HTTP/2

I'm Sarah Lane.

HTTP 2 Shell sparks emergency patches.

HTTP 2 Shell, also called Node 2 Shell, affects broadly Google's compression library used in Node.js, some Python HTTP clients, .NET, and other software.

Malicious compressed data can crash apps, expose memory, or run code.

which cybersecurity company Imperva confirmed.

And for hunting, if they're worried they patched too late.

Hunt for HTTP2 and HPAC encoding anomalies in your logs.

Look for those traversal sequences and that backslash zero null byte.

Okay, so let's quickly recap the defender action list for everyone listening.

And that is exactly what we are diving into today.

I was reading Steven Louden and Javier Garza's breakdown of this in their book, Learning HTTP/2: A Practical Guide for Beginners.

It's a great read, super detailed.

Yeah, it really is.

That's a great way to put it, and the data they gathered was just undeniable.

SPDY was drastically faster.

They took this proof to the Internet Engineering Task Force, the IETF, and it became the foundational blueprint for HTTP/2, which was officially published in twenty fifteen.

So this is the big upgrade.

Good work.

So the security vulnerability is in HTTP2 servers.

Okay.

HTTP2, in case you're unfamiliar.

So there's HTTP, which is like protocol used to talk to the web.

And two is like the newer one, which is faster, right?

Why is it faster?

Wow.

...

ClassicNet brings a modern network stack to classic Mac OS, including TLS 1.2 and 1.3, HTTPS, HTTP/2 with multiplexing and flow control, and WebSocket, while PlatinumSky and PaleoMastodon bring both BlueSky-

[laughs]

... and Mastodon to Mac OS 9.

Y- you know, I don't know.

And I was t- I, I was looking into it a little bit because I was like, man, I, you know, I, I'm, I feel like I'm just now getting a grip on HTTP2, and now they're talking about HTTP3, you know? And, uh, it, it is, um, it is, it is tricky, man.

Uh, so this is a UDP-based HTTP, right, um, uh, as well.

And, uh, man, it, it seems like that solves a lot of the speed, you know, issues because-

Yeah.

It's still, um, a lot of major, uh, CDNs like CloudFront still don't support upstream HTTP2.

So if you're on those CDNs, you cannot kill upstream HTTP1 yet.

And I'm hoping over time, putting more and more pressure on them to actually prioritize adding HTTP2 support so that we can kill this thing off properly.

Awesome.

And Burp Collaborator brought like OS to the masses, right? You know, Paramount Miner, Turbo Intruder, and Backlash Power Scanner becomes like a staple, right? So what makes a security tool become industry standard?

Most overhyped buzzword at Defcon right now?

Well, right now, it's agentic, but we just launched an agentic product two weeks ago.