This week I gave a talk on Hacking Holiday Lights at Kenna Security and here is the promised accompanying blog that outlines the hardware and software I demoed for easy reference for anyone who wants to build their own holiday lights.
I looked at a bunch of different boards that ended up having a variety of technical hurdles and ended up really liking the first two boards for ease of use and the last one for the “Real Hacker Experience”.
This has been an amazingly fun project that I was able to do with my son and my hardware hacking is not always that easy. You can easily build more complex and complicated displays using these tools and I hope you have fun exploring these systems and finding the right fit for you. If you have any questions please ping me on twitter @jgamblin.
I have been meaning to look at Cartography since I saw their talk at BSidesSF last year and I finally had a chance to start looking at it today. One of the first things I noticed was that is was not containerized so I built a quick container for it and decided to document my progress here.
I just spent a day and a half recovering my Github account after the code in my 2FA application stopped working for authentication. GitHub has a good support article on how to recover your account that has this ominous warning on it:
Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods.
I was worried that I wasn’t going to get access to my account back since I didn’t have a copy of my recovery codes so I reached out to GitHub support and was able to work with them to get access using my verification token from an SSH session.
If you have 2FA enabled on your account you should make sure you have the following:
About once a month I need a Kali VM to use for an hour or so, and I am terrible at keeping a VM up-to-date, so this weekend I took a few hours and built a tool to download automatically, provision and update a Kali Linux VM in Virtualbox.
I had the chance to attend LoCoMoCoSec this year and had a fantastic time. It was a well-run conference that was extremely focused on being friendly for families and being inclusive of the diverse group of people who make up our community.
It also doesn’t hurt that it was in one of the most beautiful places I have ever seen.
Many of the attendees and speakers had brought their families with them, and this helped the conference have a fantastic family feel to it.
The organizers decided to keep the inclusiveness going by only offering a cash bar and asking anyone who was planning on over drinking to please move to another bar.
LoCoMoCoSec is the only conference I have attended that is hyper-focused on real-world product security. With talk after talk full of actionable or relatable stories that I will take back to work with me to help improve our security posture. I will highlight some of the key takeaways I will be bringing back to work with me.
Open Source Security
Neil and Adam both had amazing presentations on open source security and I had a ton of conversations with people around the subject at this conference.
Neil talked about how Github struggled with getting from an out of date forked version of Rails to the latest current version. It was one of those rare talks where the presenter was open and honest about how hard it was to get up to date even in a technology company. I am looking forward to this presentation video being uploaded to share with my dev teams.
Adam from NPM talked about framework security and how little code is actually written in modern node apps. This slide shows that 97% of modern node apps are made up of underlying frameworks was one of the most talked about at the conference.
Outside of these talks, I spent a lot of time talking with people about how we can better understand and help the security of the many open source frameworks that companies build their applications on. This is a problem that everyone is obviously thinking about but no one has found an answer to yet.
I saw three really good talks about DevSecOps from James Wickett, Tanya Janca, and Dave Lindner all of who I really respect as leaders in our industry. They each had a very unique approach to this topic but they all ended up with DevSecOps is really hard and we all have a lot of work left to do. I have some thoughts on this topic and am working on a talk that I am hoping to be able to share later this summer.
James Wickett talk was one of the most entertaining of the conference, and he is writing a DevSecOps book that he is looking for material for. You can check out his slide deck here that includes contact information.
Tanya Janca is a high energy presenter and talked about the DevSecOps in sprints. She also talked about how great organizations have a ratio of 100 Devs to 10 Ops to 1 security person.
David Lindner who works at Contrast and is a friend of mine talked on Friday about the challenges of adapting appsec at a startup and balancing that with business needs. I empathized with him as we both come from startups of about the same size.
Bug Bounties are always a touchy subject at these conferences but there was a bunch of great discussions around them and how to improve them to make them more actionable.
Google in their talk about fixing CSP talked about 75% of their web payouts are for XSS bugs and how they are working on fixing that.
Katie Moussouris gave a talk about how bug bounties work and my biggest take away from her talk was that there is likely less than 500 bug bounty hunters who find the majority of all bugs.
Melanie Ensign from Uber put together an amazing Dive Track with the ability for people to take a few hours and explore some of the best diving in the world. I took a morning and went out for an amazing drive.
Overall I had an amazing time and I didn’t talk to anyone who wasn’t looking forward to LoCoMoCoSec 20202. I know if at all possible I will be going back. 🤙
Bundle Audit is a great tool to check if the Ruby Gems used in your project have any known vulnerabilities. Most DevOps teams I know run this tool against their builds in their CI/CD process when deploying. This can mean that code that is not updated often can have vulnerable gems unless you have a way to continually monitor your projects.
I spent some time looking at a few solutions this week and I thought I might be able to do this with a crappy shell script™ and the GitHub API. So, this morning while watching cartoons (The new Carmen San Deigo series is excellent.) I wrote this:
I have developed a bad habit of picking up vanity domain names and not really doing much with them. Last month at AWS Re:Invent I picked up ServerlessSecurity.org and really wanted to do something with it but didn’t feel like maintaining, or paying for, a VPS so after doing some looking around I found that is was possible to point a custom domain to Github pages.
The documentation they provide is a little lacking, so I figured I would put together a small how to for anyone who wants to do this for themselves.
Here is a list of my favorite security books from 2018 if you are looking for that last minute gift or have some extra time around the holidays to catch up on some reading.
The GCHQ Puzzle Book 2
I just got The GCHQ Puzzle Book 2, and like the original, it has quickly become the book that I always have in my bag. It is full of amazingly challenging and thought-provoking problems. It is easily the best gift you can give the security geek in your life this year.