Security Journey's hi/5

Protect your open source project from supply chain attacks - https://opensource.googleblog.com/2021/10/protect-your-open-source-project-from-supply-chain-attacks.html?m=1

This blog post walks through the quiz questions, answers, and options for prevention, and can serve as a beginner's guide for anyone who wants to protect their open source project from supply chain attacks.

Trojan Source Attacks - https://trojansource.codes/

Some vulnerabilities are invisible - rather than inserting logical bugs, adversaries can attack the encoding of source code files to inject vulnerabilities. The attack is to use control characters embedded in comments and strings to reorder source code characters in a way that changes its logic. 

An Opinionated Guide on How to Reverse Engineer Software, Part 1 - https://margin.re/media/an-opinionated-guide-on-how-to-reverse-engineer-software-part-1.aspx

"This is an opinionated guide. After 12 years of reverse engineering professionally, I have developed strong beliefs on how to get good at RE."​

AppSec Things to Watch in 2022 - https://www.securityjourney.com/post/appsec-things-to-watch-in-2022

It’s that time of the year again when everyone under the sun comes up with predictions. We’re not fans of predictions, so instead, we give you Security Journey’s Application Security Things to Watch in 2022.

AWS WAF's Dangerous Defaults - https://osamaelnaggar.com/blog/aws_waf_dangerous_defaults/

Any malicious payload that starts after the 8KB limit in a POST request will completely bypass your WAF unless you've explicitly added a rule to block any POST request greater than 8KB in size. Even the simplest SQL injection, the legendary '1=1' can fly right by.

GitLab analysis of OWASP Top 10 changes from 2004 to 2021-https://public.flourish.studio/visual...
Visualization of how OWASP Top Ten has changed over the years.

To Learn a New Language, Read Its Standard Library-http://patshaughnessy.net/2021/10/23/...
The best way to learn a new programming language, just like human language, is from example. To learn how to write code you first need to read someone else's code.

Making sense of OWASP A08:2021 - Software & Data Integrity Failures-https://www.securityjourney.com/post/...
We should expect this category to rise higher within a few years. Supply chain poisoning is difficult to detect and prevent. Our countermeasures are, arguably, in infancy. ​

GitHub - xntrik/hcltm: Documenting your Threat Models with HCL-https://github.com/xntrik/hcltm
Hcltm aims to provide a DevOps-first approach to documenting a system threat model by focusing on the following goals: Simple text-file format, simple cli-driven user experience, and integration into version control systems (VCS). This repository is the home of the hcltm cli software. The hcltm spec is based on HCL2, HashiCorp's COnfiguration Language, which aims to be. "pleasant to read and write for humans, and a JSON-based variant that is easier for machines to generate and parse". Combining the hcltm cli software and the hcltm spec allows practitioners to define a system threat model in HCL.

All Things SSRF-https://github.com/jdonsec/AllThingsSSRF
This is a collection of writeups, cheat sheets, videos, related to SSRF in one single location.

Minimum Viable Secure Product

Minimum Viable Secure Product is a minimalistic security checklist for B2B software and business process outsourcing suppliers. 

How to Secure Python Web App Using Bandit

Bandit is a tool developed to locate and correct security problems in Python code. To do that Bandit analyzes every file, builds an AST from it, and runs suitable plugins to the AST nodes. Once Bandit has completed scanning all of the documents, it generates a report. 

Explain Sigstore to me like I am five

Sigstore provides an easier way to seamlessly issue and validate signatures from constituent dependencies, including base images, all the way to the final deployed application artifact. ​

Threat Matrix for CI/CD Pipeline

This is an ATT&CK-like matrix focus on CI/CD Pipeline specific risk.  

Malware Found in NPM Package with Millions of Weekly Downloads

A massively popular JavaScript library, UAParser.is (npm package), was modified with malicious code that downloaded and installed a password stealer and cryptocurrency miner on systems where compromised versions were used.

SHOW LESS

Commonjoe/ WrongSecrets - https://github.com/commjoen/wrongsecrets
Improper secret storage is a common technology problem. Use this tool to expose your developers to how to do it wrong, so they can learn how to do it right

List of IT Assets an Attacker is most likely to Extort -https://www.helpnetsecurity.com/2021/10/13/it-assets-target/
Attackers love IT assets; here are the top things they are targeting and exploiting.

OWASP Top 10 2021: 7 action items for app sec teams https://www.securityjourney.com/post/owasp-top-10-2021-7-action-items-for-app-sec-teams
Your AppSec team has work to do with the new OWASP Top Ten for 2021.

How to win at CORS - https://jakearchibald.com/2021/cors
CORS is tough to implement correctly and develop against – but it is worth the effort. Security is often difficult.

7 Unconventional Pieces of Password Wisdom -https://www.darkreading.com/application-security/7-unconventional-pieces-of-password-wisdom 
Nice summary of NIST 800-63b.

• How Yahoo Built a Culture of Cybersecurity- https://hbr.org/2021/09/how-yahoo-built-a-culture-of-cybersecurity

Commentary: Security culture continues to grow as a non-negotiable piece of a security strategy.

• ​ minimaxir/big-list-of-naughty-strings​ – https://github.com/minimaxir/big-list-of-naughty-strings

Commentary: Safe list input validation is always our go to, but the big list of naughty strings is a nice input for testing!

• Have Trusted Types API built directly into the jQuery Core Files · Issue #4409 jquery/jquer-  https://github.com/jquery/jquery/issues/4409

Commentary: jQuery is still widely in use across the web, and adopting trusted types is a strong security step forward.​

• Making sense of OWASP A08:2021 – Software & Data Integrity Failures​- Encryption is easy, key management is hard - https://www.securityjourney.com/post/making-sense-of-owasp-a08-2021-software-data-integrity-failures​

Commentary: Software and data integrity failures are the root cause of many supply chain debacles in the past few y

•  Apache Servers Actively Exploited in the Wild, and the Importance of Prompt Patching - https://blog.sonatype.com/apache-servers-actively-exploited-in-wild-importance-of-prompt-patching​

Commentary: We often think of patching as a security problem that has been solved – patching is always challenging!​

1. NIST Brings Threat Modeling into the Spotlight

If you haven't heard about the NIST Executive Order about software security and supply chain, you've been living under a rock. Adam gives us the threat modeling perspective on the EO

2. How to ensure the highest quality of Software code

Security or development, we all want the highest quality of software code. Explore linting, unit testing, SAST, and continuous monitoring of software.

3.  A cloud company asked security researchers to look over its systems. Here's what they found

Everything is broken, and everything is breakable – don't let anyone lead you to a different conclusion. The cloud is someone else's computer.​

4. Masscan: TCP port scanner, scanning entire Internet in under 5 minutes

Masscan is a TCP port scanner that can scan the entire Internet in under five minutes. The entire Internet!


5. Why is Server-Side Request Forgery #10 in OWASP Top 10 2021

SSRF cracked the OWASP Top 10 for 2021. Learn it. Live it. Know it.

1.  Application security tools ineffective against new and growing threats

Outdated offerings, false positives, and ineffective blocking are among the main causes driving this global concern.

2. HTTP/2: The Sequel is Always Worse

Attackers are learning HTTP/2. Developers and defenders must learn it as well.

3. AppSec Village Live Stream of DefCON 29

Check out AppSec Village as it is the perfect place to connect with those with related interests.

4. Mark Loveless -- Threat modeling in a DevSecOps environment

We discuss his philosophical approach, framework choice (spoiler alert, it's a pared-down version of PASTA), and success stories / best practices he's seen for threat modeling success.

5. Do you like to read? I can take over your Kindle with an e-book

An attacker could delete e-books, potentially gain full access to an Amazon account, converted a Kindle to a bot, attacked other devices in the local network, and more.

1.  Empty npm package '-' has over 700,000 downloads — here's why

There have been 720,000 downloads since its publication on the npm registry since early 2020.

2. Privacy – more than the icing on the cake

Questions to consider: What are we working on? What can go wrong? and more. Give this a read to gain more context.

3. Jeroen Willemsen -- Security automation with ci/cd

Jeroen joins us to unpack security automation in a DevOps world.​

4. Why cybersecurity pros need to learn how to code

Learn to code to level up your breaking skills; it is easier to find issues when you understand the underlying construction of the things you break.

5. Supply chain attacks are getting worse, and you are not ready for them

Manage suppliers over the whole lifecycle of a product or service, including procedures to handle end-of-life products or components.​​

1. 16 of 30 Google results contain SQL injection vulnerabilities

The dreadful quality of most of Google's search results. Several of these results were, simply put, SEO-optimized baloney.


2. A case against security nihilism

Skepticism that we can guard against the NSO Group's Pegasus spyware, or similar products.


3. Why the password isn't dead quite yet

It will take time and more experimentation to create a passwordless ecosystem that can replace all the functionality of passwords, especially one that doesn't leave behind the billions of people who don't own a smartphone or multiple devices.


4. Thinking back, Looking forward - A Balanced Approach to Securing our Software Future

We cover how to make security easier for developers, SBOM, software minimalism, cyber resiliency, and so much more!


5. 2021 CWE Top 25 Most Dangerous Software Weaknesses

The 2021 Common Weakness Enumeration (CWE™) Top 25 Most Dangerous Software Weaknesses (CWE Top 25) is a demonstrative list of the most common and impactful issues experienced over the previous two calendar years.

1.  Jeevan Singh -- Threat modeling based in democracy

Jeevan joins us to speak about self-serve threat modeling at Segment or threat modeling based in democracy. 

2. joswha/Secure-Coding-Handbook

Client side, Server Side, Auxiliary.

3. Security headers quick reference

Security headers recommended for all websites, websites that handle sensitive user data, and websites with advanced capabilities.

4. Cyber insurance isn't helping with cybersecurity, and it might be making the ransomware crisis worse, say researchers

The paper suggests that insurance should require 'minimum ransomware controls' as part of any ransomware coverage.

5. Microsoft Refining Third-Party Driver Vetting Processes After Signing Malicious Rootkit

If you sign something malicious, you allow it to bypass all your other security controls.