August 2020 Summaries

Portable Document Format (PDF) files, while widely used, can pose significant security risks as highlighted in Jens Müller's presentation at Black Hat USA 2020. The complexity and ubiquity of PDFs make them attractive targets for attackers, with potential threats including denial of service attacks through infinite loops or deflate bombs, which can crash systems by overloading them. Additionally, PDFs can hide more severe vulnerabilities such as informational disclosure, where malicious files can leak users' IP addresses or allow unauthorized access to local files, potentially leading to privacy breaches. A particularly severe vulnerability involves code execution through logical bugs rather than buffer overflows, although this only affects a few PDF readers. Müller's research underscores the importance of caution when dealing with PDFs from unknown sources and suggests that web browsers' built-in PDF viewers generally offer the least security risk. The findings emphasize the need for continuous security vigilance and the role of ethical hackers in identifying emerging threats, as demonstrated by Detectify's efforts to provide cutting-edge security research and solutions.

In an increasingly fast-paced tech environment, the attack surface has broadened beyond traditional firewalls and network monitoring to include web applications, which serve as new entry points for unauthorized access. As businesses prioritize agile methodologies like CI/CD, the focus on security can wane, increasing vulnerabilities. The attack surface, defined by known and unknown components, includes intentional and unintentional web application exposure, which can be exploited by attackers. Effective reduction strategies involve keeping an inventory of web applications, identifying technologies in the tech stack, approaching asset discovery like a hacker, integrating security checks into the development lifecycle, maintaining updated software, and addressing even minor vulnerabilities. Organizations are encouraged to adopt a proactive and integrated approach to security by embedding it into development cycles and maintaining awareness, as innovation and business needs necessitate continuous production and code development.

Özgür Alp, an experienced ethical hacker with over seven years in offensive security, successfully uncovered a significant vulnerability by transforming an open redirect issue into a publicly disclosed vulnerability, CVE-2020-1323, with the support of the Detectify Crowdsource team. Initially discovered during a routine bug bounty program, the vulnerability was linked to Microsoft SharePoint but was initially deemed out-of-scope by Microsoft due to the low impact nature of URL redirects. Persistence paid off when Alp reported the finding to Detectify, a platform that accepts open redirect reports irrespective of the vendor. This led to the development of a live module and a coordinated effort for responsible disclosure with Microsoft, resulting in the bug being patched and recognized with a CVE assignment. Despite Microsoft's initial assessment, collaboration ultimately led to a $1200 bounty, showcasing the value of persistence and teamwork in vulnerability disclosure.