MarbaSec

We just decided to do it: bringing BSides Maine to life

2026-06-06T00:00:00Z

This year's badges, courtesy of Ryan Boutot.

BSides Maine is officially in the books, and I am still trying to fully process it. After months of planning, building, coordinating, designing, and solving one problem after another, Maine's first BSides actually happened.

For a first-year conference, the response floored us. We had more than 50 talk submissions, 260 registered attendees, and a waitlist of around 100 people who wanted in but couldn't fit. The feedback has been overwhelming in the best way: people were kind, people had fun, the talks were excellent, and the hallway conversations went somewhere real. Folks who have been to BSides events all over the world told us they were surprised by the quality, the organization, and the energy of a first-year con.

Here's the part I still can't quite believe: this was the first conference I had ever helped bring into existence. Not the first I'd attended, and not the first I'd volunteered at, but the first I'd helped shepherd from a long-running "someday" into a real place where people could gather. And BSides was never ours to own. An event like this belongs to the community that shows up and gives it life. We were simply its stewards: the people willing to gather the crew, do the paperwork, open the doors, and give the idea a home in Maine.

Hackers around here had talked about doing a con in Maine for years, and it was always a someday. Eventually someday ran out, so a few of us decided to Field of Dreams it, build the space and trust that the people would come. A lot of that nerve came from the BSides down in Cambridge, Massachusetts. I went in hoping their lead would hand me a roadmap, some detailed step-by-step guide to starting a conference, and what I got instead was permission. His advice boiled down to one thing: if you want to do it, you just have to lean in and do it. So we did. I started a group chat, made a logo, and said, "Let's do this. If you BSides Maine, they will come." Then I gathered the best people I could think of, the ones I knew would care about what this could become, and we started building.

This year's theme: signal through the fog. Dirigo, the state motto, means "I lead."

First, there was paperwork

Before there was a conference, there was a nonprofit. We stood up DirigoSec for real, with real bylaws, a real bank account, real filings, and real responsibility. Signing your name to all of that is a genuinely strange feeling, because overnight you go from "person throwing an event" to "person legally and financially on the hook if the whole thing goes sideways." It turns out that building the world you want to see involves an incredible amount of paperwork.

Then came the venue, the sponsors, the speakers, the volunteers, the badges, the activities, the schedules, and the thousand tiny decisions nobody attending a conference should ever have to notice. Every answer uncovered three more questions, and every solved problem revealed another one waiting behind it. Eventually there was nothing left to do but open the doors. People came.

And they came.

Then I looked up

At one point during the event, I looked across the room and saw a cluster of people hunched over the badges. Heads together, tools out, laptops open, deep in the CTF and prying the thing apart to see how it worked. Most of them had walked in that morning not knowing a soul. The badge was just the excuse, a reason to pull up a chair next to a stranger and ask what they had figured out so far. By the time I looked over, they weren't strangers anymore.

That was the moment, and it was the whole reason. You can plan talks and order supplies. You can make schedules, sell tickets, and spend months worrying about everything that could go wrong. But you cannot manufacture the moment when a group of strangers becomes a community over a circuit board. You can only build the space, prop the doors open, and hope people fill it. They did.

The badge challenge in progress. This is the good stuff.

We built it together

I did not white-knuckle this conference into existence by myself. I had a crew, and they were incredible. Hawk ran operations and kept the whole machine moving. Ben ran speaker operations and made sure everyone stepping onto a stage had what they needed. Abhi wrangled the volunteers, which is its own kind of heroism. Ryan Boutot owned the badge and the activities, and those electronic badges gave BSides Maine its own identity from day one. Jim gave me solid, steadying advice exactly when I needed it. And Mark jumped in on the badge lift when it counted. I could not have gotten through this without them, and every one of them made the hard parts survivable and the good parts better.

The same goes for every speaker, sponsor, volunteer, and community partner who saw something that needed doing and stepped in to help. BSides Maine started with a group chat and a logo, but it became real because a community chose to build it with us.

Serious people, running a serious conference.

Why we're doing it again

Here is the belief underneath all of it: Maine deserves a hacker con that celebrates security at the practitioner level, not just the C-suite. A place for the people actually doing the work, the ones with their hands on keyboards and soldering irons, not only the people presenting quarterly slides about them. That conviction is worth a lot of lost sleep.

Practitioners on stage, telling the real stories. That's the whole point.

We put ourselves through the stress because of what the payoff actually looks like: candid conversations that go somewhere real, selfies with people who were internet strangers an hour earlier, folks huddled in corners chewing on a badge challenge, and people making new friends and finally feeling connected to others who are curious, technical, and a little obsessed with using technology in ways it was never meant to be used. That is what a conference is supposed to create.

Like a lot of organizers, I didn't get to see every talk or have every conversation I wanted. So seeing the photos, the messages, and the reactions afterward has been genuinely moving. It turns out building the world you want to see is a lot less glamorous than it sounds. It is more paperwork, more panic, and more staring at spreadsheets than anyone puts in the inspirational version. And every so often, it looks like a few strangers reverse-engineering an electronic badge in a quiet corner between talks while it rains.

So to everyone who attended, volunteered, spoke, sponsored, organized, helped, encouraged, tested badges, answered and asked questions, moved boxes, shared posts, and gave feedback: thank you. You made the day bigger than just a conference. You are the conference. The BSides Maine team builds the space and holds the doors open, and you are the ones who step through and make it real.

We'll see you next year. We'll be the ones worrying in the corner, and loving every second of it.

Thank you for helping us send the signal through the fog. ❤️

-Marbaṩ

CVEase: disclosure tracking that doesn't live in your head

2026-04-21T00:00:00Z

After yet another coordinated disclosure this year, I took an honest look at how I was actually running the process, and it was not pretty. Findings lived in a Notion database. Follow-ups sat in my calendar. Vendor contacts were buried in a random email folder. And the deadlines? Those were in my head. Something was going to slip. It was only a matter of time.

Here's the thing nobody warns you about coordinated disclosure: it takes months from start to finish. One at a time, you can wing it. Once you have more than one going, or heaven help you, more than ten, "winging it" quietly turns into "dropping things." I needed a better way to organize the chaos.

So I built CVEase.

CVEase, keeping my disclosures in order for once.

What it is

CVEase is a free, open-source desktop app for managing vulnerability disclosure from discovery all the way to the victory lap.

It's a Kanban-style board built around the actual stages of coordinated disclosure, with follow-up dates, deadlines, and stage-aware checklists, so you always know what the next move is. A few of the things it does that I was tired of doing by hand:

When it's time to reach out to a vendor, it pre-fills a disclosure email from the data you've already entered. No more writing the awkward first-contact note from scratch at 11pm.
It keeps you on track, nudging you to follow up when you need to.
When the embargo lifts, it drafts the public advisory in markdown, ready to drop straight into GitHub.
And when you want to admire your glorious bugs, your published findings live in a Hall of Fame that generates LinkedIn-ready posts for your adoring fans.

Your data stays yours

CVEase is local-first. Your findings never leave your machine to feed some SaaS vampire quietly selling your data downstream to the latest AI model. It's SQLite under the hood, with no telemetry, no account, and no cloud.

Did I mention it's free, open source, and runs on Windows, macOS, and Linux?

Grab it

I built CVEase for myself, because I was the one about to drop a disclosure. I'm sharing it in case it's useful to anyone else doing disclosure or research work and struggling to keep all the plates spinning.

It's on GitHub: github.com/marbas207/CVEase. Take it, use it, break it, and send me issues.

-Marbaṩ

Keeping DC207 afloat

2025-10-09T00:00:00Z

Jayson Street at DC207. Standing room only.

People sometimes assume that being connected to DEF CON means a local DEF CON Group gets funding, infrastructure, or some kind of ready-made event operation. That's not really how it works. DEF CON Groups have historically been affiliated with DEF CON, but they're mostly autonomous. Each group decides what it wants to do, finds its own people, and figures out how to make its events happen. That independence is great, but it also means the work and expenses stay local.

The talks

At DC207, a lot of that work goes into the content. We want talks that are actually interesting and useful, not just something to fill a spot on the schedule. Finding speakers takes time, and even after someone commits, life can get in the way. People get sick, work comes up, travel plans fall apart, and emergencies happen. We need backup speakers and alternate plans so the whole event doesn't fall apart when someone has to cancel.

Lightning talks.

Live demos. This one cloning access badges in real time.

The venue

Then there's everything involved with the venue. We have to find a space that works, make sure it's available, and deal with all the smaller details that nobody thinks about until something goes wrong. When people attend an event, they see the room, the speakers, and the finished schedule. They usually don't see the emails, negotiations, last-minute changes, and contingency plans that got us there.

What it actually costs

A typical event in Portland can cost somewhere between $750 and $1,000. Across the year, DC207's events run us roughly $7,500 to $10,000. That might not sound like a huge event budget compared to a major conference, but it's a lot for a community group to come up with year after year.

Everything became more expensive after COVID. Venue prices went up, food and supplies cost more, and all the smaller expenses started adding up faster. At the same time, corporate funding for community events didn't really return at the same level. There used to be more companies willing to throw some budget toward local events, but that support is harder to find now.

Workshops, with hardware and pizza on us. This is where the money goes.

Why we don't take sponsors

For some groups, sponsorship is the obvious answer. DC207 is intentionally not a corporate-sponsored event, though. We don't sell speaking slots to companies, and we don't feature businesses or their products because they wrote us a check. Other events use that model, and it can make the finances much easier, but it isn't what we want for DC207. We want talks to be on the schedule because the content is worth sharing, not because somebody paid for access to the audience.

Of course, choosing not to rely on corporate sponsorship doesn't make the bills disappear. We still have to pay for the venue and everything else that goes into putting on an event. It just means we have to find other ways to do it while keeping the events accessible and staying true to what we want DC207 to be.

Where the money comes from

That's one of the reasons I started pwnagotchi.com. It began as a small business that could help me cover some of the cost of running these events. It has been surprisingly successful, which has allowed me to branch out with the business and contribute a lot more funding to DC207 than I could before.

I feel very fortunate that it has worked out that way. Something I started has grown into a reliable way to put money back into the community. It helps us rent venues, organize more events, and remain independent without having to turn the schedule into a series of company pitches or paid product demos.

Why it's worth it

I'm not writing this to complain about the cost or the work. I just think people don't always realize what it takes to keep a DEF CON Group active. The affiliation connects us to a larger community, but the local organizers are still the ones finding speakers, making backup plans, booking venues, paying bills, and making sure everything comes together.

The annual hacker cruise on Casco Bay.

DC207's independence is one of the things I value most about it. I'm happy that we've found a way to support the group without changing what it is or who it's for. It takes a lot of work, and it isn't cheap, but I think the community we've built makes it worth doing.

-Marbaṩ

HatGPT: a rude offline AI that lives in a hard hat

2025-08-08T00:00:00Z

The eyebags are regulation: con survival rule of 3, only three hours of sleep.

What is this thing?

HatGPT is a sarcastic, DEF CON-savvy, offline AI chatbot that lives inside a construction hard hat and answers your questions about hacker history, badges, contests, and general con chaos. It spams the DEF CON peer-to-peer mesh over Meshtastic, and it runs entirely on my head.

No cloud. No API key. No phoning home to anybody's data center. The whole brain is a Raspberry Pi 5, a small local language model, and an unhealthy amount of poorly constructed Python. It's rude, it's reasonably fast, and every so often it's genuinely insightful. Kinda like me.

HatGPT out in the wild at Linecon. And yes, Maine does exist.

Where it came from

The idea started at my last DEF CON, which was honestly one of the best I've had. I kept seeing folks roaming the halls in hard hats, and the hard hat society had this gravity to it, people just talking to each other because of a piece of plastic on their heads.

I got to meet Mr. Bill and talk with him about the project, and the thing that stuck with me was how the hat itself was the device. Not the electronics. The hat. It was a reason to walk up to a stranger, a conversation starter, a way to get people engaged and connected.

So I wanted to build something in that spirit. But what? I love a good pun more than is probably healthy, and at some point I said, out loud, "hey, maybe there's AI in it or something?" And that was it. HatGPT. A hat you could actually talk to. Once the pun existed, I was legally obligated to build it.

Under the hard hat

The brain is IBM's Granite model, a small one at around 2.5B parameters, running locally on the Pi. Small and simple was the entire design goal: reasonably fast, fully offline, and beholden to nobody's servers.

The fun part is the reference layer. I built a RAG pipeline (retrieval-augmented generation) backed by a vector database, so before the model answers anything, it matches your question against a library of real con knowledge and front-loads the good context. That's what keeps a 2.5B model from making things up quite so enthusiastically.

And that library, I earned. I spent weekend after weekend pulling data together out of PDFs, photographs, blog posts, lore, and anything else I could get my hands on, covering all 33 years of DEF CON. It was, genuinely, my love letter to the con. And like most love letters, I sent it out over Meshtastic, by spamming the channels. Sorry. Not sorry.

The people part

Here's the thing the tech misses: the Hat worked because people talked to it, and to me. I set it up so anyone who felt like interacting could contribute knowledge back into the system by submitting their own entries. By the end I'd compiled and folded in 42 community submissions, updating the dataset each day as more came in.

Getting people onto the mesh was half the fun, so over the week I handed out several Meshtastic radios, widening the circle of folks who could talk to the Hat, and to each other.

And because it's DEF CON, people immediately tried to hack it. Loads of them. Prompt injection, jailbreak attempts, every angle you can think of to make the Hat say something it really shouldn't. Good thing I'd built injection filters to catch exactly that. Watching people probe it and hardening it against them in real time was, no exaggeration, one of the most fun parts of the whole build.

Not everyone was a fan. A gloriously unimpressed goth in the Linecon cash line looked me dead in the eye and informed me that I had personally enshittified AI. I told them, honestly, that I didn't think I could. AI is already kind of bad. This was just a fun little project to poke at it, learn some new things, and see what happened. They were unmoved.

But mostly it was conversations. So many of them. Strangers walking up because of a stupid glowing hat, and staying to talk. It was a good year.

and I won something?

In the spirit of doing new stuff, I met Jai in the AI village and she basically told me I should 'walk the runway' in the hacker runway contest.... and turns out my helmet has range. HatGPT took the Smart Wear category at the DEF CON 33 Hacker Runway. I put an AI in a hard hat as a joke and walked away with a trophy for it, which tells you everything you need to know about my decision-making and also about DEF CON. I'm delighted.

The DEF CON 33 Hacker Runway crew. That's me on the far right, under the ever-judgmental hat.

Talk nerdy to me

The DEF CON 33 run is done, so the Hat isn't holding court on the con floor anymore. But it still boots up now and then. If you ever catch it online in the Maine Mesh, here's how you talk to it:

Get on the mesh with a Meshtastic device and tune to the channel it's living on.
Send a message that starts with @hatgpt and ask your question.

You can DM it if you want privacy, or shout into the mesh for everyone to see. HatGPT doesn't judge. (That's a lie. It judges. Loudly.)

Give it a beat before you expect a reply. It's a Raspberry Pi, and it might be chewing through a queue of other people's nonsense before it gets to yours.

▶ Watch HatGPT lit up in RGB mode (video on X)

▶ Video: HatGPT running its lights in full RGB mode, over on X.

Asked for the DEF CON 26 theme, it nailed it (1983: The Counter-Future) and threw in a tinfoil-hat crack for free.

And if you don't have a Meshtastic radio yet and any of this sounds fun: come find me around Maine. I usually have a few on me, I'm happy to get you started, and if you ask nicely I'll give you the whole tour.

-Marbaṩ

How to have the most fun at DEF CON

2024-08-15T00:00:00Z

DEF CON can be a lot. Thirty-thousand-ish people, a hundred things happening at once, a map that may as well be written in another language, and a reputation for being full of people too cool to talk to you. The first time can feel less like a party and more like getting dropped into someone else's inside joke.

I've been going for years now, and there's been good times - and some times that things didn't go exactly as I had hoped. I feel like in the last few years I'd been hyper focused on being part of the con instead of enjoying it, and I was thinking at the end of DEF CON 31, maybe I wouldn't be back. However, my huband convinced me that I should just go and have fun... so I did that, focusing on exploring new things and not getting wrapped up in projects, and I had a great time. So here's my tips for making the most of DEFCON.

Go make something

If you do one thing, go to the Maker Village or the Hardware Hacking Village (or any village that hands you tools) and build a badge add-on. An SAO, or Simple Add-On, is a little PCB that plugs into a conference badge, and half of them are gloriously stupid, which is exactly what makes them fun.

At DEF CON 32 I sat down and soldered one badge after another, and had a genuinely great time doing it. There is no better icebreaker in the world than two people fumbling with a soldering iron next to each other. Nobody at that table cares how good you are. They care that you showed up and grabbed the iron.

I put together a couple of badges myself. The dinosaur-vs-cowboys badge a teammate handed me while we were waiting in line ("linecon") was especially fun.

Talk to the person next to you

DEF CON runs on the fact that everyone there built something weird and secretly wants you to ask about it. That intimidating-looking person in line? They'll light up if you ask what their badge does. Somebody had Doom running on their hard hat's little display, because of course they did. That's just how this place works.

Someone built a hard hat that plays Doom on recycled hospital hardware... what?

With that said, the scary version of DEF CON, the one with some egos and gatekeeping, is real, but it's a small and very loud minority. The rest of it is just nerds who are thrilled you're curious. So be curious out loud, make a friend, get involved in whatever pulls you in.

Try a CTF, just not the whole con

I played in a few CTFs, and I genuinely enjoyed working on the Chakra badge, which was basically a piece of art disguised as a puzzle. I was the third person to solve it, which was good enough for third place and an actual trophy that now sits proudly on my shelf. Third place, sure, but it felt like a win, especially since I got there without burning my entire con on it.

Hang with a tribe... or find a new one.

DEF CON has sub-communities living inside the main event, so go find yours. I went to the Queercon meetups and hung out with some genuinely cool people.

The unglamorous survival stuff

The 3-2-1 rule: at least 3 hours of sleep, 2 meals, and 1 shower a day. Adjust upward. You will want to adjust upward... especially if you're almost in your 40s.. like me.
Water, constantly. It's a desert, inside a casino, inside a desert.
Mask up in the crowds. "Con crud" is a tradition I do not endorse. (Ask me how DEF CON 31 ended. Actually, don't.)
You don't have to do everything. You will miss things. Everyone misses things. Missing things is fine. There's always next year.

Just be open to whatever comes your way...

The most fun I've ever had at DEF CON has almost never been the thing I planned. It's been the side quest, the random village, the stranger who turned into a friend over a soldering table. Show up, be a beginner at something, and talk to people. I promise you'll have fun.

And if the con ever feels like a room you don't belong in: it isn't. Come sit down, grab an iron. I'll save you a seat.

-Marbaṩ

DC207's response to SecureMaine: allyship and cyber inclusivity

2023-09-26T00:00:00Z

In our seas, DC207 shines against those exploiting cybersecurity communities and elevating hate. Our commitment to inclusivity is unwavering.

In the vast expanse of the digital world, akin to the unpredictable seas, there are beacons of light that guide ships to safety. For the cybersecurity community of Maine, DC207 has been one of those guiding beacons. Our mission has been about ensuring education and networking opportunities in the world of cybersecurity exist, and we have worked tirelessly to foster an environment of inclusivity and respect.

Recently, questions have emerged regarding DC207's involvement with SecureMaine. As the largest and most active information security networking group in the state, we have naturally been asked questions on whether we'd be there and how we'd be participating. To set the record straight: while we were approached for sponsorship and asked for advice on bringing DC207-like events to the conference without our involvement, we are not involved because we didn't pay to sponsor the event. Given the information available to us, our alignment has always been and will always be organized with values of inclusivity, especially in the face of repulsive hate speech and divisive religious organizations masquerading as "community centers", like The Point, which is the focus of why we cannot support this event. The organizers of SecureMaine have selected a religious organization known as 'The Point' as their partner in running this conference. The Point is a church with deep-seated beliefs that equate members of the LGBTQIA+ community to zoophiles and pedophiles. Such beliefs, rooted in discrimination and ignorance, are not just baseless but deeply dehumanizing and offensive.

While they realize publishing this kind of derogatory material is harmful to turning their church into a thriving enterprise, someone ought to introduce them to the concept of OSINT.

From The Point's own leadership guide (page 88), preserved on the Wayback Machine.

We could only bring ourselves to watch one of these videos where hate speech is employed against the trans, gay, and lesbian communities, and there are 400 more where that came from.

The Point's leader, in a sermon posted to their own YouTube channel.

We want to be unequivocally clear: DC207 does not, and will not, endorse, sponsor, or maintain any relationship or partnership with entities that propagate such harmful beliefs. Our priority is the community. A community that thrives on diversity, mutual respect, and shared knowledge. A community that values each individual for their skills, knowledge, and contributions, and yes, their identities. Our diversity is our strength.

When bringing these concerns to SecureMaine, we noted they were quick to update their website with the following new statement:

SecureMaine is taking place in a publicly-available rental venue. The venue owner is a church. SecureMaine is working closely with the venue management to make sure that its other use as a church will not be expressed substantially within the space of the SecureMaine event. This has included the removal or obscuring of substantial non-secular material.

DC207's position is that claiming the ownership of the venue belonging to the church is misleading and disingenuous. The venue is a church, and efforts are being made to mask the public appearance of what truly is 'the point' of The Point. This is a great example of performative allyship, where an organization goes to lengths to literally obscure the hateful nature of what is being supported, saying they don't support it while forking over thousands of dollars in cash to groups marginalizing minorities. If SecureMaine were an ally, they would denounce this, but they don't, they don't want to ruffle feathers. DC207, however, does not mind ruffling the feathers of people who perpetuate an oppressive society. SecureMaine continues:

Government-allied and informational nonprofit institutions working with a wide variety of religious and community institutions is a common practice, in order to access regional facilities and populations, scaled appropriately to the event organizer's nonprofit resources. Renting this, or any, publicly available venue does not mean SecureMaine supports any social, political, religious, or workforce practices of the owner / operator of the venue. SecureMaine's Code of Conduct clearly states our own position.

SecureMaine is supporting the church, though. The church can continue to spread hate speech through the support of dollars. When you give money to SecureMaine, you're indirectly funding hate speech like the ones spread in the rooms the conference will be held in. Unfortunately, SecureMaine's code of conduct is boilerplate language put up hurriedly in an effort to get ahead of this controversy. If the organization had true core values, event venues like this would not have been considered and secured for this conference in the first place.

Every individual has autonomy over their financial and moral choices. However, it's vital to recognize the broader implications of these choices. Supporting events or venues that platform hate and discrimination directly perpetuates harmful ideologies. It's not just about where you put your money but also about what values and ideologies money amplifies.

At its heart, DC207 is a community-driven, non-commercial entity. We don't need to go and obscure ourselves for public viewing or make half-hearted excuses for how we fund hate speech, because we don't do that. Our mission is centered around fostering cybersecurity knowledge, building meaningful connections, and creating an inclusive and respectful environment. It's where we started, where we're going, and where we'll always be. Our journey does not cross with events that perpetuate hate.

At DC207, you can bring your whole self. We prioritize genuine inclusivity and respect without exceptions. We hope you will join us in taking a clear stand against any form of discrimination, ensuring that cybersecurity remains a field of shared knowledge, unity, and mutual respect.

-Marbaṩ

DEF CON 31: The Lonely Hard Drive, and a very large Betty Pagefile

2023-08-18T00:00:00Z

DEF CON 31 is a bit of a blur. Mostly a good one.

I spent most of it helping run The Lonely Hard Drive, which was one of the most fun and most exhausting things I’ve ever packed into a single con.

DC30 to DC31

The Lonely Hard Drive is a DEF CON contest built on an extremely simple premise: hand people free hard drives and see what happens.

For DEF CON 31, we handed out literal hard drives. Real ones. Each one had a CTF loaded onto it.

You take a drive, plug it in (you monster), and suddenly you’re falling down a rabbit hole of puzzles and challenges, finding flags and climbing the leaderboard toward prizes.

The idea started the year before with FragileDuck from the DC207 crew. For DC31, he turned it into an official contest.

It rewards the one instinct every security person spends their entire career trying to unlearn:

Ooh, a free drive. Let’s see what’s on it.

Hard Drives Are... Hard

I originally got involved through DC207 to help with the money side of the project. We hosted the website and landing pages, and we paid for the drives and cables.

Turns out buying an absurd mountain of hard drives from a manufacturer in China is a whole project by itself.

First you order the drives. Then you arrange for custom labels. Then you clone the CTF onto every single one of them.

At that quantity, cloning the drives is not an afternoon project. It’s a week or two of drives running around the clock.

Then the team decided to heat-seal all of them in anti-static bags. That meant a bunch of us sitting around, packaging drives by hand like the world’s nerdiest holiday assembly line.

It was tedious. It was also genuinely kind of wonderful.

That unglamorous backstage work is what makes the shiny, fun part possible. I’d take an evening sealing drives with good people over almost any panel.

Chips Ahoy!

At some point during the con, I found $200 on the casino floor. So, obviously, I spent it on putting another chip inserted into my hand.

I’d been wanting another implant, and finding $200 in Vegas seemed like the universe giving me a very specific kind of grant.

The chip lights up when it gets near an energy field, which is extremely cool. It does work. I just have to wait for the swelling to go down before I can properly enjoy the tiny light someone injected into me through what was basically a straw.

So now I have two implants.

I found $200 on a casino floor and left Vegas with more hardware in my body than I arrived with.

Chips Ahoy!

The Parting Gifts

Also, I got COVID.

DEF CON sent me home with the traditional souvenir, and it was its own special flavor of miserable. Ask me how the trip ended. Actually, don’t.

The honest version is that COVID wasn’t the only rough part. Any project run by a passionate pile of volunteers eventually reaches a point where people stop agreeing. A lot of things that had never quite been settled got settled all at once.

After DC31, I decided not to come back for the next version of the contest.

There’s no big drama to air and no hard feelings. Volunteer projects get complicated, especially when everyone cares a lot. Sometimes you can be proud of something, love the time you spent doing it, and still know when you’re done.

I’m proud of what we built. I’m glad I was there. And I’m glad I knew when to step away.

-Marbaṩ

How to set up your very own AND!XOR Chomper hacker smartwatch

2022-09-04T00:00:00Z

Every summer in Las Vegas, hackers from all over the world come to the strip to hack the planet at the largest hacking conference, DEFCON. The AND!XOR group has been building wearable technology badges in tandem with the conference and selling/giving them away at the conference since 2016. DEFCON 30 was no exception, their awesome badge named "Chomper" was in the works for roughly two years before its release last month. The badge was orginally slated for DEFCON 29, but the global supply chain issues which were impacting almost everything that year elongated the timeline. In short, their plan was to buy consumer hardware, hack it, build drivers from the ground up for an embedded version of Python, load it with hacking tools, and a fun text-based adventure. Amazing.

Check out the AND!XOR DC30 Trailer to see their craftmanship

If you didn't make it to DEFCON this year, or if you were so busy (guilty here!) that you didn't have time to check out the AND!XOR "snacky" CFT/vending machine, you're in luck. AND!XOR released the source code and I'm going to show you exactly how to configure your own Chomper. It's actually pretty easy. :-)

First things first, you need to buy the watch. It's a LILYGO T-Watch-2020 V3. It's basically an ESP32 with a screen, microphone, Bluetooth, Wi-Fi device shoved into a smartwatch formfactor. If you'd like to support this blog, you can buy it from amazon here: https://amzn.to/3KNDjeh.

Who exactly is this Lily? Why does she go?

So, get to ordering it! Don't worry, we'll be here when you get back. :-)

Alright, got the watch? Awesome. :-) Now you'll need to set up your flashing environment. Now I suggest that you set this up using your favorite Linux environment, while I'm sure you could set this up in Windows I just think it'd be a lot of work/heartache. For me I'm going to run Ubuntu in VMWare Workstation with a fresh install of Ubuntu.

NOTE:

If you're just finding it a little too challenging to set up this environment - I understand, not everyone is familiar with Linux. At the very end of this post, we exported the virtual machine used to do the flashing so you can just download and flash - but don't forget to set up the Wi-Fi access point "Matt Damon" explained later in this post.

Let's start by installing the basics, git, python3, etc.

sudo apt-get update
sudo apt-get install python3 python3-pip git

Once that's installed, we'll grab the AND!XOR badge firmware/flashing stuff from their github using the following command:

git clone https://github.com/ANDnXOR/ANDnXOR_DC30_Badge
cd ANDnXOR_DC30_Badge

Following the guidance from the software repository, we'll need to just do some additional configuration steps to set up user accounts, set up permissions, and install some more packages. Let's get to it.

Setup the user's permissions so we can flash the watch without sudo

sudo adduser $USER dialout

The documentation says that we need to break the serial device permissions as well. Not sure why - but let's do it. :-)

sudo apt remove modemmanager

Now we're going to need to install a whole bunch of packages, this will take a minute.

apt install build-essential python3-virtualenv python3-freetype ffmpeg picocom

Actually - since we have a few minutes while that's running, we're going to need to set up a WiFi access point for our watch, so maybe do that now. The watch downloads most of the assets right from the internet, mostly because it would be horribly slow over a serial connection. The WiFi access point must be called "Matt Damon", and the password must be "WEmustSAVEhim".

What will the neighbors think?

AND!XOR really likes Matt Damon if you didn't already know. :-) Hopefully that took up some time and our build environment is done and ready to go.

Now we'll need to add an alias for our python3 install.

sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 1

Now we'll need to set up our python packages for this whole thing to work with putting the python stuff on the watch.

pip3 install adafruit-ampy mpremote cmake

You might run into the following error (which we'll want to fix) when you install these packages.

Basically, we need to make sure we can access the new python packages from the command line. To do this, edit your /etc/environments file. Let's do that now - I'm going to use vi, but you do you when it comes to text editing.

sudo vi /etc/environments

We'll need to add the path which was in the error message. Once that's in there, save the file.

Now we'll need to just have our session pull those attributes, the best way to do this is just to log out, then log back in. Once you're back in just check to see if the new path is in your PATH variable with this:

echo $PATH

Cool! Let's go back into our AND!XOR file where all the code is.

cd ANDnXOR_DC30_Badge/

We now need to grab the ESP IDF, now in the documentation they say you need the 4.2 version, so we'll clone that repository, and then change into that directory... this will take a little while, lots to clone here. :-)

git clone -b v4.2 --recursive https://github.com/espressif/esp-idf.git
cd esp-idf

Once you're there, time to install the xtensa build tools using the esp-idf install script.

./install.sh

Now, it's not mentioned in the github readme, but you'll also need to do this export step which is shown in the terminal after installing the xtensa tools. Do that now.

. ./export.sh

Now, we should be able to rock and roll with this thing. We'll need to now attach our watch and route the USB connection to our VM, and then find out which serial device it's named. To do this, just list the directories in /dev and look for tty device named ttyACM - in this case for me, it's ttyACM0

Let's try flashing the device. If you skipped setting up that Wi-Fi access point, do that now! Back in our provision script location inside /ANDnXOR_DC30_Badge/provision, we'll want to run the provisioning script with that tty device as an argument.

./provision.sh /dev/ttyACM0

If all is good, you should start seeing some mpy files being flashed over (slowly - according to the script).

This will take a bit of time. The script is going to instruct the watch to connect to your Matt Damon Wi-Fi, and will start downloading files from "mattdamon.app". :-)

Once it's done, it'll be ready to disconnect - however, check the watch screen, it should be red, yellow, or green which is indicating if the device is properly charged. As heard in the microfab podcast (link below), at the flash party for these devices, they would leave them plugged in until they turned green to indicate the watch was charged.

Yay!! It's ready.

Now, go forth and conquer the world with your new hacker smartwatch! Enjoy the lolz, puzzles, 31337 timepiece, and hard work from AND!XOR's very talented and creative team.

Till next time.

-Marbaṩ

References & Resources

Podcast on how this badge was created: MEP EP#342: Hackery Experts - MacroFab

AND!XOR's website: HOME | andnxor

AND!XOR Software/Firmware for DC30 Badge: ANDnXOR/ANDnXOR_DC30_Badge: Chomper! (github.com)

Preconfigured VM: https://www.dropbox.com/s/erp993xm33kn1d8/ChomperFlashVM.zip?dl=0

Student Loan Scams - Info & Informational Resources

2022-09-02T00:00:00Z

Hey all,

Recent reports of student loan scammers targeting borrowers are a harsh reminder of the lengths some people will go to to take advantage of others. The scammers typically contact victims by phone or email, promising them early access to the expanded relief program announced by the Biden administration. The scammers may say they're with your bank, loan servicer, the department of education, or even a 'loan forgiveness broker'.

Once they've hooked you, they might promise immediate relief, refunds, and prey on your emotions by requiring you to act quickly. The scammers then ask for personal information, such as the victim’s Social Security number or bank account information, which they use to commit identity theft or fraud.

The best way to avoid becoming a victim of this scam is to know what the one-time forgiveness program offers and how to access it. These details have not been announced but keep a close eye on the student aid website, which publishes updates as they develop. You can check that resource out here:

https://studentaid.gov/debt-relief-announcement/

You should NEVER receive an unsolicited phone call from a governmental agency asking you for personal information. If you are contacted by someone claiming to be from the Department of Education or another government agency offering assistance with your student loans, be sure to verify their identity before providing any personal information. You can call the Department of Education’s Federal Student Aid Information Center at 1-800-4-FEDAID (1-800-433-3243).

If you think you may have been the victim of a student loan scam, contact the Federal Trade Commission and the Department of Education immediately. You can also file a complaint with the Consumer Financial Protection Bureau.

In addition, be sure to take steps to protect your identity and financial information, such as monitoring your credit report for changes or unusual activity and signing up for a credit monitoring service. An excellent government resource will walk you through the steps of protecting your information from identity theft abuse. Check it out here:

https://www.identitytheft.gov/

To help spread the word, we created a couple of infographic resources which we're attaching to this post. One is in a poster-friendly format, the other is in a social media-style gallery. Feel free to share these resources as you see fit.

Stay safe out there.

-Marbaṩ

Avoid Student Loan Forgiveness Scams - Social Media Formatted Image Gallery (ZIP • 2218KB)

Example of social media gallery

Student Loan Forgiveness - Video (MP4)

Video format of the social media post

Avoid Student Loan Forgiveness Scams - Poster (PDF • 376KB)

Example of poster

Beckman Coulter's Remisol Advance - Security Advisory MARBAS-22-001

2022-08-30T00:00:00Z

Affected Product: Beckman Coulter Remisol Advance v2.0.12.1 and below

Vulnerability Type: Insecure Permissions & Privilege Escalation

Root Cause: The permissions set by Remisol Advance V2.0.12.1 and below on install for six running services allows for non-privileged users to overwrite and/or manipulate executables and libraries which run as the elevated SYSTEM user on Windows.

Affected Components and corresponding CVEs:

CVE-2022-26235: Normand Message Server
CVE-2022-26236: Normand Remisol Advance Launcher
CVE-2022-26237: Normand ViewerService
CVE-2022-26238: Normand Service Manager
CVE-2022-26239: Normand License Manager
CVE-2022-26240: Normand Message Buffer

It's no secret that healthcare technology offers a buffet of information to would-be attackers. It's amazing how many systems, vendors, and technologies you've never even heard of are burdened with rich sets of information which these unheard entities are then entrusted to. On top of all of this, there's a consumer expectation that these systems are protected or at least given attention when they have serious problems.

Expectations are funny things.

This disclosure specifically deals with the software product Beckman sells as LIMS middleware Remisol Advance. Remisol is supposedly doing the following according to Beckman's marketing materials:

REMISOL Advance is a leading middleware solution for today’s clinical laboratories, bridging laboratory information systems (LIS) and instrumentation. It helps drive improved operational efficiency within and across the laboratory network through process automation and standardization. The enhanced capabilities of dashboards provide real-time insights into operations and fast access to key metrics for more informed decision-making.

We've opened the following CVEs for this disclosure which lead to privilege escalation:

The vulnerabilities are simple enough Windows vulnerabilities related to incorrect permissions on installed services. Remisol Advance runs these six services with the SYSTEM account when installed. Also, when installed, the files where the services are initialized are something all users can write to. A user could kill the process which is running the service, install malware, and restart the service to take advantage of the SYSTEM account.

The fix is simple: correct the permissions so that every user cannot overwrite the services and therefore make themselves a super admin on the local Windows host.

Movin' on up thanks to Beckman Coulter!

The biggest concern is that this software is installed on Windows workstations which are often placed in easy to access areas of the hospital. Think lab stations where a phlebotomist might take a blood sample, also - in most chemistry, hematology and microbiology labs. Labs are usually running around the clock processing samples and workstations are usually logged in and ready to take data from users. Don't believe me? Do a google search for an example - think something like this.

Or this...

I think after googling these I'm on some list now....

This is commonplace, and as such these workstations are typically locked down with controls that account for malicious users. These controls can be circumvented when an attacker takes advantage of these vulnerabilities. As stated, the services allow for the overwriting of libraries and executables which lead to privesc. Per the CVE disclosures:

The default privileges for the running service *Service name here, because there's six* in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data.

This sensitive data is PHI.... and administrative control over the system and future inputs. The combination between easy physical access of systems and really dumb (and very preventable) vulnerabilities is a perfect storm of several abuse cases.

Although, we're talking about physical access though. If you're lucky enough to be network adjacent, you can look forward to default passwords configured for the highest levels of access enabled by default.

Not disclosed as a CVE, we found documents while attempting to authenticate to the software directly using usernames and passwords. Using simple Google searches, we found published materials on Beckman's website 8 years ago which gives users super admin rights into the software itself. From what was observed - the vendor likely installs this middleware and then leaves it with defaults intact.

8 years old is a great age to be when you're a human - not so much if you're a password.

What's interesting about these security findings is that they're just so elementary that they should have been caught by basic vulnerability scanners and/or penetration testing if Beckman had even decided to do that sort of thing on their own products. So, if you're out there Beckman - we have some advice for you:

Don't install customers with your software using published default passwords which give super admin privileges. Advise your current customer to change their passwords because this is likely everywhere.
Don't use SYSTEM to run services which you then grant everyone the ability to modify the files - which in turn gives them the ability to change said files.
Do basic security work in assessing your systems in the future. You're a five-billion-dollar company. Shape up.

If you're a customer of Beckman Coulter, my apologies but you'll need to do the following if they haven't helped you.

Change default passwords on any Remisol Advance or Beckman product with the knowledge that they publish and use default passwords for customer products.
Monitor systems using the Remisol Advance middleware for unusual behavior, especially related to their services which apparently need to run with full administrator privileges. Possibly lock down those folders if you have a decent team who can harden and then validate access to those files.
Ask Beckman to be better with their security and ask specific questions about what they're doing to improve.

Thanks for checking out the blog - till next time. :-)

-Marbaṩ

9/12/22 Edit: Added one more service - originally publishing five when there were six in total. Also cleaned up content so it's easier for MITRE to consume.

Bypass .NET Request Validation with MSSQL

2022-04-06T00:00:00Z

So - once in awhile I see applications with this specific flaw and I find myself just trying to jog my memory about this faint thing I remembered in an application. I figured sometimes to retain this information you just need to get it out of your head and into another place - like a blog.

For this blog post, I wanted to share just a simple bit of information I've needed from time to time for bypassing character restrictions on .NET applications using web forms. So, the long and short of it is that there's something called request validation in .NET applications, and in older versions of .NET or let's just say - more homebrewed/homemade kinds of .NET applications this is usually implemented in a lacking way - especially if the application is using MSSQL.

Homemade things have their charm and place, but maybe not so much for enterprise software which contains highly sensitive PII... just saying.

With that being said even though this is referencing older applications - I saw this kind of broken request validation very recently on a new application which had some fancy rebranded functionality on the surface - but was still an old .NET application to its core doing dumb stuff in the backend database.

Ok fine, so how do you beat form level request validation performed by .NET? Typically, by just using different unicode characters which will be translated by MSSQL and stored in a database as something different. I sort of imagine the servers having this kind of conversation among themselves.

Interconnected systems are always so positive and upbeat.

Got it? Cool, let's dig into the specifics. Let's say you save the following text to a form with this validation turned on:

<txt1>

More than likely what you'll get is this:

I stole this screenshot from: Request Validation with ASP.NET 4.5 : A deep dive | Code Wala, didn't want to put my own here.

Ok, neat. So we're screwed right? Not yet. You see there are different kinds of opening and closing brackets which will bypass field validation but will get translated. A perfect example of that is something like this unicode character:

＜txt1 ＞

So they look the same, but they're not the same character. If we go to our trusty Unicode lookup tool (literally unicodelookup.com) you can see we have char 1, the less-than sign, and then char 2, the fullwidth less-than sign.

The first one gets blocked, the second one doesn't, gets written to the database and then MSSQL converts char 2 into char 1 through a process (which I believe is related to collation - not 100% sure on that one). How nice of it.

So this doesn't work everywhere... but - it works a whole lot and instead of hunting for this info every time I need it I figured I'd write myself a little something on my blog so I remember for next time.

Maybe you'll find it helpful too.

-Marbaṩ

The IT Industry Needs a Toxic Masculinity Intervention

2022-04-02T00:00:00Z

I spend a great deal of time talking to people... it's one of the things I love the most about my line of work. I speak with people, get to know them, learn about them, and teach others about security and technology. But, while I get a lot out of this, there's one group of people I find incredibly draining to talk to: my corporate IT department.

Just yesterday, I found myself being responded to in all-caps chat from a senior leader of that department when trying to ask questions about process. "HOW CAN I BE CLEARER?!" was just one of the nice things he said while accusing me of trying to usurp him, subvert his authority, and so on. He was there to remind me that there was a pecking order in so many (aggressive) words. Hideous.

Same energy.

I respectfully declined to meet him at his level or attend his meetings where he could continue his abuse. Of course, this isn't the first time this group had exhibited this kind of toxic behavior, and I doubt it will be the last. Here's the shake: I could not shed the feeling of negativity about that day, and it followed me around through this weekend where I decided to write about it.

As a gay man with many years of experience in this industry, I instantly recognized this experience as one of toxic masculine behavior manifesting itself in the form of bullying. I've seen this throughout my career and increasingly so in roles of seniority. Assertive males in the workplace are beautifully summarized In Holly Althof's article detailing how Toxic Masculinity kills workplace culture published for SHRM, where she wrote:

"Toxic masculinity involves an ultra-competitive, dog-eat-dog work style that supports a patriarchal system designed to keep men on top. It encourages the mindset that outspoken men are assertive, while outspoken women are aggressive. Toxic masculinity is on display when men interrupt or talk over [people], take an inflexible attitude, and navigate the workplace like a battle zone to be conquered."

I'd argue there's a cultural epidemic in the IT industry, hurting all of us. This epidemic has manifested as a toxic masculinity problem. We need to tackle it head-on to create inclusive and diverse workplace cultures where people can productively collaborate.

A brief introduction to toxic masculinity

Yeah bro!

So, if you're not familiar, "Toxic Masculinity" is an umbrella term that encapsulates three related yet distinct concepts. The first refers to socially constructed norms and expectations of what it means to be a man. The second refers to culturally associated behaviors and practices that enforce these expectations. The third refers to how men are socialized into harmful versions of their gender. Toxic masculinity, in other words, describes masculine traits which are damaging to people regardless of gender. When we use terms like toxic or masculine interchangeably, we can perpetuate dangerous ideas about how all men act or behave, thus disregarding individuality and diverse experiences.

Toxic tech is burning out a burned-out workforce

It's not a stretch to conclude that technology workers are in high demand. Axios reporter Margaret McGill wrote last year that "Tech workers were in high demand pre-pandemic, and the COVID era's rapid moves to digital further intensified that need." 2021 alone saw around 1,200,000 openings for technology workers. Retention of skilled technology workers is crucial to the success of projects, business operations, and a competitive edge.

So it's not surprising that companies are willing to tolerate toxic cultures to retain hard-to-find talent. In 2017 the Kapor Center published their first-of-a-kind study on tech workers in which they surveyed 2,000 technology workers who left their jobs. Their studies found that a company culture like this created a sieve for underrepresented cultures. One person of color commented in the survey:

I was offended by the liberal use of stereotypes and the insistence on making a 'welcoming culture' that truly focused on only improving work life for a single demographic.

The study also found that these male-dominated cultures in tech resulted in 78% of the respondents were experiencing mistreatment. LGBTQ employees were the most likely to be bullied and experience public humiliation while at work. The study concluded that this toxic culture costs the industry 16 billion (with a B people!) dollars annually, even with conservative estimates.

Burning money like they're a supervillain in a fictional universe...

While retention of talent is a problem, so is developing promising talent. Burning out people means you lose not only some fantastic engineers but also everything they were capable of. The mental health impact alone could cause massive damage on an individual level and will most certainly drive valuable talent away from your company if it isn't dealt with. Honestly, couldn't we do better?

A Call to Action

If you've ever worked in a toxic workplace environment that tolerates and allows bullies and machoism, you know how soul-crushing it can be. Your work suffers, and your quality of life erodes. When leadership enables and fosters the culture by retaining toxic employees, it unnecessarily strains employees who are already stretched too thin by unreasonable workloads and demanding deadlines.

Let me be clear about my take on this: If any organization is actually serious and committed to overcoming obstacles like racism, inequality, and social justice, they need to develop a zero-tolerance policy for bullies and this kind of toxic culture, no matter how. Organizations must make it clear to the workforce that business, as usual, is no longer acceptable. Enable them to understand that if they witness or become targets of abuse, they will have support systems, and remedies, available to them. Everyone will need to be on board with this, and we'll need to confront this cultural problem together.

What you can do

If you're currently being bullied, harassed, or abused in your work life, then there are some basic steps you can (and should) take to protect yourself.

1. Learn how to identify toxic traits

Sometimes toxic people don't see themselves as bullies. They see their actions as playful or feel entitled to dominate others. Of course, whether or not a bullying situation is mainly subjective, but if someone feels privileged to be mean to you and doesn't seem motivated by anything other than power, you may need to take note.

2. Try to disengage

Like my conversation I mentioned in my open paragraph - the best thing to do here is to disengage. Refuse to submit to whims and pressure from the harassers. Giving them power over you provides them what they want. Refuse to do so.

3. Document the abusive behavior

Human resources will thank you later if you need to establish that you're being harassed. Document this at length. Save e-mails, copy chats, and abusive IM conversations. Establish that there's a pattern, and as you do, document how it is effecting people like you.

4. Talk to peers about how you feel

You're not alone, and your peers probably feel similar if they've had to deal with abusive coworkers. Talk to your peers, share how you think, and develop unified coping strategies that defuse these people.

5. Recognize your own shortcomings

Toxic masculinity much like toxic sludge has a way of getting in everything and rosining people once it's been spilled. Recognize and understand where you can better yourself and ask yourself if you're adopting the better parts of the company culture or the worst. Cheesy but true, change starts with you.

6. Keep your resume up to date

Life is far too short of putting up with prolonged periods of abuse. If you've tried to help improve company culture through self-advocation and don't have support from peers, or even worse, from HR, you need to remember something. In tech, there are a lot of opportunities. As previously outlined, 1,200,000 open jobs are waiting for you - and some of them are at companies with progressive cultures which might better align with your values.

So, in conclusion...

I really need this sticker for my laptop.

Maybe it might be silly or a bit on the nose to insist on smashing the patriarchy to solve this problem. But if you're reading this and feel alone, stressed, or even bullied... take heart, take a breath, and remember to be kind to yourself. You're not alone. We can change this, but we need to hold the line and change the situation. Without action nothing will change.

We got this.

-Marbaṩ

References

How Toxic Masculinity Is Ruining Your Workplace Culture, by Holly Althof: How Toxic Masculinity Is Ruining Your Workplace Culture (shrm.org)
Tech feels labor market crunch, by Margaret Harding McGill: Tech feels labor market crunch (axios.com)
Kapor Center Report Leavers: KAPOR_Tech-Leavers-17-0428.pdf (kaporcenter.org)

CVE-2021-22521 - The ZEN of Privilege Escalation

2021-07-25T00:00:00Z

DISCLAIMER: The content published here is the opinion of the person writing this, and that person alone.

Way back in February I came across a vulnerability in a Novell product (now Microfocus) called ZENworks. Generally, it's a really simple vulnerability and something I think a majority of security folks could find with a tiny bit of effort. In a nutshell, it's a privilege escalation which could allow an attacker to gain system level permissions on an impacted host through, essentially unquoted service path issue.

First, if you don't know what an unquoted service path is, let's fill you in on that. When a Windows service is created, an executable path is always provided. Sometimes these paths can contains spaces, and if these paths are called by Windows with no quotes, it leads to a vulnerability known as an 'Unquoted Service Path'. This can allow the attacker to assume the role of a service. This works because when Windows creates new processes it will traverse the filesystem in a way which will automatically append an executable extension if a space is found in the path. So for example, if you had a program in C:\Ice Cream\Social Security Numbers\myservice.exe, and a service was called to open that path without quotes, Windows would try the following:

First: It would attempt to open C:\Ice.exe
Second: It would attempt to open C:\Ice Cream\Social.exe
Third: It would attempt to open C:\Ice Cream\Social Security Numbers\myservice.exe

If you as a user have the ability to write content in the root of C:\, or in the C:\Ice Cream folder, you could add an executable which would subvert the execution of your service.

In our case, it wasn't the specific service that was vulnerable - it was the child processes in question here. Thinking back to our example, let's say our service was correctly called - but that service creates additional threads which Windows has to search for. Those threads are executed with the same permissions of the parent process. So it's important that those additional processes also must be called with quotations, or the child processes could be hijacked in the same way.

Sensibly, Microfocus was alerted and a critical system issue was opened in their ticketing system, stating that they thought it was serious. Here's what they said:

The organization I work for in my day job received a patch relatively quickly and Microfocus decided to leave other customers uninformed and without patches until the 21st of July, 2021. I've been keeping my eyes out for a vulnerability disclosure since there's been mostly radio silence from the vendor on if customers would be informed. I really wasn't planning on writing anything about this issue until my google alert on this product and came across the following forum post on their website.

I said to myself... cool, people got notified and are going to patch, great. It sucks that you need to specifically ask for a patch... but ok. What was really special is the what ZENworks support wrote in response to the question about the vulnerability disclosure.

****Wow.

A few things to note, if you please, Microfocus support.

If you in fact, knew all about it, you would be slightly more informed.
Windows doesn't call 911 in this kind of event (or ever actually). In the proof of concept we sent to engineers, we gave your company instructions which do in fact create a noticeable impact which would alert users. The bad guys your company will attract will not announce themselves like this if they aim to exploit your software.
Tools did not uncover this exploit, a manual review of the security of your software did, something I'd suggest investing in.
If my day job org wasn't concerned, why'd they rush to patch? Maybe it had something to do with all of the supply chain attacks where management software (hello, Kaseya anyone?) are targeted by state actors and organized crime syndicates.
All of this could have been known and your support agents could have been properly educated if you had bothered to reach out to and talk to the people who reported it.

End of day, the cherry on top of all of this for me is that this product and general platform is often used in organizations all over the world to manage security patches.

This likely means it's installed and distributed to EVERY COMPUTER on an impacted network to help mitigate security problems. Why in the world would Microfocus advise customers to not patch the product they sell to manage the installation and distribution of security patches?

But yeah, don't install it. Windows will call 911. Great advice.

Microfocus KB7025205: Privileged Escalation Vulnerability (CVE-2021-22521) (microfocus.com)
Registered CVE: CVE - CVE-2021-22521 (mitre.org)
How to exploit this kind of vulnerability: Windows Privilege Escalation - Exploiting Unquoted Service Path Vulnerability (exploitblizzard.com)

-Marbaṩ

CVE-2021-32077 - Fun With Social Security Numbers

2021-05-06T00:00:00Z

In my day job I get a lot of time to spend with various software solutions which are meant to solve healthcare related problems with technology. It's fun, and it can be really surprising on how some software was designed and is continued to be used to accomplish daily tasks.

Today, I'll be writing about CVE-2021-32077. It's a vulnerability I discovered while reviewing the security configuration of a credentialing website. It's a really simple vulnerability and I don't think I'm breaking any new security research ground here. In healthcare, when employers of nurses, doctors, and other various healthcare workers need to have their credentials verified (ie, if they're licensed, what did they do, did they work for a hospital in the past, etc), they often turn to automated systems which can make this easy. One such piece of software is MSOW Solutions. This software is provided by VerityStream, or as they like to refer to themselves as 'your source of truth'.

MSOW consists of a few components, the one which drew my initial attention was the PSV or Primary Source Verification search. This module had the ability to query users by PII information such as date of birth and social security serial number. This feature is meant to be used by anyone on the internet who is looking to verify the credentials of a provider.

This internet facing component of MSOW's software inadvertently allows malicious users to query all employees in the company's database by their last name. Once obtained, a malicious user can target the discovery of the social security numbers by guessing possible numbers with automated fuzzing tools.

You might be saying to yourself: "Oh the last four of my social security number isn't really a big deal".

But it kinda is. The last four of your social security number, often known as the social security serial number - it's the one unique component in your social security number which isn't predetermined by how you began your life in the United States.

According to the Social Security Administration (SSA) in the United States, the nine digit number consists of three distinct values, the area number, group number and serial number.

The area number and the group numbers are assigned to groups of people who are in a specific geographical areas in specific times. Now, social security numbers are no longer issued this way, but had been up until June 25th, 2011. While not failproof - typically armed with information such as a date of birth, name, and other details, researchers have been able to construct algorithms which guess the first 6 digits of a person's social security number with a high rate of success, something they used to verify with online credit card applications. Yikes.

The date of publishing this article is in 2021, meaning that every healthcare provider listed in these databases could likely have enough information siphoned off this way in order to commit fraud. (Unless of course if the provider is Doogie Howser and was born after 2011.)

There are of course, plenty of articles on data privacy and the horrors of having your social security serial number captured by a criminal - I won't link all those here, but in essence the last four can be used to apply for loans, utilize healthcare, perform various social engineering attacks, give you a bad day, and another reason to freeze your credit.

Thankfully, I'm writing this at the end of getting a coordinated disclosure for the vulnerability which the vendor patched (even though motivating them to do the right thing was as practical and easy as performing dental surgery on an elephant). I needed to get CERT involved and I used their brilliant VINCE system (which I'll write about in a separate post) which helped make the vendor accountable for their software.

This was the final communication to customers which they mulled on sending to customers for almost two months after the patch was ready to go.

Michael, it does feel a little disingenuous seeing that you had a fix for almost two months and you chose not to inform your customers as quickly as you could. So I'm a little disappointed here when you claim that 'the safety of your data is our priority'.

VerityStream reached out and patched their customers using MSOW on April 29th, 2021... hopefully closing the loop in a uncomplicated yet serious problem in a healthcare vendor's software.

-Marbaṩ

Your passwords are up for grabs. Here's how security researchers find them.

2019-02-12T00:00:00Z

Note: These methods do not work any longer due to the site referenced being taken down.

In January 2019, over 770 million password and username records were dumped onto the internet. The common security response to any new data dump is to use the very popular 'have i been pwned?' service. This awesome service can tell you if you're impacted by breaches like these, and will advise to change your password when it detects that an account linked to your e-mail address has leaked.

Criminals and security researchers might turn to this service to determine if a data dump should be scoured for credentials, but doesn't provide the actual credentials. We think that it's best to know the impact of your exposure by directly querying the sources criminals and security researches use. Knowing what the hackers know, or how common a password might be is really helpful in constructing useful mitigation solutions.

In the field of information security, there's always new and interesting tools popping up on the the internet, and we wanted to share a simple tool which was recently built by David Tavarez which can automate the retrieval of leaked credentials. This tool is named named pwndb.py and once installed, and you're connected to a TOR network (details in the link), you can query leaked data via cli. Let's check out the help;

$ python pwndb.py -h

usage: pwndb.py [-h] [--target TARGET] [--list LIST] [--output OUTPUT]

optional arguments:
  -h, --help       show this help message and exit
  --target TARGET  Target email/domain to search for leaks.
  --list LIST      A list of emails in a file to search for leaks.
  --output OUTPUT  Return results as json/txt
  --tor TOR        Define port running tor

We can pass in a few arguments. Let's say we just want to search for any password associated with the commonly faked e-mail address, 123@abc.com. (Passwords are masked in this image)

We can also search by domain. Let's say I want to review the passwords for all e-mail addresses associated with the abc.com domain. (Passwords are also masked in this image)

You can even pass through a list, especially useful when an organization might have several domains that need to be reviewed. You can check out helpful examples over at David's blog: https://davidtavarez.github.io

Check out your risk exposure by testing your own e-mail address. The hackers are, shouldn't you?

-Marbaṩ