Chris Frohoff

Scholars - Women in Security and Privacy WISP Privacy Statement

Today I’m raising money to send underrepresented folks to @defcon.bsky.social + other technical cons/training next year! Yes, you’ll get a tax write off ❤️

Hear our Scholar Stories for the impact of WISP: www.wisporg.com/scholars

Here’s the donation link! wisporg.app.neoncrm.com/forms/donation

Scene from "The Hobbit" movie with Elrond and Bilbo talking with meme text saying "it is said: go not to the principal engineers for counsel, for they will say both no and yes"

What I had read in multiple places seemed to indicate that it did not do that, but now I'm not so sure

Imported my previous posts from twitter. App should show a small indicator to note that it isn't new

speech and writing are just serialization for human thoughts #showerthoughts

summary of how apps tended to mitigate a reported deserialization vulnerability

summary of how gadgets tended to be introduced into a library

paper here https://arxiv.org/pdf/2208.08173.pdf

Some very cool research and analysis in this paper, but remember kids: don't assume that fixing/removing/blocking gadget classes is going to protect you if you're still deserializing objects from untrusted data https://twitter.com/TheRegister/status/1561805738699259905

Though tbf, anything trying to be an API is only as good as it's documentation, contracts, and change control

Also, your internal app logs are not an API https://twitter.com/rakyll/status/1562239578865405952

More fun bespoke Oracle product java deserialization gadget chains and blacklist bypasses https://twitter.com/peterjson/status/1539920744129634305

ysoserial/src/main/java/ysoserial/payloads/URLDNS.java at master · frohoff/ysoserial A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. - frohoff/ysoserial

Fun fact: @gebl's URLDNS java deserialization gadget in ysoserial relies on exactly this obscure (and absurd) behavior to trigger a DNS lookup https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/URLDNS.java#L27 https://twitter.com/ncweaver/status/1470453024870912000

This seems likely to be fruitful against a lot of apps out there. https://twitter.com/iangcarroll/status/1455580303578124291

The Illustrated TLS 1.2 Connection Every byte of a TLS connection explained and reproduced

Handy detailed TLS protocol reference https://tls.ulfheim.net/

https://twitter.com/josephfcox/status/1448711092201472006

Great analogy, and applicable to the whole tech industry https://twitter.com/kwestin/status/1445965144979218435

Good survey of Ruby ecosystem deserialization vulnerabilities https://twitter.com/zenn_dev/status/1442089822156296193

In my previous life as a lead sweng, our project's maven pom.xml literally listed my role as "code archaeologist" https://twitter.com/rakyll/status/1441832225595527169

Artistic rendition of code reuse attacks a la ROP and deserialization https://twitter.com/Rainmaker1973/status/1402664288104292353

Older post focusing on intra-service auth is also great https://web.archive.org/web/20200507173734/https://latacora.micro.blog/a-childs-garden/

Great overview and pros/cons of various types of auth tokens https://twitter.com/tqbf/status/1430278923653468168

That's the sound of 100k developers firing up Linux VMs https://twitter.com/QuinnyPig/status/1432720164169076755

I don't always do work on weekends, but when I do...

More excellent WebLogic deserializaion gadget blocklist bypass work from @matthias_kaiser. I've lost count on all these. https://twitter.com/matthias_kaiser/status/1417837065060950021

PSA: folks should be aware that AWS Infinidash allows full read access by default so make sure you lock yours down with a fine-grained IAM policy

This would make a great April fool's day prank next year https://twitter.com/FooBartn/status/1411349844292247553

LayerOne 2021 CTF "Deathball: *" challenge series LayerOne 2021 CTF "Deathball: *" challenge series. GitHub Gist: instantly share code, notes, and snippets.

And if you want to play more, just run this docker-compose project locally and netcat to the entrance at port 4444

https://gist.github.com/frohoff/3a387ede3364f4ee2733fbffe7d297d0

For anyone who didn't finish the Deathball challenge series at @LayerOneCTF and was curious, here's the map of our pseudo-randomly generated network REPL container labyrinth:

Do the Germans also have a word for the guilt felt when relishing absurd levels of schadenfreude?