Tessera
Folgen

Seth Art

@sethsec.bsky.social

Security Research and Advocacy @ Datadog. Former Principal and Cloud Penetration Testing lead @BishopFox. I like to build, break, learn, and share. 
CloudFox, CloudFoxable, BadPods, IAM Vulnerable

9 Posts614 Follower112 Folgt
Datadog Security Labs@securitylabs.datadoghq.com · last yr.

The July edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... • Cloud image investigator by @sethsec.bsky.social • Our top picks for Black Hat / DEF CON • A benchmark for LLM coding accuracy and security • Malicious Homebrew installation campaign .. and more

Preparing for Hacker Summer Camp and a new cloud image investigator | Datadog Security Labs

This month’s digest covers Hacker Summer Camp prep, a new cloud image investigator, and supply-chain vulnerabilities associated with the Open VSX Registry.

securitylabs.datadoghq.com

Matt J@mhjwork.bsky.social · last yr.

When I first started reading this I though,t “is this really news, this issue has been around for years…” but then it gets interesting - kudos to the researchers on this one!

Seth Art@sethsec.bsky.social · last yr.

I’m excited to share our research on the “whoAMI” attack. We discovered that AWS customers pulling AMI IDs insecurely could accidentally use malicious images instead of the legitimate ones— leading to remote code execution. securitylabs.datadoghq.com/articles/who...

Nick Frichette@frichetten.com · last yr.

Need to hack thousands of AWS customers? What about on internal AWS systems? Datadog Security Research found that a number of tools, including one published by AWS, are susceptible to name confusion attacks, leading to RCE in vulnerable environments! securitylabs.datadoghq.com/articles/who...

whoAMI: A cloud image name confusion attack | Datadog Security Labs

Detailing the discovery and impact of the whoAMI cloud image name confusion attack, which could allow attackers to execute code within AWS accounts due to a vulnerable pattern in AMI retrieval.

securitylabs.datadoghq.com

Seth Art@sethsec.bsky.social · last yr.

I’m excited to share our research on the “whoAMI” attack. We discovered that AWS customers pulling AMI IDs insecurely could accidentally use malicious images instead of the legitimate ones— leading to remote code execution. securitylabs.datadoghq.com/articles/who...

whoAMI: A cloud image name confusion attack | Datadog Security Labs

Detailing the discovery and impact of the whoAMI cloud image name confusion attack, which could allow attackers to execute code within AWS accounts due to a vulnerable pattern in AMI retrieval.

securitylabs.datadoghq.com

Datadog Security Labs@securitylabs.datadoghq.com · last yr.

We discovered a pattern in the way many projects retrieve Amazon Machine Images (AMIs), allowing attackers to publish AMIs with specially crafted names and gain code execution within vulnerable accounts. securitylabs.datadoghq.com/articles/who... by @sethsec.bsky.social

whoAMI: A cloud image name confusion attack | Datadog Security Labs

Detailing the discovery and impact of the whoAMI cloud image name confusion attack, which could allow attackers to execute code within AWS accounts due to a vulnerable pattern in AMI retrieval.

securitylabs.datadoghq.com

Jared Short@jaredshort.com · 2y ago

I'm not saying I'm an AWS expert… but I am saying I finally tracked down the random AWS account charging me small amounts every month and closed it.

Nicolas Grégoire@agarri.fr · 2y ago

Plenty of additional information about the compromise of OpenWRT’s online build service, involving command-injection and hash bypass 🧠

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...

flatt.tech

stacksmashing@stacksmashing.bsky.social · 2y ago

Stop. Truncating. Hashes. www.phoronix.com/news/OpenWrt...

2. **Truncated SHA-256 Hash Collisions**: The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious image can be served in place of a legitimate one, allowing the attacker to "poison" the artifact cache and deliver compromised images to unsuspecting users.
Datadog Security Labs@securitylabs.datadoghq.com · 2y ago

Introducing Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages securitylabs.datadoghq.com/articles/int... by @ikretz.bsky.social New open-source tool designed to transparently block known malicious PyPI and npm packages. github.com/DataDog/supp...

Introducing Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages | Datadog Security Labs

Release of Supply-Chain Firewall, an open source tool for preventing the installation of malicious PyPI and npm packages

securitylabs.datadoghq.com

Seth Art@sethsec.bsky.social · 2y ago

The November edition of the Datadog Security Digest is live! securitylabs.datadoghq.com/newsletters/... Featuring: - Exploring Google Cloud default service accounts: deep dive and real-world adoption trends by Christophe Tafani-Dereeper 🧵(1/3)

Google Cloud Trends, DPRK npm Threats, & Privilege Escalation Walkthroughs | Datadog Security Labs

In the November edition, read about Google Cloud Trends, DPRK npm Threats, & Privilege Escalation Walkthroughs, and more.

securitylabs.datadoghq.com

Dominic White@singe.bsky.social · 2y ago

This is such a good story about how "gotofail" started as a drunken brag in a bar and ended up being disclosed to Apple via a burner phone. It was Ryan all along, finally taking credit after all these years!

Ryan Castellucci 🜬@rya.nc · 2y ago

Oh, I never posted my gotofail story on here. Early 2014, someone came to me about a catastrophic vulnerability in Apple's TLS implementation. I shit you not, they'd overheard someone at a bar drunkenly bragging about how they were going to sell it to a FVEY intelligence agency for six figures.