The Transport Layer Security protocol (TLS), which secures most Internet connections, has mainly been a protocol consisting of a key exchange authenticated by digital signatures used to encrypt data at transport[1]. Even though it has undergone major changes since 1994, when SSL 1.0 was introduced by Netscape, its
Cloud Security
2021 has started with a sudden change in how IT and computing work. Remote work culture and business assessments based on the changing trends have enabled another paradigm shift in computing. The evolution of cloud computing standards and security associated with the entirety of this evolution is sending ripples in
Cloud Security
Engineers configuring security groups and firewalls tend to focus on inbound/ingress rules to restrict the networks from which requests to their applications can originate. A common best practice has long been to prevent the use of the 0.0.0.0/0 CIDR — and aliases for it — that would
Cloud Security
If there is a single best practice for container security, it is to avoid running containers as root. Rootless containers are making this much easier – almost effortless, even. In this blog, I’ll talk about why you should be avoiding root in containers, what rootless containers are, and how they
Cloud Security
Basic Authentication in GKE Until GKE 1.12, the default behavior for new GKE clusters was to generate a new set of credentials with cluster-admin access to the cluster. The username is hardcoded as admin, and the password was dynamically generated. This Stackoverflow Post from 2014 around the time of
Cloud Security
Cloud identity permissions are complex. So complex, that innocent looking permissions provided to 3rd party vendors can lead to unintended exposure of all of your data. The Wiz Research team conducted extensive research of permissions provided to 3rd party vendors in cloud environments and the results should be a wake-up
Cloud Security
As a Google Cloud Administrator planning your IAM strategy for how to best use the built-in Google Kubernetes Engine (GKE) IAM Roles, there are a few details that might be confusing and/or surprising that could have unintended consequences. Clarifying the GKE Predefined IAM Roles Here’s a listing of
Cloud Security
If an attacker compromises a Google Cloud Platform (GCP) user’s device, he can easily steal and abuse cached credentials, even if MFA is enabled. In this blog post, we will demonstrate an attack in real Google Cloud environments, involving: * Hijacking cached OAuth tokens stored on a GCP administrator’s
Technology
Cybersecurity researchers have disclosed a series of attacks by a threat actor of Chinese origin that has targeted organizations in Russia and Hong Kong with malware — including a previously undocumented backdoor. Attributing the campaign to Winnti (or APT41), Positive Technologies dated the first attack to May 12, 2020, when the
An ongoing malware campaign has been found exploiting recently disclosed vulnerabilities in network-attached storage (NAS) devices running on Linux systems to co-opt the machines into an IRC botnet for launching distributed denial-of-service (DDoS) attacks and mining Monero cryptocurrency. The attacks deploy a new malware variant called “FreakOut” by leveraging critical
Health
Welcome! In this post, we’ll be taking a character-by-character look at the source code of the BioNTech/Pfizer SARS-CoV-2 mRNA vaccine. Now, these words may be somewhat jarring – the vaccine is a liquid that gets injected in your arm. How can we talk about source code? This is a
On January 29, 2019, a serious vulnerability was discovered in Group FaceTime which allowed an attacker to call a target and force the call to connect without user interaction from the target, allowing the attacker to listen to the target’s surroundings without their knowledge or consent. The bug was
