Defense is arguably the core function of the state – a government will protect its people. In that context, it has been interesting to observe the rise of cyber attacks as a major global threat. Defense agencies are used to protecting people from bombs and bullets, but what is their responsibility to protect against malware or man-in-the-middle attacks?

It’s a fascinating question, I think, without many clear answers. One way to approach it is by looking at the national cybersecurity apparatus in place across comparable companies. How, for instance, does the US promote cybersecurity compared to the UK?

Quite differently, as it turns out. As I will soon explore, the UK takes an active, highly involved approach to defending individuals and organizations against cyber attacks. The US feels more hands-off by comparison.

Granted, US cyber readiness is quickly changing; The State and Local Government Cybersecurity Act of 2021 makes cybersecurity a much bigger national priority. Still, I was struck while reading some recent research by how our friends across the pond handle cybersecurity (a clear and present danger to national security) compared to ourselves. It’s night and day from my perspective – and my hope is that we can learn from the UK way to improve over here, not just in the federal government but at security centers across the public and private sectors.

Get to Know the UK National Cyber Security Centre

“Protect the majority of people in the UK from the majority of the harm caused by the majority of the cyber attacks the majority of the time.”

That’s the stated mission of Active Cyber Defence, a program of the UK National Cyber Security Centre (NCSC) that takes a refreshingly realistic approach (the majority is not the entirety) to stopping cyber attacks. More refreshing, however, is the emphasis on active defense designed to prevent attacks and protect proactively.

Other national governments, including the US, work to stop attacks and strengthen security, but that effort often feels underwhelming. To put this issue into perspective, does any US organization struggling with cybersecurity think of the government as their first or best solution? No. They solve problems by buying defenses, subscribing to services, hiring consultants, or recruiting staff. The government feels irrelevant in this equation. At least it does here, but that’s not the case in the UK.

The Active Cyber Defence program has, over the last five years, eliminated countless threats, significantly reduced cyber risk throughout the UK, and prevented gigantic losses. Which is to say, the impact has been real and significant.

To help understand what that impact looks like, consider the still-fresh Solar Winds attack that affected national governments around the world. The US had 9 agencies compromised, including all three branches of the military. It was bad. The UK, by comparison, hand only a few organizations affected, and all in the private sector. It was mild. The efforts of the NCSC don’t deserve all of the credit, but they undoubtedly deserve some. We should learn from what’s working.

What the Brits Do Differently

Let me reiterate that I don’t think the US cybersecurity efforts, handled primarily by the Cybersecurity & Infrastructure Security Agency (CISA), are severely derelict or deficient. They have plenty of successes to celebrate, not to mention more to protect than their counterparts in the UK. But when you compare CISA to NCSC, the differences in approach come into focus.

Here’s an easy exercise: Look over this page of free cybersecurity services and tools offered by the CISA. It’s just a long list of links to (primarily) third-party or open-source solutions. Now compare that to the page of services and tools offered by the NCSC. Not only is the presentation and organization much smarter, but all the resources highlighted were developed by the NCSC specifically.

The quality and character of the resources are different. But it strikes me that the entire approach is different. Consider this quote from the NCSC website – “ACD (active cyber defence) is intended to tackle the high-volume commodity attacks that affect people’s everyday lives, rather than the highly sophisticated and targeted attacks, which NCSC deal with in other ways.” The program targets the most common attacks and strives to prevent them proactively. It’s all about getting in front of attacks. As such, all of the tools, resources, and guidance facilitate finding and fixing weaknesses before they turn into incidents. By offering free assistance to organizations across the UK, the group responsible for lowering cyber risk is accomplishing exactly that. I wouldn’t say the US approach feels passive or reactive, necessarily. But what the Bits do feels a lot more active, agile, and animated to me.

As the emphasis of cybersecurity shifts to prevention (rather than detection and response), I think the Active Cyber Defence program is a model for other national cybersecurity efforts and one that also applies to any organization striving to improve cybersecurity. Make prevention the highest priority, and put the tools in place to make that possible. That’s where real resilience and risk reduction come from.

I have more thoughts on what makes this program unique and important. I also want to bring some data into the conversation to illustrate how and why Active Cyber Defence keeps the UK safer than places without it.

Stay tuned for that. In the meantime, I’m curious what this community thinks about national cybersecurity in the US, UK, or around the world? What’s working and what isn’t? And what are the lessons or resources we can bring into private sector security centers? I know this community has expertise in places where I have blind spots, so please bring your own perspectives to the table.

#cybersecurity #CISA #US #UK #Defense #NCSC

Intro

Continuing where we left of, we have curated a list of another five tools. These are once again belonging to different branches of Cyber, as per our intention to cover the most ground with the least steps taken. We will expand on the topics, as well as some of these tools, in the future, but for now we would like to introduce them and provide a high level overview of their purpose, capabilities, and general uses.

Burp Suite

Burp Suite probably doesn’t need much introduction as it is well known inside the community, but let’s explain some basics about how Burp works and what are some of the options that are offered. Essentially, Burp Suite is a Web Hacking framework – Web App Pentesting framework, to be precise. Burp Suite is pretty much the industry standard when it comes to web app security, and since its features enable it to test APIs, Burp is also used for mobile apps.

At its core, Burp intercepts the traffic between the webserver and the client, enabling the attacker to manipulate it. We can then issue our own requests for the server as we see fit. Burp also has the ability to forward the captured requests to other parts of the application – something we’ll explore in more depth in the upcoming Burp Suite series.

Burp comes with three different license options: Community, Professional, and Enterprise.

If you’ve used Burp in the past, chances are you’ve used the Community edition. Professional license is a yearly paid subscription, but it offers even more great features. Enterprise is a bit different to the two other versions, as it is intended for continuous scanning – automatically scanning your web apps for vulnerabilities – which would make sense in an enterprise environment.

Generally, there’s no need for the pro version as the Community version is extremely powerful by itself, but the pro version does have more automated and expanded features, such as API integration with other tools, option to save the projects and generate reports, automated vulnerability scanner, unlimited access to add new extensions, and more.

Splunk

Splunk name has become synonymous with SIEM (Security Information and Event Management), which is of no surprise as it is being heavily used in the industry, especially in large enterprise environments.

SIEM solutions are basically a centralized location where you can ingest the logs from your environment, from various sources. They are collected and normalized, so that they can be more easily investigated, and queried, by the analyst.

Aside from being able to ingest virtually any data, Splunk also offers a lot of additional capabilities in the form of Splunk apps (you can browse them here). One important Splunk app to mention is TA-Sigma-Searches which we can use to create queries in the sigma format, for easier sharing with other analysts or teams that don’t necessarily us Splunk as their SIEM solution. This is incredibly important since all SIEM solutions have different format for creating queries, and you might be on a team that doesn’t use Splunk – or vice versa.

With Splunk, you can also create alerts that are triggered when a specific condition is met. This is generally used for responding and monitoring of events.

Furthermore, all of this data can be tailored to your own purpose with detailed dashboards and visualizations.

Nessus

Nessus is a vulnerability scanner, which scans your infrastructure for vulnerabilities.

What makes Nessus unique and different from other scanners is the fact that it doesn’t make assumptions. For example, it won’t assume that your port 80 is running a web application.

Nessus can be deployed on almost any platform, including your Raspberry Pi, it also has more than 450 pre-configured templates which can help you quickly address your vulnerabilities. Its reporting capabilities are such that you can configure them as per best aligning formats for your security practices.

MISP

MISP, or short for Malware Information Sharing Platform, is a threat information platform which enables collection, storing, and sharing of threat intelligence and IOCs that relate to cyber attacks, malware, or any other intelligence, between trusted members. After all, two enterprises can both be targeted by the same threat actor, and MISP sees to it that you can safely share intel and collaborate between each other.

Your threat information can in turn be used by SIEMs and NIDS (Network Intrusion Detection Systems). MISP can be used for security investigations, intelligence, risk, and fraud analysis, and more.

MISP functionalities support Indicators of Compromise (IOC) database, data sharing (according to the different distribution models – from open/public, to semi-closed, and private), import and export capabilities, automatic correlation, and API support (you can integrate it with your own systems to obtain and export intelligence).

Much more great information on MISP can be found here, and on the MISP Project Github repo here.

REMnux

REMnux is a Linux toolkit for reverse-engineering and analysis of malicious software. REMnux can help you with:

• Analyzing malicious MS Office macros (most common way malware developers distribute their payloads)
• Identifying and analyzing malicious payloads in various formats (.pdf’s, .exe’s, etc.)
• Memory forensics on infected systems
• Gathering and analyzing threat data
• Exploring network interactions for behavior analysis
• Investigating system-level interactions of malware

and more!

Tools inside this REMnux bundle are free, however, they have their own individual licenses, and it’s up to you to figure out how you’re going to use them, in accordance with their respective restrictions. Other contents that are part of the REMnux toolkit, like configuration and code, are licensed under the GNU General Public License v3.0 – unless otherwise stated.

The easiest and fastest way to start with REMnux is to download the REMnux distro .OVA file and run it on the hypervisor software of your choice (there’s a separate download for Virtual Box). You can also run the REMnux distro as a Docker container, as well as install it on a dedicated machine.

Conclusion

So, we’ve scratched over an incredibly large surface and probably opened up a bunch of new questions; that is why in the upcoming articles we will ‘zoom in’ more into some of these tools. Of course, aside from writing a full-fledged book, we can’t hope to ever cover them all in the way they would deserve, even if we were to make series out of every one of the tools mentioned.

With all that in mind, you could think of this mini-series of articles as our Cyber-appetizers to the main course – which is fully up to your discretion. We hope some of the links shared will help you create it for yourselves, in accordance with your palate.

Bon appetit!

Cover image by Immo Wegmann

#Burp #MISP #Splunk #Nessus #Tooling #Cybersec

Introduction

A patch was released in September of 2021, so users who updated their code won’t be exposed to this attack. Users who have not updated should do so as soon as possible. It is unknown how many of the ~167,000 applications that use this library are running vulnerable versions. The purpose of this exercise is to encourage developers to update to an adequately protected version, detailed throughout this blog.

What is SLO Generator?

According to their Github page, SLO Generator is a tool to compute and export Service Level Objectives, Error Budgets and Burn Rates, using Configurations written in YAML or JSON. In layman’s terms, it’s a tool for engineers who wish to track their web API performance. Many Google services, along with other projects wishing to record these metrics, use this tool.

SLO Generator Python library can be directly installed from PyPI with pip

Figure 1: Installing the SLO Generator Python library

Usage

Once installed, it is easy to generate the SLO report with the command line interface

“`slo-generator compute -f slo_config -c shared_config –export“`

Here, 

Compute argument to the slo-generator indicates that we want to generate a SLO report

The tool also provides the functionality to migrate older, version 1 configuration to newer, version 2 configuration.

“`slo-generator migrate -s old_config/ -t new_config -b error_budget_policy/config.yaml “`

For a successful migration, the migrate command needs 3 inputs from the user:

1. a directory containing old SLO configurations.
2. a directory containing newer slo configurations
3. a yaml file containing error_budget_policy

Exploitation

There are several techniques to find a potential vulnerability in older versions, such as manually combing through the source code, fuzzing the application, or analyzing recent patches to the application. 

Let’s analyze the recent patches first, attempting to discover any potential vulnerabilities. SLO Generator is an open-source tool; this information is all publicly available on their Github repository.

Looking through the release notes of version 2.0.1, we can see that they fixed the yaml loader security issue, meaning older versions of SLO Generator (i.e. v 2.0.0) would have the yaml loader vulnerability.

Figure 2: Version 2.0.1 fixes the yaml loader security issue

Looking at the changed files, we can see that in the patch, developers have replaced yaml.Loader, which is vulnerable, with yaml.SafeLoader.

Figure 3: Developers replace yaml.Loader with yaml.SafeLoader

Looking at the official documentation for pyyaml, it is mentioned that calling yaml.load on any untrusted data is as dangerous as pickle.load, a common attack path making it possible to provide malicious shellcode as input, causing remote code execution.

This indicates that if we can control the data which is passed to the yaml.load function, we can perform a python deserialization attack to get the code execution on the application.

Looking through the changes, we see there is a function called ‘ebp_v1tov2’, which is calling the yaml.load function on a variable called “conf”. As we can see on line 262, every file in the variable ebp_paths will be passed through yaml.load as “conf”.

Figure 4: Dissecting code line 264 for yaml.load

As per line 70, ebp_paths is a list containing files in error_budget_policy_path which we pass to the application.

Figure 5: Code line 70

Creating the Exploit

Our first step is to create a malicious python deserialization object that we store in a yaml path. Next, we call the migrate function with error_budget_policy_path pointing to our malicious file. Our malicious file will be loaded by the application and our code will be executed.

As generating a yaml deserialization payload is out of the scope, we will find a common deserialization payload and copy it to our attack yaml file as exploit.yaml.

Figure 6: Deserialization payload with exploit.yaml

Now, running the following command to exploit the application:

Figure 7: Command to execute payload

As SLO Generator is a widely used python library, a code execution vulnerability makes it more severe. A typical exploit scenario would be executed in a web application to migrate user-supplied configuration.

Solution

All instances of SLO Generator should be updated to the latest version. Most applications handle user-supplied yaml data. Yaml data should always be handled correctly. Avoid using unsafe functions such as yaml.load, and replace it with yaml.SafeLoad. At an absolute minimum, it is imperative that all instances be updated past ‘yaml loader security issue 173’ to protect against this exploit.

Key Takeaways

This exploit shows the severity of using unsafe functions such as yaml.load. Any application that processes user data directly should always handle data with extreme caution. From an attacker’s perspective, if an application is processing user input directly to a yaml.load function, the application could be vulnerable to the Python YAML deserialization attack.

Best Practices

• Always keep all dependencies up to date with a dependency manager.
• Never use unsafe functions to directly process user data.
• Check for and install updates/patches when available.

Conclusion

Although this version of SLO Generator has been updated since September 2021, it nonetheless highlights the importance of proper and timely stewardship of software tools. As we have explored in this blog, it is relatively easy for an attacker to create an exploit for an out-of-date version. There are thousands of web applications being built with libraries such as these. Dependencies can be a useful tool, but can also come back to haunt you if not looked after properly. Lookin’ at you, Log4j.

References

1. Agrawal, A. (2014, November 18). Understanding Python pickling and how to use it securely. Synopsys blog.

https://www.synopsys.com/blogs/software-security/python-pickling/#:~:text=Dangers%20of%20Python%20pickling,data%20received%20over%20the%20network.

#exploit #python #google #slo_generator #YAML #vicarius_blog