#HashiCorp's Boundary 0.16 is here with an update that simplifies connecting to target infrastructure, has better search and filtering, and adds MinIO compatibility.
🛡️ Researchers uncover details of 3 vulnerabilities in #Azure HDInsight's Apache Hadoop, Kafka, and Spark services that could have allowed attackers root access and system disruption.
⚠️ A major risk when using customer-managed KMS keys is that someone deletes the key, and thus, all data is encrypted with the key. How to mitigate the risk?
1️⃣ AWS does not allow to delete keys immediately but enforces a waiting period of 7 to 30 days.
2️⃣ Customers use key policies, IAM policies, or SCPs to restrict access to the kms:ScheduleKeyDeletion action.
But there is another risk of losing access to a key: modifying the key policy. (1/2)
CloudFox v.1.13.0 is out with 2 new AWS commands and a bunch of updates.
The new workloads command looks at EC2, Lambda, and ECS and highlights any workload that has an admin role attached, as well as any role that can privesc to admin!
The new api-gws command contributed by Wyatt Dahlenburg finds all API gw endpoints and crafts custom curl commands for you with any API keys found in the endpoint metadata)
The env-vars command has been upgraded to help you find secrets stored in environment variables. It highlights interesting variable names and creates a separate output file with just the interesting items.
The role-trusts command has been upgraded to help you find overly permissive role trusts, particularly those that trust :root, without an ExternalID.
Are you interested in the world of #cloudhacking and #cloudsecurity? Then you don’t want to miss this recap of a recent Cloud Security Podcast episode featuring Bishop Fox’s @sethsec where he touches upon #AWS#pentesting, why cloud configuration reviews just don’t cut it sometimes, and more.
(Cloud)Fox spotted in the wild at Wild West Hackin' Fest! Thanks for the shoutout, Beau Bullock.
We recently celebrated the 1-year anniversary of CloudFox; check out some of the milestone updates since original publication in this recap. https://bfx.social/48VUKVR
According to our #offensivesecurity study with #PonemonInstitute, #RedTeaming is the 2nd most effective offensive security testing strategy, right behind #cloudsecurity testing. This trend is set to continue, and smart companies are taking notice.