Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Attacking CVE data with automation

Attacking CVE data with automation

Talk about CVE data from CamSec. Discusses what CVEs are, problems with naming and versioning software, examples of tools which use the CVE database and how you can use it in your own custom tooling.

Gareth Rushgrove

August 10, 2017
Tweet

More Decks by Gareth Rushgrove

Other Decks in Technology

Transcript

  1. - An introduction to CVEs - Sources of CVE data

    - Existing tools - Automation example
  2. CVE is a list of information security vulnerabilities and exposures

    that aims to provide common names for publicly known cyber security issues. The goal of CVE is to make it easier to share data across separate vulnerability capabilities (tools, repositories, and services) with this "common enumeration."
  3. - CVE-2014-6271 - CVSS v2 Base Score: 10.0 HIGH -

    Access Vector: Network exploitable Access Complexity: Low Authentication: Not required to exploit Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service
  4. I posit that CVE Information is really only useful if

    you can tie it to a software product and version
  5. CPE is a structured naming scheme for information technology systems,

    software, and packages. Based upon the generic syntax for Uniform Resource Identifiers (URI), CPE includes a formal name format, a method for checking names against a system, and a description format for binding text and tests to a name.
  6. Lots of high-level tools exist to try and help with

    answering the question “am I vulnerable?”
  7. - Write programs that do one thing - Write programs

    to work together - Write programs to handle text streams
  8. $ puppet resource package --param provider package: acl: ensure :

    '2.2.52-2' provider: 'apt' adduser: ensure : '3.113+nmu3' provider: 'apt' apt: ensure : '1.0.9.8.4' provider: 'apt'
  9. $ lumogon scan {"$schema":"http://puppet.com/lumogon/core/draf t-01/schema#1","generated":"2017-08-07 11:35:16.6517922 +0000 UTC","owner":"default","group":["default"],"cli ent_version":{"BuildVersion":"development","Bui ldTime":"2017-05-11

    08:24:20 UTC","BuildSHA":"a7f2943697f83ba74514a0169890ec f8ad1cfacb"},"reportid":"c6a8731e-9681-4758-915 1-9c2699769418","containers":{"8c8024760f3e4692 e93c6f4f76dc56eaab879e56ace06f876afeccc5c615ac2 8":{"$schema":"http://puppet.com/lumogon/contai nerreport/draft-01/schema#1","generated":"2017- 08-07 11:35:16.1308581 +0000 UTC","container_report_id":"2e65f6e7-371d-4bae-
  10. - A central list of vulnerabilities is useful - Naming

    things is hard - CPE vs package managers vs GitHub - Still possible to build useful things - Requires work to normalize datasets