Archimydes’ Post

Think Log4j is a wrap? Think againThree years after its discovery in 2021, Log4j remains one of the most used vulnerabilities by threat actors, the most recent report released by Cato Networks has found. The report, which covers the first quarter to second quarter of the year, exposed a 61% increase in the attempted use of the vulnerability in inbound network traffic and a 79% increase in use in WANbound traffic. Log4j is a type of vulnerability that adversaries favor because it enables them to perform remote code execution

If it wasn't apparent before, it should be now that our threat landscape is much more perilous than most would like to acknowledge. Every stage of the development life cycle is at risk now. Carefully vetting your libraries is just as important as monitoring your infrastructure in scanning your code.

I had the amazing opportunity to attend the OWASP AppSec Days Pacific Northwest Conference last weekend! As someone who primarily operates in the building side of software, it was eye opening to learn how to break it and techniques to defend against software vulnerabilities! A huge thank you to Keri Kusznir for inviting me! Some of my top takeaways: • Make loveable security by making it easy to do the right thing • Vulnerabilities aren’t just in the code you write; check your dependencies and the supply chain for those dependencies • Be aware of what your language’s dangerous functions and what data goes into them • Both builders and breakers are leveraging LLMs such as ChatGPT, use them to make your code more secure • Setup guardrails using automated tools that give actionable feedback to developers

Are your systems really safe? #Dynatrace can help you identify new and lingering issues on a continuous basis, prioritize them by impact so you can quickly know the extent of any vulnerability. See what it's all about at Perform 2024 (virtually) next week (https://lnkd.in/g2TPfjbP) #appsec

Attention H2O-3 users... Our latest blog from Dan McInerney brings to light some notable vulnerabilities within H2O-3. From exposed file systems to potential remote code execution, this blog is a must-read for all H2O-3 users. #aisecurity #huntr #bugbounty https://hubs.ly/Q02vC_zc0

As LLMs continue to evolve, their role in vulnerability discovery is becoming more prominent. These top models excel at identifying common security issues and providing suggestions for remediation. However, they still face challenges, particularly with complex dependencies and code context. By combining LLMs with custom prompts and retry mechanisms, their effectiveness can be significantly improved. To explore more about this topic, as well as how to implement such strategies in your development workflow, visit this blog page: https://lnkd.in/dBimv7tN , and use Patched Autofix Patchflow today.

⚠️ PATCH NOW ⚠️ Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. Good technical write-up by ProjectDiscovery (https://lnkd.in/enGVR-MH) and exploit by Synacktiv (https://lnkd.in/eKYfg59F)

Successfully conquered the 'Cyborg' CTF on TryHackMe! Overcame challenges, unearthed backup files, and navigated the intriguing realm of 'borg'—a deduplicating backup program. Discovered an HTTP server, extracted backup files, and dove deep into Borg's documentation—an essential tool for efficient and secure data backup. Unearthed a crucial password, gaining access to an open SSH port, and swiftly progressed to seize the user flag. Navigated through the twists and turns, escalating privileges to 'root' and securing the elusive root flag. While labeled 'easy,' the real challenge lay in mastering 'borg.' Embraced the struggle, learned extensively, and emerged victorious. Huge thanks to TryHackMe for this engaging experience, pushing boundaries, and expanding my cybersecurity expertise. Onwards to new challenges and continuous growth! #CTFChallenge #Cybersecurity #TryHackMe #Borg #Rooted #AlwaysLearning #bugbounty #penetrationtesting

Really great post about X509 Client certificate parsing. Definitely keeping our eyes peeled during the next code review project, developers are likely to over-trust the fields in a certificate leaving them open to all kinds of injection driven attacks, as noted in the blog post. https://lnkd.in/dS_Ypr3N