asw206

Application Security Weekly Episode #206 – August 01, 2022

Subscribe to all of our shows and mailing list by visiting: https://securityweekly.com/subscribe

1. Reachability & Attackability – 12:30 PM-01:00 PM

Announcements

Description

A discussion of how the changes and advancements in static application security testing (SAST) and intelligent software composition analysis (SCA) have helped development and DevSecOps teams work better together to fix security issues faster.

Guest(s)

Manish Gupta

Manish Gupta – CEO and Co-Founder at ShiftLeft

@manishguptaTD

Manish has 15+ years in cybersecurity. He was previously the Chief Product and Strategy Officer at FireEye, helping grow the company from approximately $70 million to more than $700 million in revenue. Prior, he was VP of Product Management for Cisco’s $2 billion security portfolio. He also served as a VP/GM at McAfee growing the network security business five fold in 5 years.

Hosts

JohnKinsella

John Kinsella

@johnlkinsella

Co-founder & CTO at Cysense

MikeShema

Mike Shema

@Codexatron

Security Partner at Square

2. Smart Lock and Simple Vulns, Macros and Secure Defaults, Breaches and Costs – 01:00 PM-01:30 PM

Announcements

  • Don’t miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!

  • Do you have a specific guest or topic that you want us to cover on one of the shows? Submit your suggestions for guests by visiting https://securityweekly.com/guests and completing the form! We review suggestions monthly and will reach out to you once reviewed!

Description

Multiple vulns in a smart lock, Office Macros finally disabled by default, data breach costs and threat modeling, designing migration paths for 2FA

Hosts

JohnKinsella

John Kinsella

@johnlkinsella

Co-founder & CTO at Cysense

  1. Time from vuln disclosure to exploits is shrinking – ????
MikeShema

Mike Shema

@Codexatron

Security Partner at Square

  1. XSS vulnerabilities in Google Cloud, Google Play could lead to account hijacks – I tend to skip over XSS. It’s a flaw that’s been around forever and feels like there’s little new to say about it. This example doesn’t add to any new aspect, but it’s worth a reminder that the flaw persists despite modern frameworks, scanning, and decades of awareness campaigns. If there’s one new discussion point to tease out of this ancient topic, it’d be a question about how old this flawed code was — was it relatively new and therefore a new mistake, or old code that’s been missed or skipped by increased security attention?
  2. Technical Advisory – Multiple vulnerabilities in Nuki smart locks – Grabbed this one for its range of mostly software and a few hardware vulns identified by NCC Group. The list of vulns has several classics, like stack overflows from parsing and DoS, that are frustrating to see in modern apps. So, regardless of whether you’re building an IoT device or writing C code, revisit your security architecture around parsers. One of the flaws relates to the “invite keys” functionality, which is essentially a way to share access to the lock. The researchers discuss potential threats with exposing secrets to the system’s servers vs. preserving them client-side. That also touches on the more universal challenge of balancing user experience with secure designs.
  3. Attacks using Office macros decline in wake of Microsoft action – We need more secure defaults. It took decades for Microsoft to disable Office macros by default, followed by an on-again-off-again spectacle in the last few weeks. It’s always great to see metrics that can reinforce the security success of switching to a hardened default. I look forward to the day where we deploy software and occasionally have to refer to “unhardening guides” to enable a few, rarely used features. Until then, we’ll be stuck with default configurations and PDFs with double-digit pages of hardening instructions.
  4. GitHub enhances 2FA for npm, improves security and manageability – We’ve already covered some of the bumps in npm’s enforcement and adoption of 2FA for its ecosystem. One item I hadn’t noticed before that felt worth highlighting was their effort to maintain backwards compatibility. If I were to use this as a very (very, very) broad strokes example of appsec vs. DevOps, I’d consider a framing like: Appsec says 2FA has to be rolled out; DevOps says here’s how to enable 2FA in 10 lines of code. That’s a pretty reductive summary, but the idea is to try and highlight the difference between just mandating “more security” and putting in the up-front development work to make adopting “more security” easier.

    GitHub and npm discuss this at https://github.blog/2022-07-26-introducing-even-more-security-enhancements-to-npm/

  5. Data breach costs record $4.3M with firms passing buck to customers – We haven’t talked about specific breaches in a while and, while we covered the Verizon DBIR a few months ago, we talked about the appsec attack vectors, not the costs. When you craft threat models, how often do you talk about records or the costs, value, or fines associated with records? When is it useful to include? When is it a distraction?
  6. 3 Year Review – Phil Venables shared a list of his most popular posts along with his personal favorites. His most popular one was about a year ago — https://www.philvenables.com/post/cybersecurity-and-the-curse-of-binary-thinking

    One of his favorites was from almost two years ago and got about 1/10th of the views — https://www.philvenables.com/post/the-uncanny-valley-of-security-or-why-we-might-never-finish-anything

    I don’t have any grand insight to share on this disparity, but I do find it interesting to read through posts like that and think about what makes something stand out more to the reader or the writer. Helpfully, Phil shares his perspective on each one of the posts.