ASW #217 – Kong Yew Chan

Java, curly braces, and interpolation -- the planets align for another RCE, but this one lacks the dimensional rift of its log4shell predecessor. With luck, we'll just label the language as Java4shell and work on better default configurations and design patterns.

The vuln announcement is at https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om

Supply chain acronyms are stretching their metaphors a bit too far now, but at least the projects are demonstrating investment in solving problems that developers face. This four-letter friend aims to provide better insight on the attack surface exposed by a known vuln within a software dependency: It brings together supply chain info into a graph, walks the graph, and provides an answer.

They'll be presenting more about this on Thursday at KubeCon.

Let's hope the next project dips into a new naming scheme.

How well can metrics drive a behavior? How do we build a culture that uses metrics to improve software security rather than devolve into gaming the metrics themselves?

The report is on the vendor's site -- thankfully not behind a registration wall!

It's always good to step outside familiar software and see what types of security challenges other industries face that don't rely on JavaScript front-ends, a key-value store, and user-generated content. Doing so can inform our practices, recommendations, designs, and threat models.

Fun hardware hacking and firmware dissection from NCC Group. Although mostly I included this as a missed opportunity to name it a more Halloween-friendly LexMark of the Beast.

A researcher finds a memory safety issue in a reference implementation of the SHA-3 algorithm -- and it's been in there for ten years. Here's a chance to talk about implementation, copying implementations, test cases for implementations, secure coding, secure code reviews. In other words, a fun example of the eternal challenges in appsec and what progress does -- or doesn't -- look like.

This is an interesting reflection on the current state and a future vision for OWASP from its founder. It's a constructive argument that aims to refine and build on what OWASP is doing, not to tear it down. I find the direction towards a product management approach appealing. And, in general, would love to see the OWASP brand recognized more immediately for other appsec resources than just the Top 10.

General information about the OWASP global board elections can be found here, including a list of all the candidates.

A walkthrough of an HTML injection attack where the researcher's initial report was a duplicate, followed by more research that ultimately found a clever combination of syntax from a JavaScript library for displaying math equations. Patience and a positive bug bounty experience led to a $10,000 award.

Last episode I included a link to a deep technical article on Linux kernel hacking. This week I found one on exploiting Chrome. We'll keep an eye out for similar long reads on topics that take more than a few minutes to cover. Let us know if you have any favorites we should highlight!

Modern Windows has functionality to alert the user before running a file downloaded from the Internet. People discovered that by altering the signature to an invalid one, that Window's "Mark-of-the-Web" would throw up it's hands and just execute the file.

Physicists figure out that a DOS attack using the fibonacci sequence keeps qubits entangled

Another counter-point to "must have SBOMs!" :)