Qualys Blog

openbsd literally had the morris worm vulnerability up til very recently. not sure this is a great idea. the way it is (still) programmed is just asking for it. https://blog.qualys.com/vulnerabilities-threat-research/2020/01/29/ope…

Safe signal handling has so many footguns that it seems worth re-considering the entire API. Even OpenSSH has had issues with it [1]. It seems very difficult to build good abstractions for it in any programming language, without introducing some function colouring mechanism explicitly for this. Maybe a pure language like Haskell could do it. [1]: https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/reg…

Yes. ModSecurity is best used as a tool for virtual patching, meaning something you can use to create a temporary defence for a problem you know you have. That buys you some time until the problem is fixed. When you're writing a virtual patch you know exactly what data you're dealing with and you can allow through only what's known to be good. Any other approaches (e.g., generic rules) deal with text in bulk and are prone to false positives. Even with this narrower focus, it's still a difficult problem. Here's a paper I wrote on this subject a while ago: https://blog.qualys.com/wp-content/uploads/2012/07/Protocol-Level%20Ev… Source: I am the original author of ModSecurity (but not of any of the rules packages).

Here is a non .txt format with a great video explanation as well: https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3…

Removing dynamic pins was inevitable given the associated risk for all sites. Some ideas to fix those exist[1], but I'm not sure it's worth the effort in a fully CT-enforced web. That's probably time better spent somewhere else (such as improving CT itself and the gossip mechanism.) I'm not convinced that static pins need to go too. There are something like 10 sites on that list currently, and all of them are valuable targets and should have the resources to ensure their pins don't fail. Even increasing that number to something like 100 should be manageable for browser vendors and would cover a large percentage of all page views (rather than just guarantee discovery after the fact). [1]: https://blog.qualys.com/ssllabs/2017/09/05/fixing-hpkp-with-pin-revoca…

> Every time the Docker daemon starts, it changes iptables’s FORWARD chain’s policy to DROP for no reason. Prior to v28, iptables rules were written in such a way that they depended upon the default `FORWARD` policy. To get proper container isolation, that default policy had to be set to `DROP`. That's not the case anymore. Iptables rules have been rewritten to not depend on that default policy, but we're still setting it as users might (un)knowingly depend on that to secure their system. We thought it wasn't worth the trouble to change that after so many years. However, we added an escape hatch in the form of a new daemon parameter (named `ip-forward-no-drop`) to not force users to disable iptables integration altogether when they don't want that default policy. We published a blog post about that, and other security hardening measures we took in v28: https://www.docker.com/blog/docker-engine-28-hardening-container-netwo… v29.0 will have support for nftables. It'll be marked as experimental in the first few releases to allow us to change anything without worrying about backward compatibility. However, it already provides the same feature coverage as iptables. Things will be a bit different with this firewall backend though - the Engine will refuse to start if sysctl `net.ipv4.ip_forward` is not set to 1. Users will have to set it on their own, consider the security implications, and take the necessary measures to block forwarding between non-Docker…

Hi OP here In my experience I think the biggest bottleneck that I've found is filesystem performance. FFS (Fast File System) is pretty freakin slow, and you should really consider redundancy options in case one of the drives fails because its tolerance for recovery from failure isn't the best. It definitely isn't the most optimal or sometimes even viable solution for when you need performance on the filesystem to be high. Given these things though chances are a lot lower that someone finds something filesystem-level which constitutes a way to hide malicious code or whatever (For example NTFS and hiding malware in Alternative Data Streams [1] or messing around with timestamps [2], or local privilege escalation in Linux's filesystem layer being a big vector for attack lately [3] - Hell even WSL mounting /mnt/c/ as chmod 777 which can wreck some real havok in something as basic as a few lines of python or ruby like stealing your browser session cookies [4] or just wrecking your windows install by deleting system32 like a bad prank from a decade ago [5]) [1] https://www.youtube.com/watch?v=S4MBzeni9Eo [2] https://www.sciencedirect.com/science/article/pii/S2666281720300159 [3] https://blog.qualys.com/vulnerabilities-threat-research/2021/07/20/seq… [4] https://blog.lumen.com/windows-subsystem-for-linux-wsl-threats/ [5]…

The biggest benefit to dropping TLS 1.0 and 1.1 is that modern AEAD ciphers are only supported by TLS 1.2 and above. In TLS 1.0 your only options are the hilariously-broken RC4 or block ciphers in CBC mode, which is a perennial source of padding oracles (several new ones were just discovered earlier this year[1]). By setting TLS 1.2 as your minimum you can also require the use of AEAD ciphers as Mozilla's new guidelines recommend. (In theory you could support different ciphers with different TLS versions but I don't know how many people did that in practice.) The Wikimedia Foundation has a dashboard showing TLS statistics for their services[2]. As they run one of the most popular websites on the Internet I think this data can be considered to be representative of clients on the public web. That dashboard shows 99+% of connections use TLS 1.2 and only 0.5% of TLS 1.2 connections use non-AEAD ciphers. Now, for someone operating at the scale of the Wikimedia Foundation dropping TLS 1.0 and 1.1 is probably not a good idea right now, but for smaller sites (particularly sites that are non-commercial/non-monetary in nature) it should be just fine. Servers have already been dropping TLS 1.0 support for years now. According to SSL Pulse[3] only 67% of servers support TLS 1.0 compared to 95% support for TLS 1.2. At its peak, TLS 1.0 support was at 99%. If you want to continue using ancient software with the modern Internet you should probably use a modern proxy server anyways just…

Blog post: https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qua…

But it could start delivering not-jQuery at some point. Far-fetched on the surface, but it's exactly what occurred with polyfill.io recently: https://blog.qualys.com/vulnerabilities-threat-research/2024/06/28/pol… https://news.ycombinator.com/item?id=40791829

This is in regards to the SUNBURST malware delivered via SolarWinds' Orion platform. I like the Qualys blog for a detailed technical analysis: https://blog.qualys.com/vulnerabilities-threat-research/2021/01/04/tec…

Versions from 4.4p1 up to, but not including, 8.5p1 are not vulnerable. The vulnerability resurfaces in versions from 8.5p1 up to, but not including, 9.8p1 https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/reg…

And it looks like it was a buffer overflow: https://blog.qualys.com/vulnerabilities-threat-research/2021/01/26/cve… Would Rust prevent this?

Ok, we've changed to that from https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve… above. Thanks!

You made the right call. Polkit is most commonly deployed on modern GNU/Linux distributions so the “on Linux” is mostly redundant. On a related note, Polkit, itself, has had its own privilege escalation problems: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034 https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwn…

This had a showstopper bug a few years ago that could completely compromise a host. I don't usually need this, so I disable it. https://blog.qualys.com/vulnerabilities-threat-research/2020/01/29/ope…

You said it yourself. LD_LIBRARY_PATH, and a myriad other knobs. Think of all the stuff you can do: mess with filehandles, signal handlers, chroot, resource limits, seccomp, capabilities, program arguments... and more appear over time. You can't defend yourself from things that didn't exist at the time the code was written. Polkit recently got exploited this way: https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwn… Putting it on a socket is a good way to make sure the client has no control over the environment.

Original title: "A bug lurking for 12 years gives attackers root on every major Linux distro // It's likely only a matter of time until PwnKit is exploited in the wild" > a 12-year-old vulnerability in a system tool called Polkit gives attackers unfettered root privileges Original publication of finding at https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwn… Immediate patch (though distributions are already providing security updates): remove the SUID-bit from `pkexec` # chmod 0755 /usr/bin/pkexec ... The article from blog.qualys.com (signed Bharat Jogi) is very, very well written, and instructive. It would be nice to have a good collection of these sources.

I had to deal with the opposite problem this week. My company uses Qualys for our vulnerability management stuff and after our security guys ran their scans throughout the network over the weekend we had a bunch of false positives. Seems that they were alerting on log4j-api in addition to log4j-core (only log4j-core is impacted per Apache). Looks like Qualys fixed it on Monday though so this shouldn't be a problem going forward if anyone else uses them. https://blog.qualys.com/vulnerabilities-threat-research/2021/12/10/apa…

Not sure about the particular setup you mentioned, but given that there's an LPE published every few months, I wouldn't be surprised. https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/ https://blog.qualys.com/vulnerabilities-threat-research/2021/07/20/seq…

The name isn't an exact match but maybe it's this glibc vulnerability: https://blog.qualys.com/laws-of-vulnerabilities/2015/01/27/the-ghost-v… Edit: nope, this is Ghost in the Shell, from last February https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-…

Some of them didn't break any more, they were always broken. Or, some of them were purely additive. We added mitigations against https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash, that was categorized as one.

1. Certification Authority Authorization (CAA) specifies which CAs are allowed to issue certificates for your website. Of course if the CA is truly evil, they would ignore whatever is specified. [1] 2. A DNSSEC-signed website can use DANE to specify which certificate, intermediate or key is authorized to be used. [2][3] [1]: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-f… [2]: https://weberblog.net/how-to-use-danetlsa/ [3]: https://community.letsencrypt.org/t/please-avoid-3-0-1-and-3-0-2-dane-…

> CAA creates a DNS mechanism that enables domain name owners to whitelist CAs that are allowed to issue certificates for their hostnames. https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-f…

> SSL Labs will start giving “F” grade to the server affected by these vulnerabilities from end of May 2019.[0] This is due to the server supporting cipher block chaining (CBC) cipher modes. Almost everyone has been moving towards Galois counter mode (GCM) ciphers for several years. [0] https://blog.qualys.com/technology/2019/04/22/zombie-poodle-and-golden…

This is actually a new take on a fairly well known security/DoS attack called the "slow post" attack (https://blog.qualys.com/securitylabs/2012/01/05/slow-read) pretty novel to see it used the other way around though!

The other article says that this is a privilege escalation: > The exploits and proofs of concept that we developed in the course of our research are all Local Privilege Escalations: an attacker who has any kind of access to an affected system can exploit the Stack Clash vulnerability and obtain full root privileges. https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash

After reading through the original Qualys discussion[1] of this new vuln I was definitely left with a feeling that this class of bugs has not yet exhausted its treasure trove of vulns. This article only confirms it. Very interesting discussion that will likely continue as more people wrap their heads around this tough problem. [1] https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash

Slightly easier to read: https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash "The Stack Clash is a vulnerability in the memory management of several operating systems. (...) It can be exploited by attackers to corrupt memory and execute arbitrary code." "If you are using Linux, OpenBSD, NetBSD, FreeBSD, or Solaris, on i386 or amd64, you are affected. Other operating systems and architectures may be vulnerable too, but we have not researched any of them yet: please refer to your vendor’s official statement about the Stack Clash for more information."

This might be considered similar to the DoS vector that was also present in the HTTP Public Key Pinning proposal [1]; an adversary seizing temporary control over the server can convince clients to not request a response from the server for a certain period, or in the case of HPKP request a response that cannot possibly be fulfilled. Its seems much more mundane in this Cache-Control case, but it is the same vector nevertheless. [1] https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-key-pinning-…