Trustwave SpiderLabs

One substantial difference worth noting between the Russian astroturfing and astroturfing from other countries is that Russian crime have been refining their ability to automate human-like behavior for ad-fraud purposes. For those not familiar with ad fraud, there's been an arms race between criminal organizations to emulate human behavior clicking on ads and the advertising companies trying to detect it. The resulting algorithms have dual use properties that can be applied to astroturfing (e.g. https://www.trustwave.com/Resources/SpiderLabs-Blog/Bedep-trojan-malwa…

I've read through the spec along with the FAQ that epeus so graciously shared here. The idea of mentioning beyond the scope of one website's walled garden seems like a very natural progression of ActivityPub and the new-found hype surrounding Mastodon. My concern is that I haven't seen much thought into the security implications. The spec makes it clear that they're trying to simplify pingbacks but they don't address the fundamental security problems with pingbacks in the first place. And anyone who's maintained a Wordpress site will tell you, the first thing you do is turn off the Trackback and Pingback features [1] because not only does it attract the scummiest deluge of spam [2] but they've also been useful for disclosing internal network info and [3] leveraged to target other websites in DDoS attacks. [4] The only thought given to preventing abuse is as follows from Section 4.1: >The verification process SHOULD be queued and processed asynchronously to prevent DoS attacks per section 3.2. >Receivers MUST verify Webmentions per section 3.2.2. The first directive isn't a guarantee a DoS attack won't block all IO, it just means don't make it trivial to bring a site down with webmentions. The second directive sounds nice but if you read through section 3.2.2 of the recommendation, it just mandates that you should validate the application data that's submitted. [5] There's no mechanism to authenticate messages, validate the sender, nor limit mentions to a set of trusted…

Feels hot off the heels of the other critical 7-Zip vulnerability less than two months ago: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-20…

It's not hard to find quite recent json parsing vulnerabilities, e.g. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsec… A fun historical one was remote code execution due to a json parser bug in Google Chrome. Oops. If you try a simple search on mitre, you'll see some false positives, but also a bunch of actual vulnerabilities each year: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=json Here is a nice blog post walking through various JSON based exploits: https://bishopfox.com/blog/json-interoperability-vulnerabilities

Why link to a tweet of a screenshot of a story about the report? This is the source. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving… And as far as I can tell they just arbitrarily claim that without evidence. The way they say it also makes it sound like a partial list of blocked languages, based on former USSR countries like Syria.

If only it was $2 of RAM... > in exchange for security Electron is not famous for its security. See for example https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-20… and https://securityboulevard.com/2018/06/june-vulnerability-of-the-month-…

This is the original blog post by the author who filed the cve. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authen…

The original advisory can be found here[0] and a Github repository with PoCs here[1]. [0] https://www.trustwave.com/en-us/resources/security-resources/security-… [1] https://github.com/scarvell/grandstream_exploits

Well, it brings the usual web security issues to the desktop, dragging with it much of the browsers' attack surface. Also, there's been a bunch of CVE – there's one [0] in particular that springs to mind. Accessibility is only achieved by the creator's intention. That's a problem. Native widgets come with accessibility built in (to the extent accessibility is supported on the platform in question). [0]: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-20…

It's basically another take on this older report: https://www.trustwave.com/Resources/SpiderLabs-Blog/Mass-MikroTik-Rout…

How is this news? This entire post is blogspam referencing a 2014 Blackhat presentation about a cheap social engineering trick that has nothing to do with SSL. https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Dow…

https://www.trustwave.com/Resources/SpiderLabs-Blog/(Updated)-ModSecur… My guess is strategies like this but it isn't clear. [e.g. Requests designed to slow/increase the processing per-request to create a log jam at the web application level ]

Good (related) read about this vulnerability by the Trustwave team: https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injecti…

Spam tends to be a lot smaller (~6.4kb) as longer messages take more resources to send and are easier to detect. https://www.trustwave.com/support/labs/spam_statistics.asp Also, Email does not need to hop from mail server to mail server all that much due to DNS. Granted legitimate mail might move around a fair bit, but as far as the public internet is concerned the vast majority of spam is sender -> possibly senders mail server -> spam detection software -> /dev/null.

If you're already encountering blocks, I don't think you can assume there won't be blocks on QUIC unfortunately. Here are just a selection of vendors advice. There's plenty of them, and they are probably used by some schools, libraries etc. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g00… > Our recommendations: > Palo Alto Networks recommends creating a security policy in the firewall to block the QUIC application. https://community.spiceworks.com/topic/2146987-do-you-block-quic > Do You Block QUIC > Thinking about it, ... > Yes, ... > Yes, ... > Yes, ... > No, ... https://www.fastvue.co/fastvue/blog/googles-quic-protocols-security-an… > How Google’s QUIC Protocol Impacts Network Security and Reporting > ... inadvertently created a security hole for many organizations. > ... At the time of writing, the advice from most firewall vendors is to block QUIC until support is officially added to their products. https://help.zscaler.com/zia/managing-quic-protocol > Managing the QUIC Protocol > Zscaler best practice is to block QUIC https://www3.trustwave.com/support/kb/print20269.aspx > Blocking web traffic over QUIC > The recommended fix is to block outbound UDP on ports 80 and 443 ...

Honestly, when it comes to cyberattacks, I think the truly worst area right now is "Internet of Things" devices and similar Internet connected devices like point of sales. At least Windows (and other computer OSes) have slowly become more secure over the last 20+ years. As far as I know, all the major OS players are very good at patching discovered exploits quickly. Malware spread by social engineering (eg tricking someone to execute malicious code) is the most common way things are spread these days. Many IoT companies, in contrast, have root-level exploits that are laughably trivial to hack, and some don't seem to care that much at all when exploits are discovered (https://www.trustwave.com/Resources/SpiderLabs-Blog/Undocumented-Backd… Windows is imperfect I'm sure, but I'd rather connect a Windows machine to the public network than any so-called "smart" appliance at this point.

1) Schneier's advice from a few years ago is still accurate: https://www.schneier.com/blog/archives/2012/07/how_to_become_a_1.html 2) The Reddit NetSec FAQ has a good list of resources for beginners (and those starting to specialize): https://www.reddit.com/r/netsec/wiki/start 3) Finally, each of these popular "Getting Started in Security" guides has a slightly different, but useful, opinion on the specifics of the path to take: https://medium.freecodecamp.org/so-you-want-to-work-in-security-bc6c10… https://danielmiessler.com/blog/build-successful-infosec-career/#gs.0u… https://www.trustwave.com/Resources/SpiderLabs-Blog/Getting-a-Start-in… https://tisiphone.net/2015/10/12/starting-an-infosec-career-the-megami…