#security (2019-11)

Archive: https://archive.sweetops.com/security/

2019-11-22

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Introducing Flan Scan: Cloudflare’s Lightweight Network Vulnerability Scanner attachment image

Flan Scan is a thin wrapper around Nmap that converts this popular open source tool into a vulnerability scanner with an easy deployment.

:--1:2

2019-11-20

Maciek Strömich avatar
Maciek Strömich
Docker Patched the Most Severe Copy Vulnerability to Date With CVE-2019-14271 attachment image

Unit 42 researchers share details on a severe Docker container breakout vulnerability and outline a proof-of-concept that demonstrates how it can be exploited if a container has been compromised by a previous attack.

2019-11-19

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
How Attackers Could Hijack Your Android Camera to Spy on You attachment image

The application security testing world is made up of various different solutions, all with one ultimate aim – to protect software from hackers and attacks.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Google Confirms Android Camera Security Threat: ‘Hundreds Of Millions’ Of Users Affected attachment image

Vulnerabilities in the Google Camera app left hackers able to take photos, and silently record audio and video, even when the phone was locked.

endofcake avatar
endofcake
Introducing Nebula, the open source global overlay network from Slack attachment image

Introducing Nebula, an open source scalable overlay networking tool with a focus on performance, simplicity and security.

2019-11-18

2019-11-13

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
A new security flaw hits Intel’s Cascade Lake chips – TechCrunch attachment image

Time to reset your “days since last major chip vulnerability” counter back to zero. Security researchers have found another flaw in Intel processors — this time it’s a new variant of the Zombieload attack they discovered earlier this year, but targeting Intel’s latest family…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

chrism avatar
chrism

one way to pay for the processing time of hashing

2019-11-12

chrism avatar
chrism

We run it nightly; its pretty handy.

lvh avatar

Yeah prowlers’ best, we also run ScoutSuite. Prowler does a better job of mapping to controls.

:--1:2

2019-11-11

davidvasandani avatar
davidvasandani

Has https://github.com/toniblyx/prowler come up in this channel before? Has anyone tried it?

toniblyx/prowler

AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool. It follows guidelines of the CIS Amazon Web Services Foundations Benchmark and DOZENS of additional checks …

btai avatar

@davidvasandani just used it for my soc2 audit

davidvasandani avatar
davidvasandani

Whoa! How’d it go?

btai avatar

@davidvasandani @Erik Osterman (Cloud Posse) prowler is a decent tool. we were asked to use it for our soc2 audit. It’s definitely not a super robust tool, but it does the job. We had a couple use cases where we had false negatives. The tool just greps for “true” and we had a client with the word “true” in it’s name where we got some false negatives on. Also after doing key rotations, we ended up with a ton of fails because the keys hadn’t been used yet (because we had just finished our key rotations!)

:--1:1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Looks amazing. Thanks for sharing.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@lvh

2019-11-06

Maciek Strömich avatar
Maciek Strömich

update your chromes/chromium based browser asap

imiltchman avatar
imiltchman

PSA Major vulnerability in SimpleSamlPHP/XMLSecLibs XML signature validation, if anyone uses it

:--1:1
    keyboard_arrow_up