Ryan Armstrong

Public health advocate. PhD Biomedical Eng. AppSec professional. Teach @fanshwecollege. AppSec YouTube:

[Ryan Armstrong @ryarmst]

@OreoB1scuit This is a solid series. You may also be interested in my related YouTube series: https://t.co/RDU4q7Edj7

[Ryan Armstrong @ryarmst]

@shakquraa You might be interested in my recent YouTube series: https://t.co/RDU4q7Edj7

[Ryan Armstrong @ryarmst]

@0xTib3rius There are additional possibilities with examples here: https://t.co/CPnxPEjbOg

[OWASP ASVS Project @OWASP_ASVS]

Excited to welcome @ryarmst onto the @OWASP_ASVS working group!

As a long-time user and recent contributor, Ryan brings his insights in using ASVS for pen testing engagements to help us improve for version 5.0!

[OWASP ASVS Project @OWASP_ASVS]

The first ASVS Community Meetup was a great success! Thanks to @jit_io for the support!

We had great talks from @manicode, @dcuthbert, @joshcgrossman, @IreneMichlin and Alex S, and super interesting discussions.

Full details in our blog post:
https://t.co/CWtINGaoSQ

[Ryan Armstrong @ryarmst]

@pentestlist @intigriti I would if I had the time!

[Dave Kennedy @HackingDave]

The sophistication levels of online scammers that are targeting individuals and families is hitting an all time level.

Just dealt with a friend that drained all their bank accounts, SIM cloning, and had full voice cloning (to remove accents + sound perfect) and kept them on phone as they depleted accounts.

Super methodical, well prepared, precise, and had all their prior breach data at hand. This wasn't your antivirus is out of date, this was starting off:

1. Well prepared pre-text using prior breach data as initial trust gainer.
2. Chase fraud services spoofed number with caller ID.
3. Directed them to a fake FTC 800 number to report claim.
4. Already knew all their bank accounts, SIM cloned to get one time pin, through carrier due to credential stuffing.
5. Delay them as bank accounts were depleted and locked out of accounts to not recall funds.

Definitely gave me the beekeeper movie vibes.

[Health Watch @HealthWatch123]

Chiropractors again banned from giving Australian babies spinal treatment. Canada should do the same. ⁦@ryarmst⁩ ⁦@picardonhealth⁩ ⁦@CaulfieldTim⁩ ⁦@VikCBC⁩ ⁦@NightShiftMD⁩ ⁦@ScienceBasedMed⁩ ⁦@MaryFernando_⁩ https://t.co/IOx8s3oI47

[OWASP ASVS Project @OWASP_ASVS]

Coming to the @OWASP ASVS Community Meetup at Global AppSec Lisbon?

We need your input!

What would you like to see/do at the meetup? Let us know by answering a few questions:
https://t.co/quXcVK37c5

[Ryan Armstrong @ryarmst]

@pentestlist @intigriti Missing a very useful Burp extension: https://t.co/rD5aoc34Lo

[Ryan Armstrong @ryarmst]

@Scott_Helme @JoshCGrossman @OWASP_ASVS I don't think that's quite the case. I can think of scenarios where even following something like the "strict CSP" approach there could exist attacks that succeed without triggering a violation.

[Ryan Armstrong @ryarmst]

@Scott_Helme @JoshCGrossman @OWASP_ASVS @reporturi Of course, and I've never claimed reporting is not an important practice. We recommend it to clients as part of the process of deploying CSP. I just have not seen the evidence of violation reporting being effectively used to identify potential XSS attacks in practice.

[Ryan Armstrong @ryarmst]

@Scott_Helme @JoshCGrossman @OWASP_ASVS @reporturi Can you link the blog post? I have not seen many such cases reported/documented publicly, but I trust your account of it, thank you. Similarly, I have largely only seen clients using reports to refine their policies for functional reasons.

[Ryan Armstrong @ryarmst]

@Scott_Helme @JoshCGrossman @OWASP_ASVS There would, however, be situations where an attacker is not able to evaluate their own payloads in a controlled environment/browser (such as blind attacks).

[Ryan Armstrong @ryarmst]

@Scott_Helme @JoshCGrossman @OWASP_ASVS Assuming the attacker develops the attack in their own browser and app context, they can test/experiment without sending reports. If they can then develop a payload that works and does not trigger CSP, the attack proceeds with no violation logs from the full process.

[Ryan Armstrong @ryarmst]

@Scott_Helme @JoshCGrossman @OWASP_ASVS @Scott_Helme do you have available any case studies or data on orgs identifying and mitigating XSS vectors primarily from CSP violation reports?

[Ryan Armstrong @ryarmst]

@Scott_Helme @JoshCGrossman @OWASP_ASVS We have always recommended reporting regardless, but I've seen it more as a tool to properly deploy a CSP without breaking page functionality.

[Ryan Armstrong @ryarmst]

@Scott_Helme @JoshCGrossman @OWASP_ASVS How about this: have you observed instances of CSP violation reporting in the wild that has been used to identify and remediate a potential XXS vector in an app?

[Ryan Armstrong @ryarmst]

@Scott_Helme @JoshCGrossman @OWASP_ASVS As you say, the end goal is strengthening the CSP, but violations of the policy only capture what could already be blocked by a given policy. If I am misunderstanding, please describe how violation reports can help strengthen a CSP or identify actually effective attacks.