Rhino Security Labs

I love this concept of proof-of-work captchas, but there's a growing number of tools and ways to bypass IP blocks via IP rotation[1], specially after the explosion of IaaS providers. How do you intend to tackle this? [1] Some examples: https://rhinosecuritylabs.com/aws/bypassing-ip-based-blocking-aws/ https://oxylabs.io/products/real-time-crawler https://github.com/alex-miller-0/Tor_Crawler https://www.scrapinghub.com/crawlera/

> I would never expect Little Snitch (my opinion) to completely block all network traffic on all levels It's very easy to say this in retrospect, having read the blog post. How many people would have said it beforehand? As far as I can tell, hardly anyone has ever said it, except the one other mentioned article from 2021: https://rhinosecuritylabs.com/network-security/bypassing-little-snitch… Moreover, it seems that Little Snitch changed its behavior at some point in order to use deep packet inspection. It wasn't always that way.

Yes, that is exactly what a motivated attacker would do to avoid their phishing site getting flagged as malicious. Here is a good article about how that is accomplished: https://rhinosecuritylabs.com/social-engineering/bypassing-email-secur…

There are a lot of other tools in this space and people that specialize in AWS pentesting. Another popular tool is Pacu: https://rhinosecuritylabs.com/aws/pacu-open-source-aws-exploitation-fr…

Agreed, there is a large learning curve and it took me a long time to wrap my head around it. It requires a lot of knowledge and discipline, which sooner or later will create holes. For example, if you need to pass a role to a service, you'll need PassRole; if you grant it on " * ", then oops, you might have just created the opportunity for privilege escalation [1]. There's also probably issues specific to your company: allowing access to read resource foo in general is not an issue, except your specific company stores sensitive data there. If every developer is expected to be a security expert, the security risks increase, and the productivity overhead may even be worse than having a dedicated security/IAM team that gatekeeps permissions. [1] https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mit…

To be fair to the folks at Capital One, the mitigation leverages a feature that wasn't released until well after they were compromised. https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-… I would also suggest taking a look at the various articles around AWS IAM privilege escalation: https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mit… https://know.bishopfox.com/research/privilege-escalation-in-aws (just shared on HN recently)

Some others in this space: - flAWS (flaws.cloud / flaws2.cloud) by Scott Piper - CloudGoat (https://rhinosecuritylabs.com/aws/cloudgoat-vulnerable-design-aws-envi… by Rhino Security Labs

Support for your assertion: https://rhinosecuritylabs.com/cloud-security/aws-security-vulnerabilit…

> Name a pentesting firm that cares about the OSCP. Here: https://rhinosecuritylabs.com/company/ lists OCSP and CISSP and a bunch of other certs. So I guess they care about that. Now, how about you name the pentesting firm that does not list any certs.

And? Thats not because "AWS" was like "OMG so smart", AWS is already well aware of this issue but lays the blame on "Shared Responsibility" and are likely annoyed that Salesforce, a partner of AWS< released this without communication. Honestly, my guess is there was a lapse in Salesforce somewhere, where either legal or PR didn't check this because this likely goes against Salesforce and AWS NDA for their partnership. I worked as an AWS partner before, there are requirements that go into place before you can release stuff like this to the public. Plus, having worked with Salesforce as well, I assume they have a PR policy to not use the word "hacking" in tool names or description, especially in regards to partners. My company has similar rules for OSS stuff. This was more of a bad PR / Legal issue. AWS is well aware that people misconfigure permissions... And again... better tools and more popular tools already existed... This is not new https://rhinosecuritylabs.com/aws/pacu-open-source-aws-exploitation-fr…