Darius Houle

🔍 Technical Dive: The Critical Importance of Comparison Operators in Smart Contract Security Inspired from a conversation on X, i thought i'd write an elaborated post here. At Olympix, we keep encountering a subtle yet potentially dangerous pattern: the misuse of comparison operators, specifically '>' vs '>=' in boundary conditions. Let me break down why this seemingly minor detail matters significantly in Web3 security. 🔍 The Security Implications: 1️⃣ Edge Case Exclusion: When using '>', you're inadvertently excluding the exact boundary value. In DeFi protocols, this can lock funds permanently when amount equals minWithdrawalLimit, despite it being a valid state. 2️⃣ State Machine Transitions: In protocols with state transitions based on thresholds (like liquidation conditions), '>' instead of '>=' can create a "dead zone" where neither state is valid, breaking protocol invariants. 3️⃣ Example: A DEX implementation where LP removal was blocked when remaining liquidity exactly matched the minimum threshold - funds essentially locked due to a single comparison operator. 🛠️ Impact Assessment: Best case: User inconvenience requiring additional transactions. Worst case: Permanent fund locking or broken protocol state machines. Common severity: Low to Medium. Escalates to High when combined with precision loss in fixed-point math. 💡 Mitigation Strategy: Always question boundary conditions. Document explicit reasoning for choosing '>' over '>=' Add comprehensive test cases for exact boundary values. Consider fuzzing tests specifically targeting boundary conditions. 👉 The Rule of Thumb: Default to '>=' unless you have an explicit, documented reason for excluding the boundary value. Your future self (and auditors) will thank you.

8

Let's get better together! New article on the people + process needed in DevSecOps. Shout out to the amazing group from the Platform Engineering meetup a few weeks ago and Steven Smith CISSP, ISSAP, CCSP, CCISO, GCIH, GCED, GDSA on his contributions to this piece.

78

11 Comments

Our team at Silent Push has a spicy piece for a Friday about an ongoing Malvertising campaign that Google has failed to stop for a month, with at least 10 separate malicious domains used to target graphic design and engineering professionals. While we completely understand that tracking threats can be complex -- this current malvertising campaign isn't complex at all. All the domains in this campaign can absolutely be found with basic pivots that hundreds if not thousands of people at Google could easily accomplish. A simple rule in Google advertising and a little automation around a DNS lookup could prevent one campaign after another launching -- yet nothing apparently has been done for an entire month. Day after day, week after week, our team and our research sharing partners kept seeing this same obvious malvertising campaign spun up via unique Google Search advertising accounts -- without any clear efforts by Google to stop this or prevent similar campaigns. And to make matters worse -- each one of these campaigns has been flagged to Google! 100% of the domains launched from this campaign are hosted across 2 IP addresses -- and there are dozens of similarly named domains mapped to these IP addresses. I want to just pause and explain what this means:: anyone at Google working to stop malvertising threats or who works on their security teams, could easily take one of these domains that leads to malicious downloads, look up where it's hosted, take 10 seconds to notice the other dozens of similarly named domains also hosted on those IP addresses, and then block future advertising campaigns that launch from those IPs. A little bit of time, a simple rule, and this malvertising campaign would have had 1 successful ad launched, instead of at least 10. We've documented all 10 ads that our research sharing partners caught, and have provided additional details about the IPs in question and our thoughts around the simplicity of these pivots. Personally, I'm disappointed but not surprised. We know the malvertising threats have been active for years, but to see first hand how a simple campaign was ignored for a month, with clear proof that the threat actors were astroturfing across numerous advertising accounts, and the fact that absolute basic pivots could stop this -- is just proof that Google is out to lunch. If you are in the ad tech industry and have an obligation to stop threats to the public which also impact your own clients, it's time to step up and do the work to track *future* attacks and not just pretend like stopping today's attack is enough. Do the simple pivots to learn how the threat actor is hosting their infrastructure, and when you find a dedicated IP instance filled with suspect domains, flag that shit and prevent future attacks from coming from that same infrastructure. These are day 1 defenses, and doing less is unacceptable. Research link in the comments! ⬇️

78

9 Comments

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

I'm torn here... not sure govt can do a lot here, but applaud the effort. I like removing degree requirements for some positions for reasons already discussed at length, but not for all as it's still the most effective large scale soft-skill filter. Obviously this filter is less than ideal, but tell me a better one. I think training programs are a step in the right direction, but part of me thinks there is less available capability among the target set humans for these programs than we think. I think there needs to be a better filter here too for those to push through these programs. When I was in govt part of me naively thought this was something the market was well positioned to address with higher salaries, etc. Obviously not a silver bullet either. In many ways the gap is no difference than the one for other skilled trades. It seems the most effective solution there is apprenticeship programs, so maybe that's best here too. Thankfully that's number 2 on the list, but curious how to encourage that at scale across businesses with little incentives for them w/o grants/etc. Just my 2 cents to chew on. https://lnkd.in/ezjSR3cu

18

5 Comments

Rob makes some great points on trust centers! What would you expect a Trust Center to have?!? Having reviewed many myself I’ve come to the similar conclusion… many popular trust centers can’t be trusted! Many are just a simple yes/no ✅ checkbox exercise put out by the marketing department. They don’t actually show real time data that is in alignment to a security program. They often lack real time data that shows ongoing security measures and compliance conformity. At Compliance Scorecard we believe in actual trust, with real time data to back up the security program and help approve, ongoing, continuous, compliance monitoring Our friend Brian talks about “do what’s right” versus “do what’s popular” and that’s a similar mantra I have…

4

7 Comments

My book 📚 "Incident Response with Threat Intelligence" is also included in this promotion 🤓

65

7 Comments

The Trust Center tools offered by compliance vendors are pretty slick. They describe the organization's compliance program, what certifications and attestations they have, what controls they have in place, who their subprocessors are. In many respect, these are good tools that organizations should deploy. I have looked at a number of trust sites and have found a few themes. 1) The request for access to SOC 2 attestation report or similar documentation is not necessarily followed up on. While the company set up the site, they did not work on the process for when requests were made. I used the tool for one of our vendors (who doesn't have a great program) and they failed to respond. Since I am an actual customer I assume that I should be approved but they have not. I would bet that this behavior is not unique. 2) The controls listed on the website are very generic. I get that you are picking from a menu of controls. Someone in marketing is not crafting the specific language that is appropriate for your organization and site. Good trust centers should have language that is 100% applicable to the organization and not "The company requires authentication to production datastores to use authorized secure authentication mechanisms, such as unique SSH key." The sentence above does not give a good sense of the control or even if it is really being performed. 3) Speaking of not getting a good sense of things. Many of these pages do not give you good context for the cybersecurity program. I would like to see something like "Our cybersecurity team is led by Jane Smith, CISSP. We focus on x, y, and z." Maybe some statistics about the program. Most of these pages just give you raw information about the program. What do you think of Trust Center pages? Do they make things better or worse? Let us know in the comments below. #fciso

22

15 Comments

If anyone needed an explanation on the raise of #impersonation scams, this video should show the level of easy scaling criminals have access too. https://lnkd.in/ejnWFyau An entire upside-down industry exist to build and sell this kinf of tooling. Our predictions grow in volume weekly, the velocity and variety of attacks continue to raise. Reactive solutions are more and more showing the limit of real time processing. #PreCrime #predictiveintelligence #cybersecurity #PreemptiveDefense

43

Attackers already know your weaknesses—do you? Cyber risk management isn’t about waiting for problems to surface. It’s about: 🚨 Knowing where your vulnerabilities are. 🚨 Thinking like the bad guys. 🚨 Closing the gaps before they strike. Where should your team focus their efforts this year?

15

I’ve written a number of posts on testing and rolling out security controls safely on my blog including this one from 2020 ~ Better Testing for Better Outcomes. I have a bunch of others in a thread on X (sorry it’s the easiest right now) and on my blog. Taking the time to properly test and building tests into the software itself can prevent a lot of pain later. I explain how to do that in my posts and show examples of things not properly tested as well. https://lnkd.in/gcJ-PeG

10

4 Comments

Why are security controls paywalled? Paying more for a service just to have 2fa, SSO, or conditional access feels out of line. Here's two I just came across:   ▶️ GitHub requires the highest tier for SSO ▶️ Calendly requires Enterprise for SSO Make the strongest security options available by default.

30

1 Comment

Ex-employees still have access to your systems? Access review, recertification, attestation are all names for the same thing. Early in security teams chances are you won't find the budget for access recertification tools, at least not from the get go. We have to go manual. Let's dive into how you can do this quickly and as painless as possible. Activity: Access review/recertification There are a couple things I recommend you do before you get to this point. First, get an inventory list, second, prioritise. Without these, you can still get some value but you're kind of shooting in the dark. You may be wasting time and effort on low priority services. We want to avoid that. * Prioritisation here is important as it saves time from you but most importantly from your colleagues. Wasting time from your colleagues will hurt you in the long run. Prioritisation, mark the highest risk services of the organisation and focus just on these. It's not realistic to review everything in one go. For businesses with 500 or fewer employees you're probably looking at 5-10 high/critical services. That's a good number. You may not have a risk formula at this stage to assess the risk of your services but an informal 'finger in the air' method can work well. How does this method work? Ask the following question. Can the business operate if the tool is down? if the answer is "no", then it's a high risk. Identify the service owner, that would be the person whose team would be the most devastated if that service would go out of the window. Work with them to verify whether the users on this service are relevant and still need to have that level of access. A full month is a good deadline for service owners to verify user access. * Communication and preparation is king. Make sure you have done the groundwork. Go through the list and mark what you think needs to be done before you hand your list to the service owner. By guiding them like that you may be able to check out services from your list with just a 10 minute call with the service owner. You'll be surprised by how many forgotten users, ex-employees, duplicate accounts or even accounts shared by multiple people you will uncover there. Make sure to document the process and the results. Do this every 6 months for high risk services. For the rest you can be more relaxed, once per year is more than enough. #cybersecurity

18

Hot take: the cybersecurity industry wastes an incalculable amount of effort "remediating vulnerabilities" in code because a library used has some "vulnerability" that can't actually be exploited in the way it's used in the application.

187

67 Comments

You need to use the findings and automate based on those. eBPF is not enough.

2

*brays loudly* Howdy, code wranglers! It's time for another rootin' tootin' Technical Tuesday! Today, we're gonna mosey on down to the SAST corral and see how them Static Application Security Testing tools work their magic. Now, for you greenhorns out there, SAST is like havin' a real persnickety ranch hand look over your code without actually runnin' it. It's checkin' for them pesky security varmints hiding in plain sight! So how do these SAST tools work? Well, saddle up and let me break it down for ya: 1. Code Parsing: First off, the SAST tool takes your code and turns it into something it can understand - like translatin' donkey brays into human speak. It creates what we call an Abstract Syntax Tree (AST). 2. Pattern Matching: Then, faster than a jackrabbit on a hot griddle, it starts lookin' for patterns that match known security issues. It's like spotting a wolf in sheep's clothing! 3. Data Flow Analysis: This here's where it gets real fancy. The tool follows your data as it flows through the code, looking for places where bad input could cause a ruckus. 4. Control Flow Analysis: It also checks how your code moves from one part to another, makin' sure there ain't no sneaky backdoors or loops that could cause trouble. 5. Configuration Check: Last but not least, it takes a gander at your config files to make sure you ain't left the barn door open, so to speak. Once it's done, it'll spit out a report faster than a spooked mustang, tellin' you where all the potential security holes are. Now, SAST ain't perfect - it can sometimes cry wolf or miss some crafty varmints. But it's a mighty fine first line of defense in your code security roundup! So there you have it, folks! Next time you're fixin' to run a SAST scan, you'll know just what that tool is doing under the hood. Keep your code secure, and your debuggers debuggin'! YEE-HAW! #TechnicalTuesday #SAST #ApplicationSecurity #InfosecDonkey

12

As I previously posted, I’m struggling with PCI 4.0 Targeted Risk Analysis(TRA) process on frequency. The frequency on certain activities like vulnerability scanning and user access reviews are already determined by Corporate Policy, not a TRA. And some of these are “influenced” by other regulatory requirements such as SOX - must conduct quarterly user access reviews. Maybe a TRA would be a better approach to determining frequency, but I already have standards. What does the TRA contribute to an existing standard? One could argue that the TRA supports that standard but in reality I think it leads us to a foregone conclusion that quarterly is sufficient. I may end up with some type of TRA word salad that validates whatever frequency that the Company standards dictate. I’m still working on it, version 5. But I think having supporting Corporate Standards allows me to examine the risks of not complying with the aligned standards is the best approach to produce a TRA. Unless I go to version 6, which is unknown at this time.

Hiring a CISO is sooooo expensive. You have to: Pay for onboarding with money and time Pay their Salaries Give ESOPs as they're a C-suite hire Build them a team for Security and compliance. a shit ton of other things. No More. We are introducing the Cywreck V-CISO! Imagine getting the exact CISO you asked for, all the qualifications that you need at half the cost. That's what our virtual CISO does. 1 week onboarding, you get an outsourced team for your security and compliance from cywreck and you save them DOLLARS. Reach out to me or book a call with us on our website! #vciso #hireciso #compliance #cybersecurity #ciso #hiringciso

12