Modern vs. 0ld 5k00l

### Overview In "Modern vs. 0ld 5k00l: An AppSec Journey," Seth Law, founder of Redpoint Security and co-host of the Absolute AppSec podcast, explores the evolution of application security. He challenges the common belief that modern AppSec practices and tools represent completely unprecedented progress compared to an insecure past. Instead, Law argues that the foundational principles, design challenges, and core vulnerability classes seen today have been understood since the earliest days of computing, notably dating back to the 1970 Ware Report. By contrasting historical security incidents with modern equivalents, he demonstrates that many security weaknesses persist because security is fundamentally treated as an afterthought rather than a core design problem.

### Key Topics - **Historical Foundations & The Ware Report (1970):** Early computer security research by the Defense Science Board Task Force identified risks that mirror modern internet environments—such as geographically distributed users, multi-access time-sharing systems, and sensitive information handling. The report anticipated threat modeling and emphasized that security in computer systems is fundamentally a design problem. - **Authentication Weaknesses (Old vs. New):** From brute-forcing a 4-digit PIN on a 1992 school voicemail notification system (bypassing callouts by restarting the system) to modern registration workflows that reveal valid credentials and bypass login rate limits. - **Enumeration and Access Control Flaws:** How 1990s war dialing using tools like `IWAR` to discover PBX systems, BBSs, and long-distance exchanges parallels modern forced browsing, insecure direct object references (IDOR), and predictable URL routing. - **The Perimeter and Tooling Illusion:** How perimeter failures like Iomega's 2001 Code Red worm infection (caused by assigning routable public Class B IPs to internal systems) reflect ongoing reliance on single-point solutions like firewalls, SAST, DAST, SCA, and now AI. - **Information Disclosure in Modern Queues:** A 2021 case study where users waiting for Disney Magic Key season passes shared screenshots online showing their `Queue ID` (`Q_ID`), allowing an attacker to swap queue tokens in Burp Suite and bypass a 12-hour wait.

### Technical Details - **1970 Ware Report Insights:** Outlined deliberate penetration, active infiltration, accidental disclosure, and physical attacks, concluding that security controls must be designed in from the beginning and warning against operating sensitive systems in open environments. - **Voicemail System Bypass (1992):** An anonymous dial-in system with a 4-digit administrative passcode (`5642`) allowed high school students to access admin menus and reboot the host before nightly absence notification calls were dispatched from volatile memory. - **War Dialing vs. Forced Browsing:** Star 69 caller return disrupted automated wardialing in 1993, but the same enumeration concept exists on web apps via tools scanning endpoints. An example staging system separated tenants with a 3-letter lowercase path component without authorization checks, exposing secret keys and configuration data within 18,000 requests. - **Disney Magic Key Queue Jump (2021):** The ticketing waiting room tracked user positions via a `Q_ID` cookie that was also displayed directly in the user interface. Frustrated users tweeted screenshots of their screens displaying their queue IDs, enabling Law to capture a lower-wait ID via Burp Suite and purchase passes in nine minutes. - **Tooling Limitations:** Static analysis tools often output tens of thousands of findings (e.g., 10,000–20,000 results in Fortify or Checkmarx), overwhelming developers with false positives and confusing identification with remediation.

### Takeaways - **Security is a Design Problem:** Security cannot be bolted on at the end or solved solely through vendor tools, dynamic/static scanners, or AI hype. It requires security by design and threat modeling. - **Education Must Meet Developers Where They Are:** Cryptography theory and generic compliance courses fail to address practical daily coding flaws. Guidance must be actionable, framework-specific, and integrated into modern IDEs and workflows. - **Culture Over Antagonism:** Instead of negative security interactions where teams simply say "no," organizations should foster product security teams, security champions programs, and collaborative relationships. - **Focus on Fundamentals ("Crocs and Socks"):** Core foundational controls like access control, role-based access control (RBAC), data classification, input validation, and auditing/logging remain the most critical elements in securing modern software.