Calm before the storm. Back to training our most popular courses at Blackhat USA today

There's way too much negativity on the interwebz. Which is why I have decided that I am going to thank tools (and their creators) that I have found useful and used during the week * instructor by @jxnlco * @ExaAILabs * Microsoft Sentinel - Great product * @pipedream

Our "Rapid Threat Modeling with GenAI and LLMs" bootcamp last week was a great success! This is a testimonial from one of our participants. Exceedingly grateful for such high praise

Earlier "Secure Coding Training" used to mean - Secure coding - backend - Secure coding - front-end Now it means: - Secure coding - backend - Secure coding - frontend - Securing Kubernetes and Manifests - Securing Cloud & IaC - Securing Secrets - Securing CI/CD

What are the native tools for AWS Security Incident Response? Training a class on Cloud Security Incident Response for a $BIGBANK next week and it's full of our Attack-Detect-Defense labs on the cloud with a focus on detection. Thought I'd share this with all of you

“You can never enjoy the weekend” It seems as though we can never enjoy weekends in cyber security. There’s always a fire. And always on a weekend. This time, it’s (I am guessing) one of the largest supply-chain exploits I’ve come across in a long time. Gather round. Let’s break this down. Xz-utils is a very popular library that is used to perform lossless compression. This library is used to compress release tarballs, packages, kernel images, etc. The library is in use extensively across the internet. The code is hosted on Github and is OSS. This library was backdoored and the backdoor was discovered and reported by a developed on March 29 2024. The backdoor has a massive impact already. It it triggered when remote systems connect to publish SSH services. 🤯 This activates when the connections are created, creating performance issues. Basically, if you’re running SSH, you’re vulnerable because of this. Also - to add insult to injury. The current “known” trigger for this is SSH, but there may be other events where the backdoor is triggered. The story is interesting, to say the least. A dev named Jia Tan becomes a contributor to this project around 2.5 years ago. Another user named Jigar Kumar starts to prod the original maintainer Lasse Collin to allow Jia Tan to become a maintainer. Jia Tan becomes maintainer and creates the 5.6.0 and 5.6.1 release tarballs, which are the ones that are backdoored. A careful dev named Andres Freund identified the backdoor and publishes it on open wall. He finds it because his SSH connections take 500 ms more than the usual time (mind blowing observation). So he fires up valgrind and identifies the obfuscated backdoor that executes on the SSH connection activating. The tarballs are integrated into popular distros like Debian, etc. If you’ve read this till now. Know this. This is a very serious issue and has massive implications to security of Linux servers hosted all over the Internet. If you’re running: * a Distro that uses glibc * And have versions of 5.6.0 or 5.6.1 of liblzma. This happens if you’re running a rolling release or updating religiously (irony, I know) * If you’re running a container with the above parameters + using that for SSH (there may be other triggers, but SSH is known) If you meet these conditions (above) update right now to a version that is not affected by this (5.6.0, 5.6.1) The exploit payload is known to cause authentication bypass, although reasons for it have not yet been fully discovered at the time of me writing this. Andres Freund suggests that there may be some other way of remote code execution.

👀 SSO and SCIM for Enterprises now available on @AppSecEngineer User Provisioning, Deprovisioning and Management is a breeze for your org, no matter how large

@kubernetesio security protip Sometimes the service account token needs to be available inside a pod. Use Token Projections to limit the duration, add aud claims, etc. Kubelet automatically handles token refresh. You are protected against a non-expiring token getting pwned!