Trustwave's SpiderLabs security research team publishes vulnerability disclosures, exploit write-ups and malware analysis, covering Electron, Joomla, SolarWinds and ModSecurity.
HN links it as a primary source for vulnerabilities and attacks, such as 7-Zip flaws, JSON parsing bugs in ModSecurity and the Kaseya VSA attack.
I've read through the spec along with the FAQ that epeus so graciously shared here. The idea of mentioning beyond the scope of one website's walled garden seems like a very natural progression of ActivityPub and the new-found hype surrounding Mastodon. My concern is that I haven't seen much thought into the security implications.
The spec makes it clear that they're trying to simplify pingbacks but they don't address the fundamental security problems with pingbacks in the first place. And anyone who's maintained a Wordpress site will tell you, the first thing you do is turn off the Trackback and Pingback features [1] because not only does it attract the scummiest deluge of spam [2] but they've also been useful for disclosing internal network info and [3] leveraged to target other websites in DDoS attacks. [4]
The only thought given to preventing abuse is as follows from Section 4.1:
>The verification process SHOULD be queued and processed asynchronously to prevent DoS attacks per section 3.2.
>Receivers MUST verify Webmentions per section 3.2.2.
The first directive isn't a guarantee a DoS attack won't block all IO, it just means don't make it trivial to bring a site down with webmentions. The second directive sounds nice but if you read through section 3.2.2 of the recommendation, it just mandates that you should validate the application data that's submitted. [5] There's no mechanism to authenticate messages, validate the sender, nor limit mentions to a set of trusted…
If you're already encountering blocks, I don't think you can assume there won't be blocks on QUIC unfortunately. Here are just a selection of vendors advice. There's plenty of them, and they are probably used by some schools, libraries etc.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClarCAC
> Our recommendations:
> Palo Alto Networks recommends creating a security policy in the firewall to block the QUIC application.
https://community.spiceworks.com/topic/2146987-do-you-block-quic
> Do You Block QUIC
> Thinking about it, ...
> Yes, ...
> Yes, ...
> Yes, ...
> No, ...
https://www.fastvue.co/fastvue/blog/googles-quic-protocols-security-and-reporting-implications/
> How Google’s QUIC Protocol Impacts Network Security and Reporting
> ... inadvertently created a security hole for many organizations.
> ... At the time of writing, the advice from most firewall vendors is to block QUIC until support is officially added to their products.
https://help.zscaler.com/zia/managing-quic-protocol
> Managing the QUIC Protocol
> Zscaler best practice is to block QUIC
https://www3.trustwave.com/support/kb/print20269.aspx
> Blocking web traffic over QUIC
> The recommended fix is to block outbound UDP on ports 80 and 443 ...
Honestly, when it comes to cyberattacks, I think the truly worst area right now is "Internet of Things" devices and similar Internet connected devices like point of sales. At least Windows (and other computer OSes) have slowly become more secure over the last 20+ years. As far as I know, all the major OS players are very good at patching discovered exploits quickly. Malware spread by social engineering (eg tricking someone to execute malicious code) is the most common way things are spread these days.
Many IoT companies, in contrast, have root-level exploits that are laughably trivial to hack, and some don't seem to care that much at all when exploits are discovered (https://www.trustwave.com/Resources/SpiderLabs-Blog/Undocumented-Backdoor-Account-in-DBLTek-GoIP/). Windows is imperfect I'm sure, but I'd rather connect a Windows machine to the public network than any so-called "smart" appliance at this point.
1) Schneier's advice from a few years ago is still accurate:
https://www.schneier.com/blog/archives/2012/07/how_to_become_a_1.html
2) The Reddit NetSec FAQ has a good list of resources for beginners (and those starting to specialize):
https://www.reddit.com/r/netsec/wiki/start
3) Finally, each of these popular "Getting Started in Security" guides has a slightly different, but useful, opinion on the specifics of the path to take:
https://medium.freecodecamp.org/so-you-want-to-work-in-security-bc6c10157d23
https://danielmiessler.com/blog/build-successful-infosec-career/#gs.0udo4S8
https://www.trustwave.com/Resources/SpiderLabs-Blog/Getting-a-Start-in-the-Security-Industry/
https://tisiphone.net/2015/10/12/starting-an-infosec-career-the-megamix-chapters-1-3/
One substantial difference worth noting between the Russian astroturfing and astroturfing from other countries is that Russian crime have been refining their ability to automate human-like behavior for ad-fraud purposes. For those not familiar with ad fraud, there's been an arms race between criminal organizations to emulate human behavior clicking on ads and the advertising companies trying to detect it. The resulting algorithms have dual use properties that can be applied to astroturfing (e.g. https://www.trustwave.com/Resources/SpiderLabs-Blog/Bedep-trojan-malware-spread-by-the-Angler-exploit-kit-gets-political/).
It's not hard to find quite recent json parsing vulnerabilities, e.g.
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-dos-vulnerability-in-json-parsing-cve-2021-42717/
A fun historical one was remote code execution due to a json parser bug in Google Chrome. Oops. If you try a simple search on mitre, you'll see some false positives, but also a bunch of actual vulnerabilities each year:
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=json
Here is a nice blog post walking through various JSON based exploits:
https://bishopfox.com/blog/json-interoperability-vulnerabilities