Colin O'Brien

SecEng @tines_hq

Previously:
SWE @Datadog
CEO/ Founder of @graplsec
SecEng @Dropbox
SWE @Rapid7

[Colin O'Brien @InsanityBit]

@dinodaizovi It's not that OIDC solves all problems but look at even just the recent tidb breach. Long lived customer creds were sitting in tickets. OIDC would have solved that.

[Colin O'Brien @InsanityBit]

@dinodaizovi Why wouldn't you just do both? You can have the client side attestation happen via a TPM. This is what GSuite does on Chromebooks.

Cert management and device management are way more work than OIDC. Reducing access time seems like sort of just a basic least privilege move.

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

Its me, I have a working PoC with the infoleaks to bypass ASLR. It took a lot of prompting and re-iterating to find those, tested against PHP 8.5.11 x86_64 with with all defaults and tested over the Internet

[SinSinology @SinSinology]

next time you're thinking about researching the linux kernel (@linuxfoundation), remember that someone on the receiving end of your report might talk about you like this:

in one of the threads, kernel maintainer "Peter Zijlstra" decides to call the ZDI team "monkeys"

there's a longer argument about how ZDI submits reports, whether they should include patches, and how fixes get tested. fair enough, have that discussion

but how does insulting the people reporting vulnerabilities help?

i thought the kernel's code of conduct was something everyone on these lists was expected to follow
sad to see people spoken to like this while trying to help improve linux security.

crime scene:
https://t.co/4Ud7JUz10M
https://t.co/vXiHlvyZGi

[Colin O'Brien @InsanityBit]

@criccomini Check out MBX. Also split files up, agents create huge files and the diffs slow things down more than I'd expected. Move tests to separate files entirely where possible.

[Colin O'Brien @InsanityBit]

@GeorgePirlea @S1r1u5_ You think the Linux kernel will be formally verified?

[Colin O'Brien @InsanityBit]

Yeah that's a very fair point. If we are limiting this to a specific set of programs it's technically tractable. I still think it's not practical, especially given moving targets - these aren't static codebases, even the compilers would have to be proven (unless you moved proofs to the binaries, which is an option). But maybe a small TCB can be.

[Colin O'Brien @InsanityBit]

@HackingLZ It's an exposed service, I don't think this poses much of a problem.

[Colin O'Brien @InsanityBit]

I seriously doubt that ASLR is a meaningful mitigation here. 0 chance there aren't tons of infoleaks in a C codebase the size of php.

*Maybe* infoleaking/ controlling the heap is particularly annoying because of the nature of the vulns though.

[Marcus Hutchins @MalwareTechBlog]

Current information I have on php2Shell:

- The RCEs requires the attacker to obtain memory addresses which are typically protected by ASLR.

- I suspect the original author (lcfr_hax) likely has a reliable exploit which leads to stable code execution.

- Most of the PoCs being posted are completely non-functional AI slop.

- There is at least 1 working non-slop exploit being passed around, but it's reliant on bruteforcing for ASLR bypass, so not particularly impactful.

- Rumor of ITW exploitation are patchy. There are attempts being seen using the non-functional leaked RCE, or variants that are config / system specific.

- Some rumors point towards a known-working exploit being used by threat actors (I've personally confirmed this specific exploit works, but the ASLR bypass technique is unreliable at best and massively limits the potential impact).

- I'd expect heavy ITW exploitation in the next few weeks based on how many people are looking at this. Though, success rates will vary heavily based on the specific exploit chain.

[Colin O'Brien @InsanityBit]

@Ford_Lascari AFAIK they basically did one round of handing out access and then kinda stopped?

[Colin O'Brien @InsanityBit]

Every key in 3B has an expiration. We support OIDC and oauth. We have no passwords, no forever-keys, no user API keys.

[Vercel @vercel]

It's time to retire long-lived static credentials.

We surveyed 1,000+ SaaS vendors and found only 8.4% support secure auth. This is our call to action and how we're doing our part.
https://t.co/yhWnPYeoAX

[Colin O'Brien @InsanityBit]

@gf_256 Will try this ty

[Colin O'Brien @InsanityBit]

@digitalshane_ https://t.co/ZDL48rWzt0

They have a whole section about disclosure and it's taking up a ton of comment space etc.

[Colin O'Brien @InsanityBit]

Incredible that php is trying to shift blame to chainguard.

Imagine releasing unsafe, dogshit software for decades and then when someone patches it a few hours early you go "yeah this is their fault".

[Dan Guido @dguido]

Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
https://t.co/mSr6Vkc4pj

[Colin O'Brien @InsanityBit]

I forked wasmtime to add additional optimizations but it's all vibecoded (explored mem64-specific opts).

I feel like this isn't something that would be interesting to send upstream, and I don't want to spend much time on prepping it. But also, significant mem64 wins.

[Colin O'Brien @InsanityBit]

@dguido Like, I could spend my month of tokens on dev and then spend the next month on daybreak, it's just kinda not economical to weave the two in together without blowing up my usage and having to halt development.

[Colin O'Brien @InsanityBit]

@dguido It puts me in an awkward position for personal projects because I have to choose to put my tokens towards development or towards vuln hunting.

[Colin O'Brien @InsanityBit]

@IceSolst We haven't actually doubled, I should have said our headcount is to double. We're still working on it.

[Colin O'Brien @InsanityBit]

@IceSolst We don't have a lead but one of the fills is a senior manager for the team. I'm the highest level, I guess.

I report to the director.