0xCBE

joined 2 years ago
MODERATOR OF
cloudsecurity
sorted by: new top controversial old
4
Bad.Build: A Critical Privilege Escalation Design Flaw in Google Cloud Build Enables a Supply Chain Attack (orca.security)
3
ALFA: Automated Audit Log Forensic Analysis for Google Workspace (github.com)
 

cross-posted from: https://infosec.pub/post/397812

Automated Audit Log Forensic Analysis (ALFA) for Google Workspace is a tool to acquire all Google Workspace audit logs and perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework.

By Greg Charitonos and BertJanCyber

5
Building Chainguard's container image registry (www.chainguard.dev)
 

We’ve made a few changes to the way we host and distribute our Images over the last year to increase security, give ourselves more control over the distribution, and most importantly to keep our costs under control [...]

6
Kubernetes Security Basics Series Part I - Deployment and Container Orchestration (ksoc.com)
 

This first post in a 9-part series on Kubernetes Security basics focuses on DevOps culture, container-related threats and how to enable the integration of security into the heart of DevOps.

2
Kubernetes Grey Zone: Risks in Managed Cluster Middleware (www.wiz.io)
5
My AWS Pentest Methodology (medium.com)
3
Microsoft says early June disruptions to Outlook, cloud platform, were cyberattacks (apnews.com)
What are your favorite herbs/spices that you grow yourself? in c/gardening@thegarden.land
[–] 0xCBE@infosec.pub 2 points 2 years ago

nice! I didn’t know this plant. I’ll try to find some.

What are your favorite herbs/spices that you grow yourself? in c/gardening@thegarden.land
[–] 0xCBE@infosec.pub 8 points 2 years ago (2 children)

I like basil. At some point I i got tired of killing all the plants and started learning how to properly grow and care greens with basil.

It has plenty of uses and it requires the right amount of care, not too simple not too complex.

I’ve grown it from seeds, cuttings, in pots, outside and in hydroponics.

Toyota admits to yet another cloud leak in c/cloudsecurity@infosec.pub
[–] 0xCBE@infosec.pub 2 points 2 years ago

This is the official statement I think: https://global.toyota/jp/newsroom/corporate/39174380.html but it's light on details (I think, I google translated)

From reading around it looks like it was either a compute instance or a database exposed by mistake, nothing sophisticated.

4
GCP Pentesting Guide (slashparity.com)
4
CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (www.cisa.gov)
4
Exploring Firecracker MicroVMs for Multi-Tenant Dagger CI/CD Pipelines (www.felipecruz.es)
5
Securing the EC2 Instance Metadata Service (securitylabs.datadoghq.com)
10
Toyota admits to yet another cloud leak (www.theregister.com)
 

"Toyota said it had no evidence the data had been misused, and that it discovered the misconfigured cloud system while performing a wider investigation of Toyota Connected Corporation's (TC) cloud systems.

TC was also the site of two previous Toyota cloud security failures: one identified in September 2022, and another in mid-May of 2023.

As was the case with the previous two cloud exposures, this latest misconfiguration was only discovered years after the fact. Toyota admitted in this instance that records for around 260,000 domestic Japanese service incidents had been exposed to the web since 2015. The data lately exposed was innocuous if you believe Toyota – just vehicle device IDs and some map data update files were included. "

How to get rid of AWS access keys- Part 1: The easy wins in c/cloudsecurity@infosec.pub
[–] 0xCBE@infosec.pub 2 points 2 years ago

I think access keys are a legacy authentication mechanism from a time where the objective was increasing cloud adoption and public clouds wanted to support customers to transition from on prem to cloud infra.

But for cloud native environments there are safer ways to authenticate.

A data point: for GCP now Google also advise new customers to enable from the start the org policy to disable service account key creation.

what are some good communities NOT on beehaw.org or lemmy.ml? in c/chat@beehaw.org
[–] 0xCBE@infosec.pub 1 points 2 years ago

nice instance!

welcome in c/cloudsecurity@infosec.pub
[–] 0xCBE@infosec.pub 3 points 2 years ago

ahah thank you, we shall all yell together then

view more: next ›