Recent content in Posts on David Dworken's Blog
The Problem of Verifiable Web Apps Web applications face a fundamental trust issue: users have no reliable way to verify they’re running the code the developer claims. Consider a trivial app that many developers might find useful: a JWT validation service that parses JWTs and looks for issues - users must trust that the code validates tokens without stealing them. Another more complex…
Trusted Execution Environments (TEEs) promise to protect sensitive workloads from privileged attackers through cryptographically isolated enclaves. In practice, I think they are sometimes treated as “magic security dust” that can be sprinkled on top of a system, without critically considering the limitations of TEEs. This post aims to give a brief analysis of some security gaps in TEEs…
Measuring security effectively involves understanding not only the type of risks but also the appropriate metrics that reflect real-world threats. Two crucial categories of metrics—abuse metrics and security metrics—serve distinct purposes, each critical in their own way. Here’s why I think distinguishing them matters. Abuse Metrics: Measuring Real-World Impact Abuse metrics quantify actual…
Lately I’ve been working a good bit on security metrics, and I wanted to publish a short post on some learnings I’ve had along the way. First off, security metrics may not be super exciting to work on, but I do see them as important work. They make it possible for leadership and product teams alike to understand security postures without having to go and directly talk to a subject…
I recently published a blog post on the Google Security Engineering blog about the tradition on Google’s security team of hacking coworkers and stealing each other’s passwords. This is one of my favorite parts of the culture at Google and something I’ve personally gotten the chance to take part in. Believe me, getting to hack Google is exciting. Check out the blog post below!…
Check out my slides from the XS-Leaks Summit where I gave a talk about how we’re continuing to scale XS-Leak mitigations across Google to ensure that all services are fully protected against this dangerous class of vulnerabilities!
Check out my slides from LocoMocoSec 2024 where I gave a talk about how blocking third-party cookies can “fix” web security!
My team at Google recently published a paper about Security Signals our system to make web security posture measurable at scale. Check out the paper below!
I recently published a blog post on the Google Security Engineering blog about how we scale security practices across all of Google. Check it out below!
What does it mean to support “secure” updates? Nowadays, supply chain attacks are at the forefront of everyone’s mind, so I think it is worth delving into what it really means to make software updates secure. The simplest version of software updates is just downloading the updated software version from the vendor, and executing it. For example, one can just download a binary from…
I recently published a blog post on the Google Security Engineering blog about new approaches for securely hosting user data without risking introducing XSS vulnerabilities. Check it out below!
hiSHtory See hiSHtory: Your shell history in context, synced, and queryable and hiSHtory: Cross-device Encrypted Syncing Design for the context. I recently started promoting hiSHtory in a few different forums to see whether this was just me scratching my own itch, or something useful for other people. In order, I: Posted on HN which fizzled with no real attention. Posted on Product Hunt which also…
hiSHtory I recently launched hiSHtory on reddit and HN, and have gotten some questions about exactly how it is able to support complex queries, and end-to-end encryption. So let’s do a guided tour of the syncing code! Installation and Initial Syncing When hishtory is installed, it generates a random secret key. In order to share a shell history, computers have to also share this secret key…
hiSHtory Check out my latest project, hiSHtory, which is your shell history, but with superpowers. It is stored in context (where did I run that command? what was the output of the command? how long did it take to run?), queryable (via a search interface, and SQLite), and synced cross-machine. Check out this demo: And check it out on GitHub!
same-site, cross-origin attacks Here’s an interesting brain teaser: Is it safe to host untrusted HTML on evil.example.com if your main app is hosted on app.example.com? The tempting simple answer is “it is safe as long as authentication cookies are set for app.example.com and not .example.com”, but there are a number of other key ways this can go wrong. Read on! Overwriting…
log4j scanning Like everyone in security I was hard at work over the holidays working on log4j scanning. We just open sourced the log4j scanner that I worked on with my colleages at Google. Check it out here. It is capable of crawling an entire machine to find jars containing log4j (matching on the generated java byte code!) and auto-patching all found jars.
XS Leaks I recently got the chance to present at the XS-Leaks mini-conf on my work to deploy Resource Isolation Policy and Cross-Origin Opener Policy across Google. Check out my slides below!
Worming through IDEs Check out my DEF CON 29 presentation on hacking IDEs! I found and disclosed critical vulnerabilities in over a dozen IDEs:
Google Cloud Shell Intro Because of the pandemic, I ended up with a lot of free time stuck in my apartment so I decided to try to get back into bug bounties. Since it’s been a while, I decided that my strategy would be to find an interesting target and then go very deep on understanding that target rather than jumping around between different targets. I spent a while poking around and…
This past spring I took my college’s compilers course which was an absolute blast. During the course, my partner and I wrote a compiler in OCaml that compiles a custom functional language straight down to x64 assembly. After the course finished, I spent a bit of time working on adding some more features to my compiler. My current feature set is: Basic integer arithmetic (+, -, *, /, %)…
Just for fun, I’ve been working on migrating my personal infrastructure to run on top of Kubernetes. This post documents some of the hacks and tricks it took to do some less conventional things with it. After poking around with the different Cloud k8s providers, I ended up deciding to go with Digitalocean just for ease of use and predictable billing. Enabling SWAP on DigitalOcean Kubernetes…
While poking around Google looking for a good target for bug bounties, I started to look at Google Apps Script which is a Javascript based Lambda competitor (and one that was launched a long time ago). It supports using SQL to connect to a remote database, so I started poking around and saw that it supports a class called JdbcSQLXML which sounded like a good target for a potential XXE.
I was looking for something productive to do with my time and saw that libsignal-protocol-c (hereinafter referred to as libsignal) had an open ticket from Google asking if they were interested in integrating the project with OSS-Fuzz. From poking around I saw that it was a pretty large (~30,000 LoC) C project with minimal unit tests and no fuzzing set up. And it is used by a number of different…
Eclipse Theia is a project to build an open source web native IDE that is easily extensible and customizable. It isn’t necessarily meant to be used directly by end users, but is instead the base for a lot of different projects that want to offer a web IDE. Google Cloud Shell, GitLab, and GitPod all use Theia as the basis for their online IDEs. I originally came across Theia while working on…
Over the summer I interned at Keybase and had the chance to choose a new feature that I wanted to build out. Based off of my experiences working for other company’s security teams I decided to work on building an open source SSH CA system. I realized that since Keybase already does a good job of building strong cryptography around people’s identities, it makes perfect sense to use…
Back in 2015 I started a project to research on understanding malicious behavior from open proxies on the internet. Since then, the professor I worked with and some of his graduate students have continued to work on the project and their results were just published in the Annual Computer Security Applications Conference. So if you’re curious about the final results which were greatly scaled…
Intro For the past semester I’ve been participating in MITRE’s embedded CTF competition on the Sprite team (we came in second place, but captured the most flags overall). Now that the competition has finished up, I’m going to write up a few of the attacks we came up with. Design A protected firmware for River Hawk’s bootloader consists of 5 pieces of information inside a…
As of last week, mitmproxy now has built in support for detecting cross site scripting and SQL injection vulnerabilities. To have mitmproxy automatically scan pages for XSS and SQLi vulnerabilities, simple run it with the included xss_scanner.py script like so: mitmproxy -s xss_scanner.py From there, it will run the xss.py script on every page that you visit through mitmproxy’s proxy. It…
Uber’s bug bounty program just went public, so it is time to write up some of the vulnerabilities I found in Uber. One of the more interesting ones was an XSS in archive.uber.com due to MIME sniffing. Uber hosts a mirror of pypi (using the same software as pypi) at archive.uber.com/pypi/simple/. So then the question became, is there a vulnerability here. Pypi doesn’t allow package…
business.uber.com allows for names to begin with a = which allows for injection of formulas into the downloaded CSVs. There are two main ways that this can be exploited: It allows for data exfiltration through HYPERLINKs It allows for code execution on the user’s machine provided that they trust Uber 1 can be done by setting one’s username to something of the form:…
The first vulnerability I found for Uber’s bug bounty was a reflected XSS in getrush.uber.com. It was caused by Uber not escaping the utm_campaign, utm_medium, and utm_source parameters at getrush.uber.com/business. It could be exploited by injecting </script><script>alert(0)</script> into any of those parameters. I reported this to Uber on March 22nd, it was triaged the same day, and…
StegIm is a simple program for image steganography. For example, I encoded the phrase Hello world!!! into tree.png to create encodedTree.png. When looking at the below images it is impossible to tell the difference between them despite additional data being hidden in the second one. Source is available on Github here.
KBFS is great not only for storing and signing files, but also for hosting a signed mirror of a website. By default keybase.pub is configured to look for a index.html or a index.md. So to mirror your static website in KBFS, just copy it all over into a folder in your public directory. For example, my blog and my website are both mirrored in KBFS. To set this up with Nikola (which I use to host my…
In my BC Calculus class we were talking about slope fields and Euler’s method, so I wanted to program my own slope field generator. See github.com/ddworken/SlopeFields/
By default, the KBFS will only run on linux. This is a short guide on how to setup KBFS on Linux (tested on Ubuntu 15.10 with a BTRFS root). Note that this is unsupported and takes a little bit of work to get it to work. Start by making sure you have the most recent version of Keybase. Assuming you installed from the .deb, run sudo apt-get upate then sudo apt-get install keybase.
#‘Unlimited’ Storage Google has recently made unlimited free storage available on google photos. At first glance this seems truly amazing (and ripe for abuse). The one caveat to this claim is that all photos uploaded to Google Photos are compressed with lossy compression. This means that any photos uploaded to Google Photos are automatically compressed thereby loosing some detail. At…
#The List Over the past 2 months, I’ve spent some time working on bug bounties. In the past two months, I have found vulnerabilities in the following websites: AT&T Adobe Dyn Go Daddy Western Union Symantec IBM Vistaprint Hobby King Tumblr Haiku Learning Mozilla Maret eBay iFixIt MailChimp Amazon Steam Netflix Appcelerator mail.ru So far most of these companies have responded and they have…
For a while now I’ve been wanting to make my own interface to WMATA’s API. WMATA (Washington Metropolitan Area Transit Authority) has a pretty good API that allows for you to get anything from current train locations, a path between two stations on the same line, elevator/escalator/rail incidents, even an API endpoint for stations near a location. The one thing that is lacking is an…
In the past few years, there has been a lot of press about HTTP proxies that transparently modify traffic to inject javascript for malicious purposes. There have been multiple presentations at DEFCON and blackhat about this topic and a variety of ways of exploiting it including: DDOS, credential theft, and even a distributed method of storage. Due to this, I decided to write a script to…
David Dworken 1/6/15 Error Correcting Storage of Secrets in Human Memory Abstract In the past a number of different schemes have been proposed for the storage of encryption secrets in human memory. The vast majority of these schemes rely on the idea of asking the user to memorize a passphrase, often a string of randomly generated words, and then running this passphrase though a key derivation…