Colin O'Brien

SecEng @tines_hq

Previously:
SWE @Datadog
CEO/ Founder of @graplsec
SecEng @Dropbox
SWE @Rapid7

[Colin O'Brien @InsanityBit]

@Ford_Lascari AFAIK they basically did one round of handing out access and then kinda stopped?

[Colin O'Brien @InsanityBit]

Every key in 3B has an expiration. We support OIDC and oauth. We have no passwords, no forever-keys, no user API keys.

[Vercel @vercel]

It's time to retire long-lived static credentials.

We surveyed 1,000+ SaaS vendors and found only 8.4% support secure auth. This is our call to action and how we're doing our part.
https://t.co/yhWnPYeoAX

[Colin O'Brien @InsanityBit]

@gf_256 Will try this ty

[Colin O'Brien @InsanityBit]

@digitalshane_ https://t.co/ZDL48rWzt0

They have a whole section about disclosure and it's taking up a ton of comment space etc.

[Colin O'Brien @InsanityBit]

Incredible that php is trying to shift blame to chainguard.

Imagine releasing unsafe, dogshit software for decades and then when someone patches it a few hours early you go "yeah this is their fault".

[Dan Guido @dguido]

Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
https://t.co/mSr6Vkc4pj

[Colin O'Brien @InsanityBit]

I forked wasmtime to add additional optimizations but it's all vibecoded (explored mem64-specific opts).

I feel like this isn't something that would be interesting to send upstream, and I don't want to spend much time on prepping it. But also, significant mem64 wins.

[Colin O'Brien @InsanityBit]

@dguido Like, I could spend my month of tokens on dev and then spend the next month on daybreak, it's just kinda not economical to weave the two in together without blowing up my usage and having to halt development.

[Colin O'Brien @InsanityBit]

@dguido It puts me in an awkward position for personal projects because I have to choose to put my tokens towards development or towards vuln hunting.

[Colin O'Brien @InsanityBit]

@IceSolst We haven't actually doubled, I should have said our headcount is to double. We're still working on it.

[Colin O'Brien @InsanityBit]

@IceSolst We don't have a lead but one of the fills is a senior manager for the team. I'm the highest level, I guess.

I report to the director.

[Colin O'Brien @InsanityBit]

I seriously doubt that ASLR is a meaningful mitigation here. 0 chance there aren't tons of infoleaks in a C codebase the size of php.

*Maybe* infoleaking/ controlling the heap is particularly annoying because of the nature of the vulns though.

[Marcus Hutchins @MalwareTechBlog]

Current information I have on php2Shell:

- The RCEs requires the attacker to obtain memory addresses which are typically protected by ASLR.

- I suspect the original author (lcfr_hax) likely has a reliable exploit which leads to stable code execution.

- Most of the PoCs being posted are completely non-functional AI slop.

- There is at least 1 working non-slop exploit being passed around, but it's reliant on bruteforcing for ASLR bypass, so not particularly impactful.

- Rumor of ITW exploitation are patchy. There are attempts being seen using the non-functional leaked RCE, or variants that are config / system specific.

- Some rumors point towards a known-working exploit being used by threat actors (I've personally confirmed this specific exploit works, but the ASLR bypass technique is unreliable at best and massively limits the potential impact).

- I'd expect heavy ITW exploitation in the next few weeks based on how many people are looking at this. Though, success rates will vary heavily based on the specific exploit chain.

[Colin O'Brien @InsanityBit]

CPython still maps an RWX memory region right? And like, every library is in C/C++, right?

[Colin O'Brien @InsanityBit]

@mitsuhiko Attenuation is a really cool feature but I think it really only pays off if you lean very heavily into small, isolated services. Otherwise, it's a ton of effort and I don't think there's enough payoff.

[Colin O'Brien @InsanityBit]

We do support 90 day API keys in 3B, but they're pretty discouraged. Sadly, legacy clients expect this.

But we bind them to service accounts (not users, and service accounts can't be admins) so that the permissions are explicit, tag each token, and anywhere a token can be used we support and encourage OIDC instead.

Would be nice to not have them at all but I feel like we've done the best we can with the constraint.

[Colin O'Brien @InsanityBit]

I believe pretty strongly that vulnerabilities in software will be inexhaustible, regardless of whether you use proofs, AI, fuzzers, etc.

[Colin O'Brien @InsanityBit]

@ImLunaHey I think it does. If you have an exposed API with no secrets and them a "cookie minting" service that is isolated, that's a very meaningful isolation boundary. The exposed service is no longer the one holding secrets, it can just make requests to the one that does.

[Colin O'Brien @InsanityBit]

I'm adding `unsafe` to witchy, except it's going to:

1. Require proofs.
2. Break up `unsafe` into `unsafe` and `trust`.
3. Tests always run with address sanitization.
4. Can't be used in build scripts.
5. Safe constructs to reduce the need (ie: what zerocopy provides in rust).

[Colin O'Brien @InsanityBit]

@0xTib3rius Anyway, I agree with the broader point about brute force directions.

[Colin O'Brien @InsanityBit]

@0xTib3rius > Technically, the key that was "just 4" was a 384 bit number with 381 preceding zeroes.

Isn't it the case that they *were* generating a single byte though?

If I do:
x = rand_byte()
x = cast_to_384(x)

I don't think I've generated a random 384bit number.