Free Spins and Coins for Coin Master: Your Daily Dose

https://undercodenews.com/free-spins-and-coins-for-coin-master-your-daily-dose/

@Undercode_News

#Airbnb Host's Plea Sparks Debate: Is It Too Much to Ask for Respect?

https://undercodenews.com/airbnb-hosts-plea-sparks-debate-is-it-too-much-to-ask-for-respect/

@Undercode_News

Israel's Tech Titans: A Year of Record-Breaking Funding Rounds

https://undercodenews.com/israels-tech-titans-a-year-of-record-breaking-funding-rounds/

@Undercode_News

The OmniBook Ultra Flip 14: A Worthy Successor to the Spectre x360

https://undercodenews.com/the-omnibook-ultra-flip-14-a-worthy-successor-to-the-spectre-x360/

@Undercode_News

#Netflix Fined €475 Million for Privacy Violations

https://undercodenews.com/netflix-fined-eur475-million-for-privacy-violations/

@Undercode_News

🚨 #Ransomware Threat Looms Large: Funksec Targets US Sectors

https://undercodenews.com/ransomware-threat-looms-large-funksec-targets-us-sectors/

@Undercode_News

🌐 Emerging #Ransomware Group Funksec Targets Chilean Website

https://undercodenews.com/emerging-ransomware-group-funksec-targets-chilean-website/

@Undercode_News

⚡️ New #Ransomware Attack: Funksec Targets Brazilian Engineering Institution

https://undercodenews.com/new-ransomware-attack-funksec-targets-brazilian-engineering-institution/

@Undercode_News

🛡️ Securing the Cloud: CISA Mandates Stricter Federal Cybersecurity

https://undercodenews.com/securing-the-cloud-cisa-mandates-stricter-federal-cybersecurity/

@Undercode_News

📱 #Apple Seeks Chinese #AI Partners: #Tencent and #Bytedance in the Spotlight

https://undercodenews.com/apple-seeks-chinese-ai-partners-tencent-and-bytedance-in-the-spotlight/

@Undercode_News

🎤 The Memo-First Meeting Revolution: A Deep Dive

https://undercodenews.com/the-memo-first-meeting-revolution-a-deep-dive/

@Undercode_News

🛠️ Urgent Patch Required! Fortinet Warns of Critical Vulnerabilities in FortiWLM and FortiManager

https://undercodenews.com/urgent-patch-required-fortinet-warns-of-critical-vulnerabilities-in-fortiwlm-and-fortimanager/

@Undercode_News

🦑𝐄𝐥𝐞𝐯𝐚𝐭𝐞 𝐘𝐨𝐮𝐫 𝐓𝐞𝐜𝐡 𝐉𝐨𝐮𝐫𝐧𝐞𝐲: 𝐄𝐬𝐬𝐞𝐧𝐭𝐢𝐚𝐥 𝐑𝐞𝐬𝐨𝐮𝐫𝐜𝐞𝐬 𝐟𝐨𝐫 𝐆𝐫𝐨𝐰𝐭𝐡 𝐚𝐧𝐝 𝐂𝐞𝐫𝐭𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐒𝐮𝐜𝐜𝐞𝐬𝐬
Whether you’re looking to break into tech, grow your expertise, or prepare for certifications, use these resources to help you level up:

🎯 Microsoft Learn: https://lnkd.in/ge973G3j
Explore interactive, self-paced modules on Azure, Microsoft 365, Power Platform, and more.

🎯 Microsoft Virtual Training Days: https://lnkd.in/g2B_2Yq3
Free, instructor-led events with opportunities to earn free certification exam vouchers!

🎯 GitHub Learning Lab: https://lab.github.com/
Dive into Git basics, open-source contributions, and DevOps workflows.

🎯 Microsoft Educator Center: https://lnkd.in/gFcX5xdm
Focused on education technology, this resource is excellent for educators learning Teams and Office 365 tools.

🎯 Azure DevOps Labs: https://lnkd.in/gi4uekjB
Get practical experience with CI/CD pipelines, infrastructure as code, and governance—all for free!

🎯 AI for Good & Responsible AI Training: https://lnkd.in/gtXfexiY
Learn about cutting-edge AI applications and ethical AI practices.

Ref: Mohamad Hamadi
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑𝐇𝐨𝐰 𝐀𝐭𝐭𝐚𝐜𝐤𝐞𝐫𝐬 𝐇𝐚𝐜𝐤 𝐂𝐈/𝐂𝐃 𝐏𝐢𝐩𝐞𝐥𝐢𝐧𝐞𝐬 👇

I recently watched one of DEFCON's talk of this year "Your CI CD Pipeline Is Vulnerable, But It's Not Your Fault" by Elad Pticha, Oreen Livni and was really impressed by the attack vector (link in comments)

𝐋𝐞𝐭'𝐬 𝐬𝐞𝐞 𝐡𝐨𝐰 𝐢𝐭 𝐰𝐨𝐫𝐤𝐬

Github workflows are part of the CI/CD (Continous Integration/Continous Deployment) ecosystem that lets developers automate their workflow

For example: once a commit is made to the repo -> the code is scanned with a tool -> if the tests pass -> code is pushed to test/production

Now the interesting part is that (if the repo maintainer uses input that you control) inside the workflow, this can lead to command injection in the pipeline

𝐖𝐡𝐢𝐜𝐡 𝐦𝐞𝐚𝐧𝐬 𝐲𝐨𝐮 𝐦𝐚𝐲 𝐛𝐞 𝐚𝐛𝐥𝐞 𝐭𝐨 𝐭𝐚𝐤𝐞 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐫𝐞𝐩𝐨

In the example bellow, the pipeline uses the title of an issue as part of a bash echo command

That means anyone can create a issue named $(𝐰𝐡𝐨𝐚𝐦𝐢) and execute commands in the CI/CD

If you can do that -> you can abuse the command injection to steal the repo's Github token, read secrets or push malicious code

Ref: Andrei Agape
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

💻 #AMD's RX 7900 GRE: A Short-Lived Graphics Card Champion

https://undercodenews.com/amds-rx-7900-gre-a-short-lived-graphics-card-champion/

@Undercode_News

Pornhub to Exit Florida Due to Strict Age Verification Laws

https://undercodenews.com/pornhub-to-exit-florida-due-to-strict-age-verification-laws/

@Undercode_News

Generalist Advantage: Why a Broad Perspective Trumps Specialization

https://undercodenews.com/generalist-advantage-why-a-broad-perspective-trumps-specialization/

@Undercode_News

🎮 Alienware m16 RTX 4070 #Gaming #Laptop: A Black Friday Deal Worth Recapturing

https://undercodenews.com/alienware-m16-rtx-4070-gaming-laptop-a-black-friday-deal-worth-recapturing/

@Undercode_News