Cloud Security
To be able to trust cloud computing, you need to be able to trust it less. Here’s a look at the cloud/trust paradox, and what your business can take away from it. At their core, many discussions about cloud security—and, in fact, cloud computing—ultimately distill to
Technology
In light of the recent SolarWinds supply chain attack, I decided to take a quick look at SolarWinds products based on the Orion framework. SolarWinds offers trial versions for download. I picked User Device Tracker and installed it on a vanilla Windows Server 2019 virtual machine. As a part of
This post is about a VirtualBox VM escape exploit that existed in VirtualBox 6.1.16 on Windows. Many thanks to the organizers for hosting this great competition, especially to ChenNan for creating this challenge, M4x for always being helpful, answering our questions and sitting with us through the many
Key Takeaways * Donkey is a new Clojure open-source HTTP library, designed for ease of use and performance. * Identifying the strengths and weaknesses of a language helps with design decisions. * Clojure frees developers from the perils of writing concurrent programs, but at a price. * When concurrency is not a factor, consider
Technology
In previous posts we wrote about our configuration distribution system Quicksilver and the story of migrating its storage engine to RocksDB. This solution proved to be fast, resilient and stable. During the migration process, we noticed that Quicksilver memory consumption was unexpectedly high. After our investigation we found out that
Technology
This post originally appears here One of the great arts of software engineering is making updates and improvements to working systems without taking them offline. For some systems this can be rather easy, spin up a new web server or load balancer, redirect traffic and you’re done. For other
Technology
This post originally appears here Cloudflare’s network processes more than fourteen million HTTP requests per second at peak for Internet users around the world. We spend a lot of time thinking about the tools we use to make those requests faster and more secure, but a secret-sauce which makes
2020 saw an unprecedented increase in the importance and value of digital services and infrastructure. From the rise of remote working and the global shift in consumer habits to huge profits booked by internet entertainers, we are witnessing how overwhelmingly important the connected infrastructure has become for the daily functioning
Technology
In binary analysis, a recurrent problem is to track back a register or memory value (we will call them variables in the rest of the blog entry). To present the problem, we will use a simplified representation instead of barbarous assembly. Here is a first example: Here are some questions
Three layers There are three layers of protection applied before main starts doing its intended work. Frida detection, jailbreak detection, and debugger detection. Frida listens (Edit: Here is what Frida does) When Frida runs in injected mode1, there’s a daemon, frida-server, that listens for connections on port 27042 and
Technology
Today’s Go security release fixes an issue involving PATH lookups in untrusted directories that can lead to remote execution during the go get command. This post details the bug, the fixes we have applied, how to decide whether your own programs are vulnerable to similar problems, and what you
Cloud Security
The pandemic has turned 2020 into a year of medicine and information technology. The remarkable surge in the criticality level of medical infrastructure, coupled with feasible across-the-board digitalization, led to many of our last year’s predictions coming true much sooner than expected. As we foresaw, there has been an
