September 2019 Summaries

Alyssa Herrera, a bug bounty hacker and web application security researcher, delved into developing an exploitable payload for a vulnerability in Pulse Secure Connect (CVE-2019-11510) following intriguing research presented at Black Hat USA 2019. The project began with attempts to reverse engineer the exploit from limited information provided in the presentation slides, eventually leading to the creation of a proof of concept in collaboration with other security experts. The vulnerability allows attackers to access sensitive files on servers running Pulse Secure Connect by exploiting a flaw in path validation. This discovery underscores the critical importance of patching software to mitigate potential breaches, as attackers often target outdated systems to gain unauthorized access to sensitive data. Despite patches being released, a significant number of companies, including major organizations, remain at risk due to unpatched systems. The research emphasizes the necessity of regular updates and vigilance in cybersecurity practices to protect against such vulnerabilities.

Detectify, a cloud-native security solution leveraging automation and crowdsourcing to identify web vulnerabilities, uses the Go programming language for its microservices due to its performance and toolset, including the pprof profiling tool. Despite Go's strengths, the Detectify team faced challenges with what appeared to be a memory leak in one of their microservices, as memory usage would build up and not decrease, leading to out-of-memory errors. Through a detailed investigation using pprof, they explored various potential causes like unclosed resources and global variables, but found no memory leak. Instead, the issue was related to Go's memory management system, which was not releasing memory back to the operating system as expected. This behavior was linked to changes in Go 1.12, where the memory signaling was altered from MADV_DONTNEED to MADV_FREE, impacting how quickly the operating system reclaims unused memory. By using the GODEBUG=madvdontneed=1 flag and manual memory management techniques, the team was able to mitigate the issue, highlighting the importance of understanding runtime behaviors and the changes in programming language ecosystems. Detectify emphasizes the need for continuous security in microservices architecture, offering solutions that utilize hacker payloads to identify vulnerabilities, with a free two-week trial available for interested users.