This author wrote a script that was praised for its UX to automate the evaluation steps in a competition. They argue for comprehensive error handling and input validation with detailed and actionable error messages, clear and colorful output, detailed progress reporting without overwhelming the user by using set -x, using set -x and set +x for fine grained and strategic error handling, making use of platform specific functionality, and using time stamped file outputs to make multiple runs easier to compare. Examples of each of these principles are included in the post.
Many critical sectors still use vulnerable pager networks like POCSAG, which are easily exploited for message injection attacks via radio frequencies, for emergency communication. These networks lack encryption, allowing anyone with basic equipment to intercept and manipulate messages, posing serious security risks in sensitive environments. This blog post highlights the urgent need for stronger security measures in these outdated communication systems by demonstrating how easy it is to spoof messages.
To better understand the current vulnerabilities and threats facing modern DevOps teams, Datadog evaluated real-world data [13] from thousands of organizations. Discover why only 3% of “critical” vulnerabilities are actually worth prioritizing, the problem with 3rd party dependencies, and why legacy risks are still a problem. Read the
undocumented-aws-api-hunter is a tool for uncovering undocumented AWS APIs. It works by launching a headless Chrome browser that crawls through the AWS Console.
Cloudflare has launched new free security features for website owners and network protection, including threat intelligence, analytics, and account takeover attack detection. Users can now access Security Analytics, API schema validation, and Page Shield script monitor to enhance their security. Cloudflare has also introduced new authentication options, such as signing up and logging in with Google, to simplify account access and reduce the risk of compromise.
Google has announced the ability for users to save passkeys to Password Manager, the password manager built into Chrome. Passkeys will automatically sync across computers and Android devices running the Password Manager app. Support for ChromeOS is in beta and support for iOS is planned.
TCM Security has announced that it will be launching a free tier to its academy. The initial offering will contain four courses: Practical Help Desk, Programming 100: Fundamentals, Linux 100: Fundamentals, and Soft Skills for the Job Market. The free tier launches today and users can access the content by signing up with only an email address.
CrowdStrike has improved testing and rollout procedures to prevent system crashes like the one in July. It now deploys software updates gradually and has added new validation checks to prevent errors. Microsoft is also making changes to enhance security in Windows 11 following the global IT outage caused by a faulty CrowdStrike update.
A study by e2e-assure revealed a stark contrast between cyber risk owners' confidence in AI policies (85%) and employee awareness of such guidance (34%), indicating potential vulnerabilities in organizational cyber resilience despite increased adoption of AI technologies.
Recorded Future's Insikt Group is tracking a massive infostealer campaign with over 50 different variants. The campaign is targeting high-value targets in the crypto and gaming communities by spear phishing attacks impersonating job opportunities or collaborations to distribute malware. It is very sophisticated and utilizes a variety of different payloads depending on the OS of the target.
German authorities dismantled a Dark Web platform for child sexual abuse material in 2021 by identifying Tor users, raising concerns about Tor's privacy. The platform, Boystown, had over 400,000 users and hosted severe abuse content, leading to arrests and a significant blow to illegal dark web activity. Experts suggest outdated software and increased scrutiny of Tor nodes played a role, emphasizing the need for users to enhance their browser security.
AWS' Incident Response team has released guidance for investigating incidents on Generative AI workloads in AWS. The post begins by discussing the steps that can be taken before an incident to train users, set up logging, and create playbooks. It then details how to investigate each component of a workload such as the infrastructure changes, AI settings changes, access changes, private data changes, and invocation logs. The post concludes with a sample scenario.
Security teams should introduce security scorecards to scale security beyond security champions or dedicated teams. They should also take care to establish partnerships with teams, improve the UX of security scorecards, go beyond vulnerability management, and allow room for risk acceptance. This post presents several case studies of organizations that have implemented and publicly discussed security scorecards.
This blog post demonstrates how a low-privileged user on a Linux machine can gain root privileges by manipulating iptables and iptables-save through sudo, potentially leading to local privilege escalation. Leveraging sudo commands with NOPASSWD privileges or combining sudo with tools like tcpdump can allow for executing arbitrary commands as root. By exploiting the functionalities of iptables and iptables-save, an attacker can craft a root entry in /etc/passwd and escalate privileges to root on the system.
Trustero's patented AI suite unlocks 3 superpowers for GRC teams: AI Questionnaire Automation using your most current data; Human-level AI Gap Analysis; and the AI SOC 2 Report Scanner. TLDR readers can start free with 2x the AI credits [11]! To learn more about the benefits, watch the Real Value of AI in Compliance [12] with Trustero user Justin Dooley, CFO of Chassi.
SAST tools often struggle to detect vulnerabilities and follow control flow across complex frameworks or libraries. To address this, Semgrep Pro has added framework-aware analysis, global object tracking, and prebuilt rules for Django, Flask, FastAPI, and other major libraries. Semgrep's testing resulted in an 84% true positive rate on ~1,000 findings across 192 repositories containing ~20M lines of code.
Chris Farris, an expert on cloud security, writes a scathing condemnation of the state of cloud security. Farris begins the post by detailing many major cloud security incidents from Code Spaces to CrowdStrike. He divides these incidents into those that were caused by blatant customer failures such as not disabling access of terminated employees, not storing backups, and not enabling security features, and those incidents that were caused by blatant cloud provider failures such as Snowflake not enforcing MFA. Farris argues that we must demand more security guardrails and baseline features from cloud providers.
AWS Private CA has added SCEP support at no additional cost. SCEP is a protocol that is adopted by MDM solutions to obtain digital identities from a CA. This allows organizations that use an MDM provider to utilize their cloud CA for SCEP instead of needing to manage a separate CA for it.
Achieving compliance with SOC 2 and ISO 27001 is crucial for unlocking growth and establishing customer trust, but it can be time-intensive and costly.
GitLab has released a bulletin urging CE and EE users to update their installation to fix a critical vulnerability. The vulnerability allows RCE via environment stop action jobs. The fix also addresses four other high severity vulnerabilities that can be exploited to achieve RCE.
A sneaky campaign on GitHub is tricking users into visiting a fake domain and installing Windows malware by falsely reporting security vulnerabilities. Users are receiving convincing email alerts from legitimate GitHub addresses, leading to the spread of malicious software. Threat actors are using GitHub's "Issues" feature to distribute malware through open-source repositories, highlighting the platform's vulnerability to abuse.
SaaS providers often need to integrate with customers' AWS environments to perform a variety of tasks such as cost optimization or CSPM. The basics that a provider can do are to use IAM Roles with ExternalIDs instead of IAM users and to audit and minimize permissions that your role requires. Some paved roads and guardrails that providers can then take would be to provide CloudFormation templates and/or a Terraform provider as well as refusing to assume an overly permissive role. Finally, providers should treat their integrations as crown jewels and consider using defense-in-depth models such as bastion accounts and restricting the customer's trust boundary to a single role instead of a full account.
2024.09.20·
securitylabs.datadoghq.com·9 min read·TLDR InfoSec
Entrust is partnering with SSL.com to issue trusted certificates and prevent disruptions as Chrome and Mozilla plan to stop trusting its TLS certificates soon due to compliance concerns. Cloudflare will now support SSL.com certificates for automatic issuance and renewal, making it easier for domain owners.
Stowaway is a Multi-hop proxy tool for security researchers and pentesters. Users can use it to proxy external traffic through multiple nodes to the core internal network, breaking through internal network access restrictions, constructing a tree-like node network, and easily realizing management functions.
Security teams can be classified into three categories: mature and engineering-focused teams, mature but not engineering-focused teams, and less mature teams or organizations that lack resources. Mature and engineering-focused teams will look to build their own tools, become design partners with early stage startups, and only look to buy tooling once it becomes commodified. Mature but not engineering-focused teams will often buy tooling from early-stage startups. Less mature teams will primarily wait for larger companies to adopt new tooling and features to reduce the amount of products they pay for. Startups need to be aware of these trends as they are the inverse of typical strategies. Security teams need to consider this cycle when deciding to build vs buy tooling.
Semafor interviewed 24 former CrowdStrike employees in the wake of the outage this past July. The employees detailed working conditions that prioritized speed above all else and omitted quality control. CrowdStrike disputes these claims and says that these were disgruntled former employees who are not reputable.
AWS engaged Trail of Bits to evaluate three major authorization and access management policy languages: Cedar, Rego, and OpenFGA. Trail of Bits evaluated sixteen threat scenarios and grouped them by attack surface and mitigation similarity. Cedar's predictable evaluation model protects against DoS from users and the formalized semantics, testing, and typing system prevent language misuse and mis-evaluation, but data ingestion and engineering may cause complexities. Rego provides a flexible policy language which can make it easier to use but also may lead to language misuse, mis-evaluation, or performance considerations. OpenFGA provides a declarative language for mapping ReBAC constraints, which can simplify policy writing, but it relies on external attribute lists and can lead to unpredictable performance. The language also features mitigations for threats related to policy extension and replacement.
Most compliance mandates require you to define your risk tolerance before putting controls in place. To do so, you first need to have a good understanding of cybersecurity risk, and how it impacts your compliance posture.