All Posts

2 min

Bugzilla Privileged Bug Disclosure (CVE-2015-4499)

Yesterday, PerimeterX disclosed an issue in the venerable Bugzilla bug tracker, which can allow an untrusted attacker to gain access to privileged bug reports. This includes, of course, privately reported, but still unfixed, security vulnerabilities. Operators of Bugzilla bug trackers which use e-mail based permisisons are strongly advised to patch today. This would be a good place to insert a "yo dawg" joke about bugs in bugs, but I trust yo

10 min CISOs

Push vs Pull Security

I woke up from a dream this morning. Maybe you can help me figure out what it means. Your company hired me to build a security program. They had in mind a number of typical things. Build a secure software development lifecycle so app developers didn't code up XSS vulnerabilities. Improve network security with new firewalls, and rolling out IDS sensors. Set up training so people would be less likely to get phished. Implement a compliance program like NIST or ISO. And you wanted all of that rolle

7 min IT Ops

Do you need an Architect in a Software Company?

This may be a dangerous question to ask for someone whose role is that of an Architect, but I think it is a valid question for an Architect to ask. This is particularly true in the software industry where the role is interpreted in many different ways. In some cases, an Architect may work in an established enterprise company and hand down instructions on technology stacks to the developers. At the other extreme an Agile development team may work without the involvement of an Architect. Neither

7 min IT Ops

Log Analysis for Containers

Introduction The IT and DevOps world has come a long way with infrastructure. Virtualization revolutionized our ability to quickly deploy an application and scale up services when needed, paying only for the computing power used. Over the last few years, agile methodologies and continuous delivery have pushed VMs to their limits. Many teams still repeatedly use a single VM for releases and testing. Production VMs rarely change unless something goes seriously wrong. At the pace software develop

4 min IT Ops

Common Angular Routing Challenges

When it comes to frameworks, no one is perfect. As we migrate the Logentries application from legacy code to Angular, we’ve encountered a few interesting challenges along the way that we’ve enjoyed investigating and resolving. While specific challenges often depend on your project and migration strategy, the aim of this post is to share our solutions to problems one may encounter when migrating an app to Angular. In particular, I’ll focus on how Angular handles routing and some issues we’ve en

2 min

UserInsight Ranks Users by Risky Behavior

UserInsight now ranks risky users through behavioral analytics. UserInsight, the User and Entity Behavior Analytics (UEBA) solution , spots user behavior such as unusual admin activity, authentications to new assets, and new user locations and highlights users that exhibit several such behaviors. The User Risk Ranking augments UserInsight's low-noise incident alerts and enables administrators to g

4 min Microsoft

Microsoft Attack Surface Analyzer (ASA): It's for defenders too!

Attack Surface Analyzer , a tool made by Microsoft and recommended in their Security Development Lifecycle Design Phase , is meant primarily for software developers to understand the additional attack surface their products add to Windows systems. As defenders, this tool can be very useful. The tool is meant to identify changes on

5 min Phishing

10 Phishing Countermeasures to Protect Your Organization

The Internet is full of articles for how to tell if an email is phishing but there seems to be a lack of concise checklists how to prepare an organization against phishing attacks , so here you go. Because phishing attacks humans and systems alike, the defense should also cover both aspects. None of the following steps is bullet proof, so layering your defenses is important – and having an incident response plan in case someone does get th

20 min Metasploit

A Debugging Session in the Kernel

Last week, an awesome paper about the MS15-078 vulnerability and it's exploitation was published by Cedric Halbronn . This vulnerability, originally found and exploited by Eugene Ching , already has a work-in-progress module in Metasploit, which you can follow on github

6 min CISOs

CISOs: Do you have enough locks on your doors?

In a previous blog post , I referenced some research on how people plan for, or rather how they fail to plan for, natural disasters like floods. At the end of the blog post I mentioned that people who have poor mental models about disasters fail to prepare fully. I keep coming back to the idea of mental models because it starts to explain why we have such a gap between security practitioners and senior executives. I asked one CISO

3 min InsightIDR

Top 5 Alternatives For SPAN or Mirror Ports

Don’t want to use SPAN ports, but still need a source of network packets? In this blog post we break down the top 5 alternatives for you to consider.

1 min IT Ops

Best Practices for Container Log Analysis: Part 2

This 3-part series explores the challenges presented by containers and the advantages of using an end-to-end container log monitoring solution for complete container environment visibility. When working with containers, setting up a local image repository like Docker’s Registry can enable a team to iterate quickly, easily storing image versions in a central location to be used as needed. Yet as multiple team members update images, start, st

1 min IT Ops

Best Practices for Container Log Analysis: Part 1

This 3-part series explores the challenges presented by containers and the advantages of using an end-to-end container log monitoring solution for complete container environment visibility. As container environments become mainstream, it’s important to consider the most common challenges of migrating a monolithic application into containerized microservices and how to overcome them. While containers introduce new levels of flexibility from

6 min Vulnerability Disclosure

Multiple Insecure Installation and Update Procedures for RStudio (R7-2015-10) (FIXED)

Prior to RStudio version 0.99.473, the RStudio integrated toolset for Windows is installed and updated in an insecure manner. A remote attacker could leverage these flaws to run arbitrary code in the context of the system Administrator by leveraging two particular flaws in the update process, and as the RStudio user via the third update process flaw. This advisory will discuss all three issues. Since reporting these issues, RStudio version 0.99.473 has been released. This version addresses all

13 min Metasploit

Using Reflective DLL Injection to exploit IE Elevation Policies

As you are probably aware, sandbox bypasses are becoming a MUST when exploiting desktop applications such as Internet Explorer. One interesting class of sandbox bypasses abuse IE's Elevation Policies. An example of this type of sandbox bypass is CVE-2015-0016 . The vulnerability has already been analyzed by Henry Li, who published a complete description in this blog entry