1. Tractorload of John Deere Vulns, T-Mobile Breach, Kalay IoT Hack, & HolesWarm – 06:00 PM-06:45 PM
InfoSec World 2021 is proud to announce its keynote lineup for this year’s in-person event! Hear from Robert Herjavec plus heads of security at the NFL, TikTok, U.S. Department of Homeland Security, Stanford University, and more… Plus, Security Weekly listeners save 20% on world pass and main conference registration! Visit https://securityweekly.com/isw2021 to register now!
In the Security News for this week: Buffer overflows galore, how not to do Kerberos, no patches, no problem, all your IoTs belong to Kalay, the old pen test vs. vulnerability scan, application security and why you shouldn’t do it on a shoe string budget, vulnerability disclosure miscommunication, tractor loads of vulnerabilities, The HolesWarm…….malware, T-Mobile breach, and All you need is….Love? No, next-generation identity and access management with zero-trust architecture is what you need!!!
#HackingisNotaCrime Advocate, Sr. InfoSec Consultant at Online Business Systems
Founder at Security Weekly
How Much Cybersecurity Do You Need? – “Organizations also need to take a closer look into their cybersecurity investments to maximize ROI. In addition to strengthening the core through network, infrastructure and application security controls, security orchestration and automation with AI- and ML-based solutions and applying techniques like managed detection and response, next-generation identity and access management and zero-trust architecture will help counter modern-day threats, such as ransomware, more effectively and efficiently.” – And there you have! All you need is a next-generation identity and access management solution with some zero-trust architecture and just like that, you have all the security you need! We can all retire now…
Kerberos Authentication Spoofing: Don’t Bypass the Spec – “The Kerberos protocol is solid. It was developed at MIT and provides Single Sign On (SSO) for many large companies.” – Okay but define “solid”, as in like, it has many security flaws that have been uncovered over the years? Oh, and really try to code to the spec: “Then again, these four security vendors didn’t implement the Client/Server exchange at all. So I can just log in with my fake password to all these systems.”
Cisco will not patch critical flaw CVE-2021-34730 in EoF routers – In this case, Cisco’s recommendations are something that should be done anyhow, regardless of patch or not: “The IT giant recommends customers using RV110W Wireless-N VPN Firewalls, RV130 VPN Routers, RV130W Wireless-N Multifunction VPN Routers, and RV215W Wireless-N VPN Routers to disable UPnP on both the LAN and WAN interfaces of their devices.”
Hacker Says He Found a ‘Tractorload of Vulnerabilities’ at John Deere – “John Deere claimed in a statement that “none of the claims—including those identified at DEF CON—have enabled access to customer accounts, agronomic data, dealer accounts, or sensitive personal information. Further, contrary to claims made at DEF CON, none of the issues identified by the security researchers would have affected machines in use. John Deere considers the security of our systems and the data within them a top priority and we work tirelessly to identify and address any misconfigurations as quickly as possible. Deere also recognizes the important role our products play in food security and within the global food supply chain.” – Yet the researcher proved otherwise….
Millions of IoT devices, baby monitors open to audio, video snooping – “Over the course of several months, the researchers developed a fully functional implementation of ThroughTek’s Kalay protocol, which enabled the team to perform key actions on the network, including device discovery, device registration, remote client connections, authentication, and most importantly, process audio and video (“AV”) data. Equally as important as processing AV data, the Kalay protocol also implements remote procedure call (“RPC”) functionality. This varies from device to device but typically is used for device telemetry, firmware updates, and device control.” – Sounds like you need to be on the same network as the device, so I thought, but this looks like a publically available network that they were able to interface with the protoctol over the Internet: “If an attacker obtains a UID of a victim Kalay device, they can maliciously register a device with the same UID on the network and cause the Kalay servers to overwrite the existing Kalay device. Once an attacker has maliciously registered a UID, any client connection attempts to access the victim UID will be directed to the attacker.”
Fortinet slams Rapid7 for disclosing vulnerability before end of their 90-day window – Sounds like some miscommunication: “Rapid7 said they contacted Fortinet multiple times to work on the issue but didn’t get a response, so they followed their own disclosure policies when releasing the report.” – Begs the question, what do you do when you don’t receive a response? How hard do you try to get a response? What if emails go to SPAM? Difficult in larger companies as it can get lost in the shuffle. I think the lesson learned here is to closely monitor disclosure communication, and perhaps have multiple routes for disclosing vulnerabilities, or do a bug bounty so a 3rd party can help ensure clean and reliable communications.
How to Layer Secure Docker Containers with Hardened Images – “The containerized CIS Hardened Images are built on provider based images via Docker. Docker, a self-contained software bundle, makes it easy for applications to run on multiple computing environments. CIS provides these containerized CIS Hardened Images in Amazon Web Services (AWS) Marketplace.”
Penetration Tests vs Vulnerability Scans?—?Whats the Difference – Lost me right away: “Penetration testing aka pentesting is the process of finding vulnerabilities in the network and preventing them from seeping into the system.” – Nope. And then: “A vulnerability scan is a high-level test that seeks potential vulnerabilities in the system.” – Again, not really.
Application Security on a Shoe-String Budget – Beyond Security Blog – I believe this is really about 1) Create your teams to include devs, ops, and security people 2) Design and threat model with said team for functionality, reliability, performance, and security 3) Use OSS for static analysis, SCA, container scanning 4) Use commercial software for runtime protection.
2. Sequoia: A Local Privilege Escalation Vulnerability in Linux’s Filesystem Layer – 07:00 PM-08:00 PM
CyberRisk Alliance, in partnership with InfraGard, has launched the Critical Infrastructure Resilience Benchmark study. Measure your readiness for ransomware by completing the survey and getting your score. Visit https://securityweekly.com/CIRB to take the survey
Security Weekly Unlocked will be held IN PERSON this December 5-7 at the Hilton Lake Buena Vista!
We are excited to announce our first round of speakers: Lesley Carhart, David Kennedy, Alyssa Miller, O’Shea Bowens, Marina Ciavatta, Patrick Coble, Chris Eng, Eric Escobar, Nick Leghorn, Michael Schladt, Kevin Johnson, and Justin Kohler!
The Qualys Research Team discovered a size_t-to-int type conversion vulnerability in the Linux Kernel’s filesystem layer affecting most Linux operating systems. Any unprivileged user can gain root privileges on a vulnerable host by exploiting this vulnerability in a default configuration. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. Qualys security researchers have been able to independently verify the vulnerability, develop an exploit, and obtain full root privileges on default installations of Ubuntu 20.04, Ubuntu 20.10, Ubuntu 21.04, Debian 11, and Fedora 34 Workstation. Other Linux distributions are likely vulnerable and probably exploitable.
Shifting security left is good – but it’s an incomplete strategy that often leads to a false sense of security. In this segment, Sonali will discuss how organizations can reduce their risk of breach by embracing the modern AppSec techniques, that will allow development, operations and security teams to work together in order to efficiently and effectively secure all of their applications.
Sonali Shah – Chief Product Officer at Invicti Security
A seasoned business and product leader, Sonali Shah brings more than 20 years of B2B SaaS and cybersecurity sector experience, having led product management, marketing, and strategy teams at companies such as HUMAN (formerly White Ops), Veracode, BitSight, and VeriSign, among others. Skilled at leading teams with a proven track record in bringing innovative solutions to market, she will be building on Invicti’s long history of innovation, transforming the application security market, with its enterprise Netsparker and mid-market Acunetix solutions.