Artwork

محتوای ارائه شده توسط Alex Murray and Ubuntu Security Team. تمام محتوای پادکست شامل قسمت‌ها، گرافیک‌ها و توضیحات پادکست مستقیماً توسط Alex Murray and Ubuntu Security Team یا شریک پلتفرم پادکست آن‌ها آپلود و ارائه می‌شوند. اگر فکر می‌کنید شخصی بدون اجازه شما از اثر دارای حق نسخه‌برداری شما استفاده می‌کند، می‌توانید روندی که در اینجا شرح داده شده است را دنبال کنید.https://fa.player.fm/legal
Player FM - برنامه پادکست
با برنامه Player FM !

Episode 213

9:09
 
اشتراک گذاری
 

Manage episode 384249911 series 2423058
محتوای ارائه شده توسط Alex Murray and Ubuntu Security Team. تمام محتوای پادکست شامل قسمت‌ها، گرافیک‌ها و توضیحات پادکست مستقیماً توسط Alex Murray and Ubuntu Security Team یا شریک پلتفرم پادکست آن‌ها آپلود و ارائه می‌شوند. اگر فکر می‌کنید شخصی بدون اجازه شما از اثر دارای حق نسخه‌برداری شما استفاده می‌کند، می‌توانید روندی که در اینجا شرح داده شده است را دنبال کنید.https://fa.player.fm/legal

Overview

As we ease back into regular programming, we cover the various activities the team got up to over the past few weeks whilst away in Riga for the Ubuntu Summit and Ubuntu Engineering Sprint.

Goings on in Ubuntu Security Community

Ubuntu Security team at the Ubuntu Summit (00:48)

Andrei publishes The Open Source Fortress (01:41)

  • https://discourse.ubuntu.com/t/the-open-source-fortress-is-now-live/40183
  • Back in August, Andrei put out a call for topic suggestions for a vulnerability discovery workshop that he was putting together, with a particular focus on open source code bases
  • He presented this in a 90 minute session 2 weeks ago on the final day of the Ubuntu Summit
  • He covered a number of topics with a focus on practical application of each using dedicated tooling, e.g.:
    • Threat modelling with OWASP Threat Dragon
    • Secret scanning with Gitleaks
    • Dependency scanning with OSV-Scanner
    • Linting with Bandit and flawfinder
    • Code querying with Semgrep
    • Fuzzing with AFL++
    • Symbolic execution with KLEE
  • So not only did participants learn about a given technique, such as what fuzzing is etc, but also how they can easily apply it with standard tooling to find real world problems
  • Due to the success of the workshop, he has decided to make the contents publicly available
  • Designed to be worked through in your own time

UbuCTF at the Ubuntu Engineering Sprint (04:15)

  • Emi, Nishit, Andei, Amir and David from the team organised and held the first UbuCTF at the Engineering Sprint the week after the Ubuntu Summit
  • Organised around a story of cyber crime fighting against a criminal gang in Riga
  • 5 days, 26 challenges, 64 players
  • Challenges covered a variety of topics
    • Networking
    • Web
    • Crypto(graphy)
    • Reverse engineering
    • Pwning
    • Vulnerability Patching
  • Gave experience using tools like Wfuzz, Pwntools, cutter / rizin / radare2, Ghidra, Wireshark, insomnia and more
  • 457 flags submitted (110 correct), 47 patches submitted
  • Result was very close - won by Anton Troyanov (Senior Engineer on the MAAS team)
  • Ubuntu Security team members were barred from competing as we had previously worked on these challenges - BUT shout out to Sudhakar Verma who just joined our team only 4 weeks ago and so didn’t have any prior experience with this CTF - managed to solve every single challenge 💪💪💪

Get in contact

  continue reading

235 قسمت

Artwork

Episode 213

Ubuntu Security Podcast

143 subscribers

published

iconاشتراک گذاری
 
Manage episode 384249911 series 2423058
محتوای ارائه شده توسط Alex Murray and Ubuntu Security Team. تمام محتوای پادکست شامل قسمت‌ها، گرافیک‌ها و توضیحات پادکست مستقیماً توسط Alex Murray and Ubuntu Security Team یا شریک پلتفرم پادکست آن‌ها آپلود و ارائه می‌شوند. اگر فکر می‌کنید شخصی بدون اجازه شما از اثر دارای حق نسخه‌برداری شما استفاده می‌کند، می‌توانید روندی که در اینجا شرح داده شده است را دنبال کنید.https://fa.player.fm/legal

Overview

As we ease back into regular programming, we cover the various activities the team got up to over the past few weeks whilst away in Riga for the Ubuntu Summit and Ubuntu Engineering Sprint.

Goings on in Ubuntu Security Community

Ubuntu Security team at the Ubuntu Summit (00:48)

Andrei publishes The Open Source Fortress (01:41)

  • https://discourse.ubuntu.com/t/the-open-source-fortress-is-now-live/40183
  • Back in August, Andrei put out a call for topic suggestions for a vulnerability discovery workshop that he was putting together, with a particular focus on open source code bases
  • He presented this in a 90 minute session 2 weeks ago on the final day of the Ubuntu Summit
  • He covered a number of topics with a focus on practical application of each using dedicated tooling, e.g.:
    • Threat modelling with OWASP Threat Dragon
    • Secret scanning with Gitleaks
    • Dependency scanning with OSV-Scanner
    • Linting with Bandit and flawfinder
    • Code querying with Semgrep
    • Fuzzing with AFL++
    • Symbolic execution with KLEE
  • So not only did participants learn about a given technique, such as what fuzzing is etc, but also how they can easily apply it with standard tooling to find real world problems
  • Due to the success of the workshop, he has decided to make the contents publicly available
  • Designed to be worked through in your own time

UbuCTF at the Ubuntu Engineering Sprint (04:15)

  • Emi, Nishit, Andei, Amir and David from the team organised and held the first UbuCTF at the Engineering Sprint the week after the Ubuntu Summit
  • Organised around a story of cyber crime fighting against a criminal gang in Riga
  • 5 days, 26 challenges, 64 players
  • Challenges covered a variety of topics
    • Networking
    • Web
    • Crypto(graphy)
    • Reverse engineering
    • Pwning
    • Vulnerability Patching
  • Gave experience using tools like Wfuzz, Pwntools, cutter / rizin / radare2, Ghidra, Wireshark, insomnia and more
  • 457 flags submitted (110 correct), 47 patches submitted
  • Result was very close - won by Anton Troyanov (Senior Engineer on the MAAS team)
  • Ubuntu Security team members were barred from competing as we had previously worked on these challenges - BUT shout out to Sudhakar Verma who just joined our team only 4 weeks ago and so didn’t have any prior experience with this CTF - managed to solve every single challenge 💪💪💪

Get in contact

  continue reading

235 قسمت

همه قسمت ها

×
 
Loading …

به Player FM خوش آمدید!

Player FM در سراسر وب را برای یافتن پادکست های با کیفیت اسکن می کند تا همین الان لذت ببرید. این بهترین برنامه ی پادکست است که در اندروید، آیفون و وب کار می کند. ثبت نام کنید تا اشتراک های شما در بین دستگاه های مختلف همگام سازی شود.

 

راهنمای مرجع سریع