ANTITREE

A few months ago, a quiet patch was merged into Firecracker that fixed a security issue that impacts aarch64 only.

Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute I’ve been describing a common thread throughout these posts which is we can spend hours building artisinally cr…

Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute The other post, I’ve been mostly describing the operational burden of managing seccomp profiles and describing…

Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute The idea behind seccomp profiles for a container is simple: your container makes good syscalls, let’s block the…

Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute It’s been a few weeks since I presented at BSidesSF.

Just leaving DEFCON and wanted to post my slide deck from the DEFCON Cloud Village.

Seccompare.com quickly compares two container seccomp profiles and includes a handy syscall lookup table.

seccomp-diff extracts the real seccomp filters straight from a running container Reverse engineering BPF taught me more about containers and syscalls than I expected seccomp good, seccomp at scale hard Ever wonder if the seccomp profile Docker or Kubernet…

Take-aways Container registries are simple services ripe for subtle abuse They are trusted endpoints making them useful for exfil and post-exploitation It’s easy to make a malicious file appear like a legitimate image layer I’m beating up container enviro…

UPDATE 11/28/2020: Thanks to @jaybeale and @sethsec for pointing out I was calling it “OPA Gateway” instead of OPA Gatekeeper.

I’m writing about the Kubernetes API’s use of the “LIST” verb it controls access to Secrets in a cluster.

TL;DR The Linux Kernel keyring is known to be a security issue for containers Download my tool for breaking out of a container to steal all the host keys here: keyctl-unmask We can use this in Kubernetes to steal all node keys as well Have you ever wanted…

Saturday, I gave my talk titled “Command and KubeCTL: Real-World Kubernetes Security for Pentesters” at Shmoocon 2020.

It’s been on my list for at least 6 months to start contributing to krew if possible.

Sometimes during a container or Kubernetes assessment, we get requested to review whether a runtime security tool that a client uses is sufficient for their threat model.

By default Docker allows all of their containers to run with the CAP_NET_RAW capability, I believe to easily support ICMP health checks when needed.

After 8 years of Security B-Sides Rochester, it’s time for me to turn it over to new leadership that wants to keep the conference going.

The folks at Rochester 2600 were regaled by a talk from Payap Sirinam who is on Matthew Wright’s academic team at RIT.

One of my favorite things about the Tor Project is their proposal system.

I noticed this bug ticket from Tor Project last week: Make exit flag depend on ports 80 and 443, not 6667 and it reminded me about a short talk I gave regarding how the port you connect to a service on, directly affects the anonymity you’re able to achiev…

Tor Project has just released version 0.3.2.1-Alpha of tor that supports the long-awaited, next-generation onion services that aim to repair many its known flaws.

This is a follow up from the Custom Seccomp profile post which went through some of the background information.

This post goes through building custom Docker seccomp profiles for your container.

This post goes into what tor’s onion service authentication features do, how they work, and when they should be used based on your threat model because I couldn’t find any other documentation about it besides reading the spec.

One of Docker’s many updates this year was adding seccomp support.

I’ve written about [customizing PhantomJS to defend against fingerprinting]({{ ref “post/2015-05-18-browser-fingerprinting-attack-and-defense-with-phantomjs2015/05/18/browser-fingerprinting-attack-and-defense-with-phantomjs/” >}}) but I never really looked

Continuation from previous posts: 1 and 2 Website Fingerprinting Defenses at the Application Layer I like research projects on subjects that I feel have no hope.

Continuation from previous post: 1 Waterfilling: Balancing The Tor Network With Maximum Diversity This paper is proposing a new tor circuit path selection algorithm that makes bigger nodes run middle/relay traffic more often and smaller nodes more become…

The annual Privacy Enhancing Technologies Symposium (PETS) 2017 is a privacy nerd’s dream and has always been on my list to attend.

Summary This blog post is going to show you how to go from exploiting a single container to gaining root on an entire cluster and all nodes.

If you’re like me and want to stand up a quick server that can response on all ports, here’s a quick way to do it.

UPDATE: The source repository for all this code is hosted here: https://github.com/antitree/bsidesroc2017ctf Check out the previous 1, 2, 3 and 4 for the other CTF challenges.

Check out the previous 1, 2, and 3 for the other CTF challenges.

This is a continuation of the previous posts talking about BSidesROC onion related CTF challenges.

This is a continuation of the previous post talking about BSidesROC onion related CTF challenges.

Now that BSidesROC is over and the CTF is closed, I can share some of the details about the Onions CTF category that I made.

Our little hacker conference that usually draws about 400 people is happening again on 4-21 and 4-22.

I’ve made a scalable way of building a fully private functioning tor network using Docker.

It’s another year of BSidesROC, a local hacker con that we put together.

This post on hackernews got my attention.

I don’t remember the exact conversation, but Jason Ross inspired me to buy DRWND.com, as in Drone + PWND = DRWND.

PhantomJS is a headless browser that when you use Selenium, turns into a powerful, scriptable tool for scraping or automated web testing in even JavaScript heavy applications.

I’ve updated the Raspberry Bridge build to 1.5.1Beta to update a few things and address a couple issues.

The Meek Protocol has recently been getting a lot of attention since the Tor project made a few blog posts about it.

Over at rbb.antitree.com, you’ll see the details of a new project of mine: To build a Raspberry Pi environment to make it easy for anyone to run a Tor Bridge node.

If you’re like me, you’re probably getting inundated with posts about how the latest revelations show that NSA specifically tracks Tor users and the privacy conscious.

Chutney is a tool designed to let you build your own private Tor network instance in minutes.

BSidesROC is over.

Rochester’s version of a Security B-Sides is coming up next week.

Last year, I was bit by the idea of intel as a research project.