Docker в опасности, или как искать уязвимости в образах контейнеров
Какие уязвимости бывают в образах контейнеров, как их устранять и какой сканер уязвимостей лучше выбрать.
Развернутая статья от DevOps, DevSecOps инеженера из Nixys:
— https://habr.com/ru/companies/nixys/articles/735544/
Какие уязвимости бывают в образах контейнеров, как их устранять и какой сканер уязвимостей лучше выбрать.
Развернутая статья от DevOps, DevSecOps инеженера из Nixys:
— https://habr.com/ru/companies/nixys/articles/735544/
/ Meet the GoldenJackal APT group. Don’t expect any howls
https://securelist.com/goldenjackal-apt-group/109677/
https://securelist.com/goldenjackal-apt-group/109677/
Securelist
Meet the GoldenJackal APT group. Don’t expect any howls
GoldenJackal is an APT group, active since 2019, that usually targets government and diplomatic entities in the Middle East and South Asia. The main feature of this group is a specific toolset of .NET malware, JackalControl, JackalWorm, JackalSteal, JackalPerInfo…
/ WINTAPIX: A New Kernel Driver Targeting Countries in The Middle East
https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries
https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries
Fortinet Blog
WINTAPIX: A New Kernel Driver Targeting Countries in The Middle East
A detailed analysis of a driver named WinTapix that uses Donut open-source payload to inject its shellcode that appears to be primarily targeting countries in the Middle East.…
/ MikroTik received information about a new vulnerability, which is assigned the ID CVE-2023-32154
What this issue affects: The issue affects devices running MikroTik RouterOS versions v6.xx and v7.xx with enabled IPv6 advertisement receiver functionality:
https://blog.mikrotik.com/security/cve-2023-32154.html
What this issue affects: The issue affects devices running MikroTik RouterOS versions v6.xx and v7.xx with enabled IPv6 advertisement receiver functionality:
https://blog.mikrotik.com/security/cve-2023-32154.html
Mikrotik
MikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider range of users.
/ New vulnerability in popular OAuth framework, used in hundreds of online services
https://salt.security/blog/a-new-oauth-vulnerability-that-may-impact-hundreds-of-online-services
https://salt.security/blog/a-new-oauth-vulnerability-that-may-impact-hundreds-of-online-services
salt.security
New OAuth Vulnerability Impacts Hundreds of Online Services
OAuth vulnerability earns CVE-2023-28131. Salt exposes a new vulnerability in the popular OAuth framework, used in hundreds of online services.
/ Analysis of Amadey Bot Infrastructure Using Shodan
Here you'll see how to use a known c2 to craft additional queries based on html content and certificate information. In total, 12 unique servers will be identified:
https://embee-research.ghost.io/amadey-bot-infrastructure/
Here you'll see how to use a known c2 to craft additional queries based on html content and certificate information. In total, 12 unique servers will be identified:
https://embee-research.ghost.io/amadey-bot-infrastructure/
Embee Research
Shodan Query Guide - How To Track Amadey Bot Infrastructure With TLS Certificates and Russian Profanity
Identifying Amadey Bot Servers Using Shodan.
/ Technical Analysis of Pikabot
Peeking into the malware backdoor. Pikabot is a malicious backdoor that has been active since early 2023. The malware is modular with a loader and a core component that implements the majority of the functionality:
https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot
Peeking into the malware backdoor. Pikabot is a malicious backdoor that has been active since early 2023. The malware is modular with a loader and a core component that implements the majority of the functionality:
https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot
Zscaler
Pikabot | ThreatLabz
Pikabot is a modular backdoor capable of delivering second-stage payloads that shares similarities with Qakbot.
Открытый практикум DevOps by Rebrain: Шифрование секретов в GitOps
• 30 Мая (Вторник), 19:00 по МСК. Детали
Программа:
• Где хранить секреты - git, vault или облачный сервис?
• Разбираемся с dek, kek и kms
• Изучаем схему работы sops, sealed secrets
• Если успеем, то затронем варианты реализации kubernetes authentication в vault и external secrets
Ведет:
Василий Озеров - Руководит международной командой в рамках своего агентства Fevlake. Co-Founder REBRAIN. Более 8 лет Devops практик.
P.S. Зарегистрировавшимся запись практикума "DevOps by Rebrain" в подарок
• 30 Мая (Вторник), 19:00 по МСК. Детали
Программа:
• Где хранить секреты - git, vault или облачный сервис?
• Разбираемся с dek, kek и kms
• Изучаем схему работы sops, sealed secrets
• Если успеем, то затронем варианты реализации kubernetes authentication в vault и external secrets
Ведет:
Василий Озеров - Руководит международной командой в рамках своего агентства Fevlake. Co-Founder REBRAIN. Более 8 лет Devops практик.
P.S. Зарегистрировавшимся запись практикума "DevOps by Rebrain" в подарок
Vulnerability (CVE-2023-2868) in Barracuda Email Security Gateway appliance (ESG)
— https://status.barracuda.com/incidents/34kx82j5n4q9
— https://status.barracuda.com/incidents/34kx82j5n4q9
Barracuda
Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) on May 19, 2023.
Barracuda Networks's Status Page - Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) on May 19, 2023..
Free VPN Data Breach Exposed 360 Million Records Online
— https://www.vpnmentor.com/news/report-super-vpn-breach/
— https://www.vpnmentor.com/news/report-super-vpn-breach/
vpnMentor
Free VPN Data Breach Exposed 360 Million Records Online. Why Using the Right VPN Matters!
Cybersecurity security researcher Jeremiah Fowler discovered and reported to vpnMentor a non-password protected database containing over 360 million records related to a VPN data
/ OpenBLD.net DNS Mitigated Influence from new Microsoft Encrypted Restricted Permission Messages Deliver Phishing
New phishing company:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/microsoft-encrypted-restricted-permission-messages-deliver-phishing/
New phishing company:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/microsoft-encrypted-restricted-permission-messages-deliver-phishing/
Trustwave
Microsoft Encrypted Restricted Permission Messages Deliver Phishing | Trustwave
Over the past few days, we have seen phishing attacks that use a combination of compromised Microsoft 365 accounts and .rpmsg encrypted emails to deliver the phishing message.
/ Zyxel security advisory for multiple buffer overflow vulnerabilities of firewalls
…buffer overflow vulnerability in the notification function in some firewall versions could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device:
— https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls
…buffer overflow vulnerability in the notification function in some firewall versions could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device:
— https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls
Zyxel
Zyxel security advisory for multiple buffer overflow vulnerabilities of firewalls | Zyxel Networks
CVEs: CVE-2023-33009, CVE-2023-33010 Summary Zyxel has released patches for firewalls affected by multiple buffer overflow vulnerabilities. Users are advised to install them for optimal protection. What are the vulnerabilities? CVE-2023-33009 A buffer overflow…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Free (9) short cources from GitLab
— GitLab 101. 1h - https://levelup.gitlab.com/courses/gitlab101
— GitLab 201. 1h - https://levelup.gitlab.com/courses/gitlab-201-certification
— GitLab CI/CD. 3h - https://levelup.gitlab.com/courses/continuous-integration-and-delivery-ci-cd-with-gitlab
— GitLab Security Essentials. 4 1/2h - https://levelup.gitlab.com/courses/security-essentials
— GitLab Technical Writing Fundamentals. 3h - https://levelup.gitlab.com/courses/gitlab-technical-writing-fundamentals
— GitLab with Git Essentials. 4h - https://levelup.gitlab.com/courses/gitlab-with-git-essentials
— GitLab Agile Project Management. 2 ½hours - https://levelup.gitlab.com/courses/gitlab-agile-project-management
— Remote Foundations Certification. 2h - https://levelup.gitlab.com/courses/remote-foundations
— TeamOps. 1-2h - https://levelup.gitlab.com/courses/teamops
— GitLab 101. 1h - https://levelup.gitlab.com/courses/gitlab101
— GitLab 201. 1h - https://levelup.gitlab.com/courses/gitlab-201-certification
— GitLab CI/CD. 3h - https://levelup.gitlab.com/courses/continuous-integration-and-delivery-ci-cd-with-gitlab
— GitLab Security Essentials. 4 1/2h - https://levelup.gitlab.com/courses/security-essentials
— GitLab Technical Writing Fundamentals. 3h - https://levelup.gitlab.com/courses/gitlab-technical-writing-fundamentals
— GitLab with Git Essentials. 4h - https://levelup.gitlab.com/courses/gitlab-with-git-essentials
— GitLab Agile Project Management. 2 ½hours - https://levelup.gitlab.com/courses/gitlab-agile-project-management
— Remote Foundations Certification. 2h - https://levelup.gitlab.com/courses/remote-foundations
— TeamOps. 1-2h - https://levelup.gitlab.com/courses/teamops
Edcast
Gitlab
LevelUp is GitLab's integrated talent enablement solution.
В проекте OpenBLD.net DNS запущен режим OpenBLD+
Проект живет благодаря поддержке пользователей, сегодня есть возможность оформить подписку за 3$+, в замен получить:
• Персональную поддержку, помощь в расследовании Cybersecurity инцидентов
• Hardening, AppSec консультации, +консультации по SEO оптимизации Вашего сайта
• Улучшенная скорость доставки Вашего сайта/Домена пользователям OpenBLD.net DNS
• Лого компании или никнейм на сайте проекта со ссылкой на сайт или соц. профиль
• Unlimited доступ для выделенных IP
• Есть вопросы / предложения - welcome @sysadminkz
*en* - OpenBLD+ Benefits
*ru* - Что дает OpenBLD+
Проект живет благодаря поддержке пользователей, сегодня есть возможность оформить подписку за 3$+, в замен получить:
• Персональную поддержку, помощь в расследовании Cybersecurity инцидентов
• Hardening, AppSec консультации, +консультации по SEO оптимизации Вашего сайта
• Улучшенная скорость доставки Вашего сайта/Домена пользователям OpenBLD.net DNS
• Лого компании или никнейм на сайте проекта со ссылкой на сайт или соц. профиль
• Unlimited доступ для выделенных IP
• Есть вопросы / предложения - welcome @sysadminkz
*en* - OpenBLD+ Benefits
*ru* - Что дает OpenBLD+
Sys-Admin InfoSec pinned «В проекте OpenBLD.net DNS запущен режим OpenBLD+ Проект живет благодаря поддержке пользователей, сегодня есть возможность оформить подписку за 3$+, в замен получить: • Персональную поддержку, помощь в расследовании Cybersecurity инцидентов • Hardening…»
/ DogeRAT: The Android Malware Campaign Targeting Users Across Multiple Industries
masked on Youtube Premium, Zetflix, Standoff 2, private chat apps..
..deep dive into the operation of the DogeRAT malware campaign and provide tips on how to protect yourself from this threat:
https://cloudsek.com/blog/dogerat-the-android-malware-campaign-targeting-users-across-multiple-industries
masked on Youtube Premium, Zetflix, Standoff 2, private chat apps..
..deep dive into the operation of the DogeRAT malware campaign and provide tips on how to protect yourself from this threat:
https://cloudsek.com/blog/dogerat-the-android-malware-campaign-targeting-users-across-multiple-industries
Cloudsek
DogeRAT: The Android Malware Campaign Targeting Users Across Multiple Industries | CloudSEK
CloudSEK’s TRIAD team discovered yet another open-source Android malware called DogeRAT (Remote Access Trojan), targeting a large customer base across multiple industries, especially Banking and Entertainment. Although the majority of this campaign targeted…
/ New macOS vulnerability, Migraine, could bypass System Integrity Protection
https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/
https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/
Microsoft News
New macOS vulnerability, Migraine, could bypass System Integrity Protection
A new vulnerability could allow an attacker with root access to bypass SIP in macOS and perform arbitrary operations on a device.
/ Are your files securely stored at Google Drive and Docs?
Investigation with google docs analysys, dorking examples:
— https://ad14.gitbook.io/ad14s-blog/
Investigation with google docs analysys, dorking examples:
— https://ad14.gitbook.io/ad14s-blog/
ad14.gitbook.io
Are your files securely stored at Google Drive and Docs? | AD14's Blog
Google Drive and Docs are popular cloud storage and productivity services that allow users to store and share files online. But are your files securely stored when you use these services?
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Supply Chain Risk From Gigabyte App Center Backdoor
Recently, the Eclypsium platform began detecting suspected backdoor-like behavior within Gigabyte systems in the wild.
..analysis discovered that firmware in Gigabyte systems is dropping and executing a Windows native executable during the system startup process, and this executable then downloads and executes additional payloads insecurely. It uses the same techniques as other OEM backdoor-like features like Computrace backdoor (a.k.a. LoJack DoubleAgent)..:
https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/
Recently, the Eclypsium platform began detecting suspected backdoor-like behavior within Gigabyte systems in the wild.
..analysis discovered that firmware in Gigabyte systems is dropping and executing a Windows native executable during the system startup process, and this executable then downloads and executes additional payloads insecurely. It uses the same techniques as other OEM backdoor-like features like Computrace backdoor (a.k.a. LoJack DoubleAgent)..:
https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/
Eclypsium | Supply Chain Security for the Modern Enterprise
Supply Chain Risk from Gigabyte App Center Backdoor
Eclypsium Research discovers that Gigabyte motherboards have an embedded backdoor in their firmware, which drops a Windows executable that can download and execute additional payloads insecurely. The backdoor affects gaming PCs and high-end computers.
Открытые практикумы DevOps, Linux, Networks, Golang by Rebrain (расписание, Июнь 2023)
Бесплатные практикумы на всевозможные IT темы. Основное — Kubernetes, Docker, Ansible, Gitlab CI, Linux, Kafka , MySQL, Golang и др. Работа в консоли, разбор реальных кейсов на практике:
• 6 июня DevOps: SQL: Введение в использование JOIN (Виктор Щупоченко - DevOps-engineer)
• 7 июня Linux: OpenVPN (Даниил Батурин - Основатель проекта VyOS)
• 8 июня Golang: Design patterns в GO (Егор Гришечко - Software engineer в Uber)
• 13 июня DevOps: Configuration drift - управляем конфигурацией приложений
• 14 июня Linux: С Windows на Linux (Андрей Буранов - Специалист по UNIX-системам VK)
• 15 июня Networks: OSPF Loop Prevention (Дмитрий Радчук - Team Lead Вконтакте)
• 20 июня DevOps: Система Percona Motoring and Management в Docker
• 21 июня Linux: Как контролировать ресурсы (Андрей Буранов)
• 22 июня Networks: Основы построения Wi-Fi сетей (Ольга Яновская - Руководитель направления Networks by Rebrain)
• 27 июня DevOps by Rebrain (Василий Озеров - Co-Founder REBRAIN/Fevlake)
• 28 июня Linux: Пользователи Linux (Андрей Буранов)
• 29 июня Networks: Дизайн multi-area OSPF (Дмитрий Радчук)
Подключиться можно Здесь
Бесплатные практикумы на всевозможные IT темы. Основное — Kubernetes, Docker, Ansible, Gitlab CI, Linux, Kafka , MySQL, Golang и др. Работа в консоли, разбор реальных кейсов на практике:
• 6 июня DevOps: SQL: Введение в использование JOIN (Виктор Щупоченко - DevOps-engineer)
• 7 июня Linux: OpenVPN (Даниил Батурин - Основатель проекта VyOS)
• 8 июня Golang: Design patterns в GO (Егор Гришечко - Software engineer в Uber)
• 13 июня DevOps: Configuration drift - управляем конфигурацией приложений
• 14 июня Linux: С Windows на Linux (Андрей Буранов - Специалист по UNIX-системам VK)
• 15 июня Networks: OSPF Loop Prevention (Дмитрий Радчук - Team Lead Вконтакте)
• 20 июня DevOps: Система Percona Motoring and Management в Docker
• 21 июня Linux: Как контролировать ресурсы (Андрей Буранов)
• 22 июня Networks: Основы построения Wi-Fi сетей (Ольга Яновская - Руководитель направления Networks by Rebrain)
• 27 июня DevOps by Rebrain (Василий Озеров - Co-Founder REBRAIN/Fevlake)
• 28 июня Linux: Пользователи Linux (Андрей Буранов)
• 29 июня Networks: Дизайн multi-area OSPF (Дмитрий Радчук)
Подключиться можно Здесь
/ Multi-stage attack chain uses PowerShell downloader and DLL sideloading
New Horabot campaign targets Gmail, Yahoo, Outlook mailboxes.. exfiltrate contacts’ email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim’s mailbox:
https://blog.talosintelligence.com/new-horabot-targets-americas/
New Horabot campaign targets Gmail, Yahoo, Outlook mailboxes.. exfiltrate contacts’ email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim’s mailbox:
https://blog.talosintelligence.com/new-horabot-targets-americas/
Cisco Talos Blog
New Horabot campaign targets the Americas
Cisco Talos has observed a threat actor deploying a previously unidentified botnet program Talos is calling “Horabot,” which delivers a known banking trojan and spam tool onto victim machines in a campaign that has been ongoing since at least November 2020.