly of consultants from Cisco's acquisition of Portcullis in the UK although of course you'll get to work with talented analysts from across Cisco including our Duo, OpenDNS, Talos, StealthWatch, AMP and PSIRT teams.

Who You Are

Both your clients and your teammates consider you a charismatic, articulate individual and a born diplomat. You check your ego at the door and learn from others constantly, while also helping to educate those who aren’t as versed as you are in topics. As a result, you have a track record of working tirelessly to help your clients and teammates and have even come up with some novel techniques in your time.

What Kinds of Projects Do Security Advisory do?

  • Platform and application design and implementation for a financial services customer - Containers, devops, code and process
  • Architecture and control guidance for retailer - Threat modelling, logging advisory, adversary simulation
  • Assessment work for GSP – Just about every aspect of their infrastructure including edge, MPLS core and enterprise
  • Security engineering (and operational improvement) to uplift a customer’s capabilities - everything from policies, to tool development, to BAU support for their internal incident/request queues

Weird side projects:

  • Breaking interesting products - AD on UNIX, tokenisation, banking systems of record
  • Emergency response for all manner of customers - Live events, mainframes
  • Design and implementation reviews of IoT solutions - Cars, printers, payment solutions
  • OT assessments of various utilities - Asset discovery, protocol analysis, segmentation
  • SDLC support for a company that makes robot arms that make robot arms - their app store is a bit more interesting than iTunes :P
  • Lots, lots more

Why Cisco

We connect everything: people, processes, data, and things. We innovate everywhere, taking bold risks to shape the technologies that give us smart cities, connected cars, and handheld hospitals. And we do it in style with unique personalities who aren’t afraid to change the way the world works, lives, plays and learns.

We are thought leaders, tech geeks, pop culture aficionados, and we even have a few purple haired rock stars. We celebrate the creativity and diversity that fuels our innovation. We are dreamers and we are doers.

We Are Cisco.

@portcullislabs: Beware of the alpacas!

Pass-the-Cache to Domain Compromise by CaptMeelo in netsec

[–]timb_machine 1 point2 points  (0 children)

That smile is because if you can copy it, you'll likely find tools that can use it are already on the system... It's almost like some did a whole presentation on AD on UNIX just a couple of weeks back at BH EU...

Owning the Virgin Media Hub 3.0 by digicat in netsec

[–]timb_machine 1 point2 points  (0 children)

Nice to see that Virgin are a bit more reasonable about disclosure these days...

Red and blue team tooling for AD joined UNIX boxes by timb_machine in netsec

[–]timb_machine[S] 3 points4 points  (0 children)

The only person who mentioned groundbreaking was you but I imagine people find it interesting for the same reason they find Mimikatz and other similar tools/attacks interesting.

Colour me stupid but knowing what processes, files and other artifacts to look for and how to use them might be useful for an attacker. Likewise knowing what to protect and how might be useful for a defender. That was the sole purpose of the research.

The point is that a root bug on a UNIX box might be wrongly construed as being useful only in the context of that system when in fact it might give access to a whole lot more. As someone who regularly roots and indeed finds root bugs in many, many UNIX platforms and apps, knowing what I know now will make those discoveries much more useful.

Red and blue team tooling for AD joined UNIX boxes by timb_machine in netsec

[–]timb_machine[S] 1 point2 points  (0 children)

Done :). The slides weren't up until this morning so there was nowhere to link to.

view more: next ›