Hacking Articles Tips Tricks Videos Tutorials
471 subscribers
65.9K photos
15 videos
157 files
132K links
Exploit
Pentesting
Hacking
Red Team
Blue Team
Kali Linux
Bug Bounty
Black Hat
Cyber security etc

@Hacking_Video
@Hacking_attack
Download Telegram
Hacking Articles Tips Tricks Videos Tutorials
ess. The user-defined build script: MUST declare all dependencies, including sources and other build steps, using immutable references in a format that the build service understands. The build service: MUST fetch all artifacts in a trusted control plane. MUST…
ucible.✓✓Dependencies completeProvenance records all build dependencies that were available while running the build steps. This includes the initial state of the machine, VM, or container of the build worker.MUST include all user-specified build steps, sources, dependencies.SHOULD include all service-provided artifacts.✓
Requirements on the contents of the provenance:
RequirementDescriptionL1L2L3L4Identifies artifactThe provenance MUST identify the output artifact via at least one cryptographic hash. The provenance MAY provide multiple identifying cryptographic hashes using different algorithms. When only one hash is provided, the RECOMMENDED algorithm is SHA-256 for cross-system compatibility. If another algorithm is used, it SHOULD be resistant to collisions and second preimages.✓✓✓✓Identifies builderThe provenance identifies the entity that performed the build and generated the provenance. This represents the entity that the consumer must trust. Examples: “GitHub Actions with a GitHub-hosted worker”, “jdoe@example.com’s machine”.✓✓✓✓Identifies sourceThe provenance identifies the source containing the top-level build script, via an immutable reference. Example: git URL + branch/tag/ref + commit ID.✓✓✓✓Identifies entry pointThe provenance identifies the “entry point” or command that was used to invoke the build script. Example: make all.✓✓✓✓Includes all build parametersThe provenance includes all build parameters under a user’s control. See Parameterless for details. (At L3, the parameters must be listed; at L4, they must be empty.)✓✓Includes all transitive dependenciesThe provenance includes all transitive dependencies listed in Dependencies Complete.✓Includes reproducible infoThe provenance includes a boolean indicating whether build is intended to be reproducible and, if so, all information necessary to reproduce the build. See Reproducible for more details.✓Includes metadataThe provenance includes metadata to aid debugging and investigations. This SHOULD at least include start and end timestamps and a permalink to debug logs.”○” = RECOMMENDED.○○○○
Common Requirements

Common requirements for every trusted system involved in the supply chain (source, build, distribution, etc.)
RequirementDescriptionL1L2L3L4SecurityThe system meets some TBD baseline security standard to prevent compromise. (Patching, vulnerability scanning, user isolation, transport security, secure boot, machine identity, etc. Perhaps NIST 800-53 or a subset thereof.)✓AccessAll physical and remote access must be rare, logged, and gated behind multi-party approval.✓SuperusersOnly a small number of platform admins may override the guarantees listed here. Doing so MUST require approval of a second platform admin.✓
Example

Motivating example

Consider the example of using curl through its official docker image. What threats are we exposed to in the software supply chain? (We choose curl simply because it is a popular open-source package, not to single it out.)

The first problem is figuring out the actual supply chain. This requires significant manual effort, guesswork, and blind trust. Working backwards:

* The “latest” tag in Docker Hub points to 7.72.0.
* It claims to have come from a Docker file in the curl/curl-docker GitHub repository.
* That Docker file reads the following artifacts, assuming there are no further fetches during build time:
* Docker Hub image: registry.hub.docker.com/library/alpine:3.11.5
* Alpine packages: libssh2 libssh2-dev libssh2-static auto conf auto make build-base groff open ssl curl-dev python3 python3-dev lib tool curl stunnel perl nghttp2
* File at URL: https://curl.haxx.se/ca/cacert.pem

* Each of the dependencies has its own supply chain, but let’s look at curl-dev, which contains the actual “curl” s[...]

___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
ucible.✓✓Dependencies completeProvenance records all build dependencies that were available while running the build steps. This includes the initial state of the machine, VM, or container of the build worker.MUST include all user-specified build steps, sources…
ource code.
* The package, like all Alpine packages, has its build script defined in an APKBUILD in the Alpine git repo. There are several build dependencies:
* File at URL: https://curl.haxx.se/download/curl-7.72.0.tar.xz.
* The APKBUILD includes a sha256 hash of this file. It is not clear where that hash came from.

* Alpine packages: openssl-dev nghttp2-dev zlib-dev brotli-dev autoconf automake groff libtool perl

* The source tarball was presumably built from the actual upstream GitHub repository curl/curl@curl-7_72_0, by running the commands ./buildconf && ./configure && make && ./maketgz 7.72.0. That command has a set of dependencies, but those are not well documented.
* Finally, there are the systems that actually ran the builds above. We have no indication about their software, configuration, or runtime state whatsoever.

Suppose some developer’s machine is compromised. What attacks could potentially be performed unilaterally with only that developer’s credentials? (None of these are confirmed.)

* Directly upload a malicious image to Docker Hub.
* Point the CI/CD system to build from an unofficial Dockerfile.
* Upload a malicious Dockerfile (or other file) in the curl/curl-docker git repo.
* Upload a malicious https://curl.haxx.se/ca/cacert.pem.
* Upload a malicious APKBUILD in Alpine’s git repo.
* Upload a malicious curl-dev Alpine package to the Alpine repository. (Not sure if this is possible.)
* Upload a malicious https://curl.haxx.se/download/curl-7.72.0.tar.xz. (Won’t be detected by APKBUILD’s hash if the upload happens before the hash is computed.)
* Upload a malicious change to the curl/curl git repo.
* Attack any of the systems involved in the supply chain, as in the SolarWinds attack.

SLSA intends to cover all of these threats. When all artifacts in the supply chain have a sufficient SLSA level, consumers can gain confidence that most of these attacks are mitigated, first via self-certification and eventually through automated verification.

Finally, note that all of this is just for curl’s own first-party supply chain steps. The dependencies, namely the Alpine base image and packages, have their own similar threats. And they too have dependencies, which have other dependencies, and so on. Each dependency has its own SLSA level and the composition of SLSA levels describes the entire supply chain’s security.

For another look at Docker supply chain security, see Who’s at the Helm? For a much broader look at open source security, including these issues and many more, see Threats, Risks, and Mitigations in the Open Source Ecosystem.

Vision: Case Study

Let’s consider how we might secure curlimages/curl from the motivating example using the SLSA framework.

Incrementally reaching SLSA 4

Let’s start by incrementally applying the SLSA principles to the final Docker image.

SLSA 0: Initial state

Initially the Docker image is SLSA 0. There is no provenance. It is difficult to determine who built the artifact and what sources and dependencies were used.

The diagram shows that the (mutable) locator curlimages/curl:7.72.0 points to (immutable) artifact sha256:3c3ff….

SLSA 1: Provenance

We can reach SLSA 1 by scripting the build and generating provenance. The build script was already automated via make, so we use simple tooling to generate the provenance on every release. Provenance records the output artifact hash, the builder (in this case, our local machine), and the top-level source containing the build script.

In the updated diagram, the provenance attestation says that the artifact sha256:3c3ff… was built from curl/curl-docker@d6525…[...]

___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
ource code. * The package, like all Alpine packages, has its build script defined in an APKBUILD in the Alpine git repo. There are several build dependencies: * File at URL: https://curl.haxx.se/download/curl-7.72.0.tar.xz. * The APKBUILD includes a sha256…
.

At SLSA 1, the provenance does not protect against tampering or forging but may be useful for vulnerability management.

SLSA 2 and 3: Build service

To reach SLSA 2 (and later SLSA 3), we must switch to a hosted build service that generates provenance for us. This updated provenance should also include dependencies on a best-effort basis. SLSA 3 additionally requires the source and build platforms to implement additional security controls, which might need to be enabled.

In the updated diagram, the provenance now lists some dependencies, such as the base image (alpine:3.11.5) and apk packages (e.g. curl-dev).

At SLSA 3, the provenance is significantly more trustworthy than before. Only highly skilled adversaries are likely able to forge it.

SLSA 4: Hermeticity and two-person review

SLSA 4 requires two-party source control and hermetic builds. Hermeticity in particular guarantees that the dependencies are complete. Once these controls are enabled, the Docker image will be SLSA 4.

In the updated diagram, the provenance now attests to its hermeticity and includes the cacert.pem dependency, which was absent before.

At SLSA 4, we have high confidence that the provenance is complete and trustworthy and that no single person can unilaterally change the top-level source.

We can recursively apply the same steps above to lock down dependencies. Each non-source dependency gets its own provenance, which in turns lists more dependencies, and so on.

The final diagram shows a subset of the graph, highlighting the path to the upstream source repository (curl/curl) and the certificate file (cacert.pem).

In reality, the graph is intractably large due to the fanout of dependencies. There will need to be some way to trim the graph to focus on the most important components. While this can reasonably be done by hand, we do not yet have a solid vision for how best to do this in an scalable, generic, automated way. One idea is to use ecosystem-specific heuristics. For example, Debian packages are built and organized in a very uniform way, which may allow Debian-specific heuristics.

Composition of SLSA levels

An artifact’s SLSA level is not transitive, so some aggregate measure of security risk across the whole supply chain is necessary. In other words, each node in our graph has its own, independent SLSA level. Just because an artifact’s level is N does not imply anything about its dependencies’ levels.

In our example, suppose that the final curl images/curl Docker image were SLSA 4 but its curl-dev dependency were SLSA 0. Then this would imply a significant security risk: an adversary could potentially introduce malicious behavior into the final image by modifying the source code found in the curl-dev package. That said, even being able to identify that it has a SLSA 0 dependency has tremendous value because it can help focus efforts.

Formation of this aggregate risk measure is left for future work. It is perhaps too early to develop such a measure without real-world data. Once SLSA becomes more widely adopted, we expect patterns to emerge and the task to get a bit easier.

Accreditation and delegation

Accreditation and delegation will play a large role in the SLSA framework. It is not practical for every software consumer to fully vet every platform and fully walk the entire graph of every artifact. Auditors and/or accreditation bodies can verify and assert that a platform or vendor meets the SLSA requirements when configured in a certain way. Similarly, there may be some way to “trust” an artifact without analyzing its dependencies. This may be particularly valuable for closed source software.


Download

___________________________
@hacking_Attack
@Hacking_Video
How I Earned $400 IN 8min On Private H1 Program

Hi everyone, Calogero here, this is going to be a short write-up about a vuln that only took 8 minutes to find. So it has taken me a very…Continue reading on Medium »
Read more...
hacking: security in practice
Any good Bluetooth / ble hacking tutorial?

Hey guys! I'm trying to learn more about Bluetooth pentest & hacking. Tutorials I can found are quite confusing, do you have anything good to advice?

Thanks!

submitted by /u/RAZ0RP
[link] [comments]
Sent by @TheFeedReaderBot

___________________________
@hacking_Attack
@Hacking_Video
https://b.thumbs.redditmedia.com/MWZiS3rWlAM0Oo_35JpzEvjKFxIDRYA-7e3cNI5v16s.jpg Dear hackers,

I'm doing an assignment where i have to find a flag in a remote system (I already got acces using metasploit). The only hint I have is that I have to find password files and crack the hashes. The host machine is running on Windows 10 and I'm not quite used to it. I have extracted the SAM and SYSTEM files and I was able to find this:



https://preview.redd.it/elvuq4003wm71.png?width=837&format=png&auto=webp&s=0358b706969b0cb943e7b631c20869e7f2bea22b

I noticed that all the hashes are the same and that they mean NULL. I did some research and this could be because Windows 10 doesn't store things at SAM anymore (?? not sure), however, i haven't been able to find any other hashed passwords in the system. Any idea of WHAT or WHERE should I search? I'm misunderstanding something?

Any help will be really apreciated, Thank you so much!

submitted by /u/FreeRaider1
[link] [comments]
Sent by @TheFeedReaderBot

___________________________
@hacking_Attack
@Hacking_Video
Hacking on Medium
碎碎念隨筆(一):駭客 & SSH & 初學 Linux 指令


日期:9/6 ~ 9/8

Continue reading on Medium »
Hacking on Medium
$3133.70 Google Dialogflow IDOR Vulnerability


Hey, Amazing Hackers, am Raidh Ĥere, Hope, you all are doing well.

Continue reading on Medium »
Hacking on Medium
HackTheBox Writeup — Schooled


Hello Guys , I am Faisal Husaini. My username on HTB is “fa1sal” . Also join me on discord.

Continue reading on Medium »
Hacking on Medium
How I Earned $400 IN 8min On Private H1 Program


Hi everyone, Calogero here, this is going to be a short write-up about a vuln that only took 8 minutes to find. So it has taken me a very…

Continue reading on Medium »
Deep Web
The DW isn’t as scary and exciting as it seems..

Although all those horror stories paint the dark web as some forum filled with gore and live videos of torture and such, dw does have this but it’s mainly a slightly worse 4chan. To get to an actual criminal site in the dw, you have to have certain URLs and even then the host is able to deny you access. Yes there’s ways to bypass those but with feds cracking down on the dw, it’s not as exhilarating anymore..

Edit - And as bone chilling as those horror stories sound, let’s be honest, they’re all BS.

submitted by /u/SCRXVM_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video