Download to read offline
Uploaded byAntonio Costa aka Cooler_
Strange security mitigations
The document presents various security mitigation strategies and vulnerabilities from the perspective of an attacker, emphasizing atypical approaches to enhance cybersecurity. It details specific vulnerabilities such as heap overflows and the Heartbleed incident, as well as lists various defensive techniques and tools for secure memory management. The article also advocates for monitoring system calls, managing sensitive information, and utilizing tools for auditing operational libraries to bolster security measures.
More Related Content
Similar to Strange security mitigations
Strange security mitigations
- 1. Strange security mitigations Tipsand tricks from an attacker’s mind Author: CoolerVoid Tips and tricks to understand some typical vulnerabilities and how to mitigate them following an untypical intelligent approach. abr. 17, 2022 Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 2. Summary 1 Whoamy 2 Depthsof vulnerabilities (not all) 3 Always watch your home Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 3. Whoamy Whoamy Antonio Costa (github.com/CoolerVoid)Strange security mitigations abr. 17, 2022
- 4. Whoamy Whoamy Antonio Costa -CoolerVoid Appsec tech leader Cybersecurity engineer Open-source programmer Reverse engineer github.com/CoolerVoid Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 5. Depths of vulnerabilities(not all) Depths of vulnerabilities (not all) Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 6. Depths of vulnerabilities(not all) Heap overflow In late 2001, ”Vudo Malloc Tricks” by Michel ”MaXX” and ”Once Upon A free()” defined the exploitation of overflowed dynamic memory chunks on Linux. late 2004, a series of patches to GNU libc malloc implemented over a dozen mandatory integrity assertions, effectively rendering the existing techniques to exploit obsolete. Malloc Maleficarum by Phantasmal Phantasmagoria dl.packetstormsecurity.net/papers/attack/MallocMaleficarum.txt cwe.mitre.org/data/definitions/122.html github.com/shellphish/how2heap Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 7. Depths of vulnerabilities(not all) Heap overflow - Malloc resources ptmalloc2 – glibc jemalloc – FreeBSD and Firefox tcmalloc – Google libumem – Solaris Hoard - CISCO, SAP and CreditSuisse Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 8. Depths of vulnerabilities(not all) First rant, libraries alternatives In late 2010 DieHard Allocator - DieHard: An error-resistant memory allocator for Windows, Linux, and Mac OS X microsoft.com/en-us/research/video/dieharder-securing-the-heap/ github.com/emeryberger/DieHard In late 2017 FreeGuard: A Faster Secure Heap Allocator https://arxiv.org/abs/1709.02746 Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 9. Depths of vulnerabilities(not all) Heart bleed in OpenSSL OpenSSL library CVE-2014-0160 A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. https://www.openssl.org/news/secadv/20140407.txt Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 10. Depths of vulnerabilities(not all) Second rant, libraries alternatives OpenBSD’s LibreSSL Memory sanitization is a central feature in LibreSSL that is lacking in OpenSSL. Prior to the deallocation of objects, LibreSSL explicitly zeros out memory using OpenBSD’s explicit_bzero(3) function. This proactively reduces the impact of memory exposure in the event of a future vulnerability or an unprivileged process that gains control of a tainted memory segment. Google’s BoringSSL Currently BoringSSL is the SSL library in Chrome/Chromium and Android. BearSSL, MatrixSSL, mbedtls, PolarSSL, lib sodium and so on Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 11. Depths of vulnerabilities(not all) Big check list Stack buffer overflow, Heap Overflow, integer overflow, buffer underflow, off-byone, memory leak, use after free, double free, race conditions(TOCTOU), lack of ASLR, lack of DEP, lack of stack cookie, lack of relro, lack of certificate pinning, lack of signature check, RCE, IDOR, RFI, LFI, SSO, CSRF, SSRF , SSTI, XEE, ReDOS, NoSQLi, SQLi, blind SQLi, XSS, blind XSS, DomXSS, Open Redirect, Path traversal, Insecure deserealization, LDAP injection, HQL injection, http parameter pollution, improper permissions, uncontrolled upload, uncontrolled resource consumption, CSV injection, graph injection, Denial of service, weak cryptography, lack of salt, lack of secret key, lack of anti-tampering, lack of root detect, lack of secomp/pledge, lack of rate limiting, lack of resource anti-robot, lack of http header hardening, lack of anti-hooking, misconfiguration, Uncontrolled Search Path Element, information leak,hardcoded credentials, tempest attack... Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 12. Depths of vulnerabilities(not all) Dark depths in vulnerabilities - fuzzing! AFL! Figure: Magic the gathering card, dark depths by Mathias Kollros Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 13. Always watch yourhome Always watch your home Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 14. Always watch yourhome Allow list of syscalls Enumerate syscalls of each resource Linux’s seccomp() function OpenBSD’s Pledge() function Restrict a Container’s Syscalls with seccomp github.com/antitree/syscall2seccomp Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 15. Always watch yourhome Hide your treasures Prevent hardcoded credentials using the proper vault Uses a safe library example LibreSSL and lib sodium Use safe algorithm for cryptography following OWASP, CERT and NIST. Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 16. Always watch yourhome LKM to hide and protect file system resources Casper-fs is a custom Linux Kernel Module generator to work with resources to protect or hide a custom list of files. Each LKM has resources to protect or hide files following a custom list in the YAML rule file. Not even the root has permission to see the files or make actions like edit and remove. The files only can be caught, edited, and deleted if the user sends a proper key to the custom device. github.com/CoolerVoid/casper-fs Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 17. Always watch yourhome Master librarian to audit operational system libraries Figure: from the game castlevania 1997 Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 18. Always watch yourhome Master librarian to audit operational system libraries A tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities Uses pkg-config resource to list all operational system libraries github.com/CoolerVoid/master_librarian Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 19. Always watch yourhome Vision to audit all services banners Vision2 analyses the Nmap XML scanning results, parses each CPE context, and correlates to search CVE on NIST. You can use that to find public vulnerabilities in services Uses nmap result to search security issues following NVD github.com/CoolerVoid/Vision2 Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 20. Always watch yourhome LKM for Hidden firewall Tool to generate a Linux kernel module for hidden and custom rules with Netfilter hooking. (block ports, Hidden mode, firewall functions) The motivation: in a bad situation, an attacker can put your iptables/ufw to fall. But if you have HiddenWall, the attacker will not find the hidden kernel module that blocks external access because it has a hook to netfilter on kernel land(think like a second layer for Firewall). github.com/CoolerVoid/HiddenWall Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 21. Always watch yourhome Shared Library Application Firewall ”SLAF” Spock SLAF is a Shared Library Application Firewall ”SLAF”. It has the purpose to protect any service that uses the OpenSSL library. The SLAF inserts hooking to intercept all communication to detect security anomalies and block and log attacks like buffer overflow, path traversal, XXE and SQL injection. github.com/CoolerVoid/spock_slaf Antonio Costa (github.com/CoolerVoid) Strange security mitigations abr. 17, 2022
- 22. Thank you Antonio Costa(github.com/CoolerVoid) Strange security mitigations abr. 17, 2022