Hacking Articles Tips Tricks Videos Tutorials
escaped from a container. He chose to focus on the current scenario: An escape from a Windows cluster node in Kubernetes that would allow an attacker to gain access outside the node and spread into the cluster. https://media.threatpost.com/wp-content/upl…
etes clusters to develop and test code, a breach “can lead to devastating software supply chain attacks,” he said.
In Monday’s post, he explained that compromising an entire cluster is much more severe than compromising an individual container, given that “a cluster could run multiple cloud applications whereas an individual container usually runs a single cloud application.”
He noted that Siloscape isn’t like most cloud malware, which typically focuses on resource hijacking for things like cryptomining and DoS. Siloscape, on the other hand, “doesn’t limit itself to any specific goal,” Prizmant said. “Instead, it opens a backdoor to all kinds of malicious activities.” Recent Supply-Chain & Kubernetes AttacksSupply-chain attacks similar to what Prizmant warned about have been linked to spyware installation, Operation SignSight, the compromise of Able Desktop, airline breaches, and the supply-chain whopper of them all: the SolarWinds breach of the U.S. government.
As far as other Kubernetes catastrophes go, a few recent headlines include an April 2021 security bug that allowed attackers to brick Kubernetes clusters: A vulnerability in one of the Go libraries that Kubernetes is based on that could lead to denial of service (DoS) for the CRI-O and Podman container engines. Earlier in April, an organized, self-propagating cryptomining campaign was uncovered that targeted misconfigured open Docker Daemon API ports. Thousands of container-compromise attempts were being observed every day related to the campaign.
Also in April, Microsoft’s cloud-container technology, Azure Functions, was found to harbor a weakness that allows attackers to directly write to files, researchers said. A few months earlier, in February 2021, a new malware was hjacking Kubernetes clusters to cryptomine Monero.
Another example of why cloud infrastructure needs strong security, a simple Docker container honeypot was used for four different criminal campaigns in the span of 24 hours, in a recent lab test. Having Your Cloud Cake & Eating It, TooTrevor Morgan, product manager with enterprise data security firm comforte AG, thinks that Siloscape is the kind of threat that can make organizations nervous about adopting cloud. “Enterprises adopt cloud native strategies because they want to accelerate their ability to innovate. Unfortunately, most organizations struggle with the right level of data security to avoid compromise with cloud native application architectures,” he told Threatpost via email on Monday.
“Malware like Siloscape complicates this endeavor by striking at the core of containerization and creates real hesitation on the part of cloud native development efforts, threatening to slow down these processes and defeat the very agility these organizations seek,” he pointed out. “Malware threats set up a false choice between being nimble and being cautious and secure with sensitive data.”
Morgan suggested that data-centric security such as tokenization, built specifically for cloud native applications, “can help strike the right balance between these two,” by protecting the data itself rather than “the layered, even amorphous borders surrounding cloud native application environments.
“Organizations can be assured that data security does not impede speed and agility, because tokenized sensitive information even in containers cannot be compromised if it falls into the wrong hands,” he said. “Organizations adopting cloud native strategies can have their data security while achieving agility too.” What to DoPrizmant recommended that users follow Microsoft’s advice to not use Windows containers as a security feature. Instead, Microsoft recommends using strictly Hyper-V containers for anything that relies on containerization as a security boundary, he noted.” Any process running in Windows Server containers should be assumed to have the same privileges as admin on the host, which in this case is the Kubernete[...]
___________________________
@hacking_Attack
@Hacking_Video
In Monday’s post, he explained that compromising an entire cluster is much more severe than compromising an individual container, given that “a cluster could run multiple cloud applications whereas an individual container usually runs a single cloud application.”
He noted that Siloscape isn’t like most cloud malware, which typically focuses on resource hijacking for things like cryptomining and DoS. Siloscape, on the other hand, “doesn’t limit itself to any specific goal,” Prizmant said. “Instead, it opens a backdoor to all kinds of malicious activities.” Recent Supply-Chain & Kubernetes AttacksSupply-chain attacks similar to what Prizmant warned about have been linked to spyware installation, Operation SignSight, the compromise of Able Desktop, airline breaches, and the supply-chain whopper of them all: the SolarWinds breach of the U.S. government.
As far as other Kubernetes catastrophes go, a few recent headlines include an April 2021 security bug that allowed attackers to brick Kubernetes clusters: A vulnerability in one of the Go libraries that Kubernetes is based on that could lead to denial of service (DoS) for the CRI-O and Podman container engines. Earlier in April, an organized, self-propagating cryptomining campaign was uncovered that targeted misconfigured open Docker Daemon API ports. Thousands of container-compromise attempts were being observed every day related to the campaign.
Also in April, Microsoft’s cloud-container technology, Azure Functions, was found to harbor a weakness that allows attackers to directly write to files, researchers said. A few months earlier, in February 2021, a new malware was hjacking Kubernetes clusters to cryptomine Monero.
Another example of why cloud infrastructure needs strong security, a simple Docker container honeypot was used for four different criminal campaigns in the span of 24 hours, in a recent lab test. Having Your Cloud Cake & Eating It, TooTrevor Morgan, product manager with enterprise data security firm comforte AG, thinks that Siloscape is the kind of threat that can make organizations nervous about adopting cloud. “Enterprises adopt cloud native strategies because they want to accelerate their ability to innovate. Unfortunately, most organizations struggle with the right level of data security to avoid compromise with cloud native application architectures,” he told Threatpost via email on Monday.
“Malware like Siloscape complicates this endeavor by striking at the core of containerization and creates real hesitation on the part of cloud native development efforts, threatening to slow down these processes and defeat the very agility these organizations seek,” he pointed out. “Malware threats set up a false choice between being nimble and being cautious and secure with sensitive data.”
Morgan suggested that data-centric security such as tokenization, built specifically for cloud native applications, “can help strike the right balance between these two,” by protecting the data itself rather than “the layered, even amorphous borders surrounding cloud native application environments.
“Organizations can be assured that data security does not impede speed and agility, because tokenized sensitive information even in containers cannot be compromised if it falls into the wrong hands,” he said. “Organizations adopting cloud native strategies can have their data security while achieving agility too.” What to DoPrizmant recommended that users follow Microsoft’s advice to not use Windows containers as a security feature. Instead, Microsoft recommends using strictly Hyper-V containers for anything that relies on containerization as a security boundary, he noted.” Any process running in Windows Server containers should be assumed to have the same privileges as admin on the host, which in this case is the Kubernete[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
etes clusters to develop and test code, a breach “can lead to devastating software supply chain attacks,” he said. In Monday’s post, he explained that compromising an entire cluster is much more severe than compromising an individual container, given that…
s node. If you are running applications in Windows Server containers that need to be secured, we recommend moving these applications to Hyper-V containers,” he said.
Secure configuration of Kubernetes clusters is also crucial. “A secured Kubernetes cluster won’t be as vulnerable to this specific malware as the nodes’ privileges won’t suffice to create new deployments. In this case, Siloscape will exit,” Prizmant said.
“Siloscape shows us the importance of container security, as the malware wouldn’t be able to cause any significant damage if not for the container escape,” he wrote. “It is critical that organizations keep a well-configured and secured cloud environment to protect against such threats.”
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/1_6QWMn0DApM4jmbubKuCmNA-90x90.png GitHub’s new policies allow removal of PoC exploits used in attacks1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-2-90x90.png Google PPC Ads Used to Deliver Infostealers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-1-90x90.png Researchers Uncover Hacking Operations Targeting Government Entities in South Korea5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/ransomware-payment-90x90.jpg Cyber-Insurance Fuels Ransomware Payment Surge6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/banner-2021.2-release-90x90.png Kali Linux 2021.2 Release (Kaboxer, Kali-Tweaks, Bleeding-Edge & Privileged Ports)7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/ezgif.com-gif-maker-90x90.jpg Cyber attack hits JBS meat works in Australia, North America1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/HPE-corp-logo-1-90x90.jpg HPE Fixes Critical Zero-Day in Server Management Software1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/vmware-patch-90x90.jpg VMware Sounds Ransomware Alarm Over Critical Severity Bug2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-6-90x90.png PDF Feature ‘Certified’ Widely Vulnerable to Attack2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/vulnerability-e1621953424713-90x90.jpg Pulse Secure VPNs Get Quick Fix for Critical RCE2 weeks ago
The post Windows Container Malware Targets Kubernetes Clusters first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
Secure configuration of Kubernetes clusters is also crucial. “A secured Kubernetes cluster won’t be as vulnerable to this specific malware as the nodes’ privileges won’t suffice to create new deployments. In this case, Siloscape will exit,” Prizmant said.
“Siloscape shows us the importance of container security, as the malware wouldn’t be able to cause any significant damage if not for the container escape,” he wrote. “It is critical that organizations keep a well-configured and secured cloud environment to protect against such threats.”
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/1_6QWMn0DApM4jmbubKuCmNA-90x90.png GitHub’s new policies allow removal of PoC exploits used in attacks1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-2-90x90.png Google PPC Ads Used to Deliver Infostealers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-1-90x90.png Researchers Uncover Hacking Operations Targeting Government Entities in South Korea5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/ransomware-payment-90x90.jpg Cyber-Insurance Fuels Ransomware Payment Surge6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/banner-2021.2-release-90x90.png Kali Linux 2021.2 Release (Kaboxer, Kali-Tweaks, Bleeding-Edge & Privileged Ports)7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/ezgif.com-gif-maker-90x90.jpg Cyber attack hits JBS meat works in Australia, North America1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/HPE-corp-logo-1-90x90.jpg HPE Fixes Critical Zero-Day in Server Management Software1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/vmware-patch-90x90.jpg VMware Sounds Ransomware Alarm Over Critical Severity Bug2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-6-90x90.png PDF Feature ‘Certified’ Widely Vulnerable to Attack2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/vulnerability-e1621953424713-90x90.jpg Pulse Secure VPNs Get Quick Fix for Critical RCE2 weeks ago
The post Windows Container Malware Targets Kubernetes Clusters first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
What Is CSRF ? How To Perform CSRF Attack, Real Life Example OWASP Top 10
https://harshitdodia653.medium.com/what-is-csrf-how-to-perform-csrf-attack-real-life-example-owasp-top-10-1859c5ce5b88?source=rss------bug_bounty-5
In this blog we will explain what cross-site request forgery is, describe some examples of common CSRF vulnerabilities, explain how to…Continue reading on Medium » (https://harshitdodia653.medium.com/what-is-csrf-how-to-perform-csrf-attack-real-life-example-owasp-top-10-1859c5ce5b88?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
https://harshitdodia653.medium.com/what-is-csrf-how-to-perform-csrf-attack-real-life-example-owasp-top-10-1859c5ce5b88?source=rss------bug_bounty-5
In this blog we will explain what cross-site request forgery is, describe some examples of common CSRF vulnerabilities, explain how to…Continue reading on Medium » (https://harshitdodia653.medium.com/what-is-csrf-how-to-perform-csrf-attack-real-life-example-owasp-top-10-1859c5ce5b88?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
Medium
What Is CSRF ? How To Perform CSRF Attack, Real Life Example OWASP Top 10
In this blog we will explain what cross-site request forgery is, describe some examples of common CSRF vulnerabilities, explain how to…
What Is CSRF ? How To Perform CSRF Attack, Real Life Example OWASP Top 10
In this blog we will explain what cross-site request forgery is, describe some examples of common CSRF vulnerabilities, explain how to…Continue reading on Medium »
Read more...
In this blog we will explain what cross-site request forgery is, describe some examples of common CSRF vulnerabilities, explain how to…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How to Hack Website Database?
https://cdn-images-1.medium.com/max/766/0*vjRG8wQz9S9lbmT5.jpg
4 mins ago h4ckerspro
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
How to Hack Website Database?
https://cdn-images-1.medium.com/max/766/0*vjRG8wQz9S9lbmT5.jpg
4 mins ago h4ckerspro
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to Hack Website Database?
4 mins ago h4ckerspro
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Blockchain and Decentralization
https://cdn-images-1.medium.com/max/780/1*rMmmOU7UT-__UTFRaJ9HrA.jpeg
Can it be Hacked?
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Blockchain and Decentralization
https://cdn-images-1.medium.com/max/780/1*rMmmOU7UT-__UTFRaJ9HrA.jpeg
Can it be Hacked?
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Blockchain and Decentralization
Can it be Hacked?
Mass Hunting XSS — Moodle
Hello friends! In this article, We are going to see How to Identify, Mass hunt and Exploit Moodle.Continue reading on Medium »
Read more...
Hello friends! In this article, We are going to see How to Identify, Mass hunt and Exploit Moodle.Continue reading on Medium »
Read more...
Mass Hunting XSS — Moodle
https://dewangpanchal98.medium.com/mass-hunting-xss-moodle-ed4b50c82516?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://dewangpanchal98.medium.com/mass-hunting-xss-moodle-ed4b50c82516?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Mass Hunting XSS — Moodle
Hello friends! In this article, We are going to see How to Identify, Mass hunt and Exploit Moodle.
Hello friends! In this article, We are going to see How to Identify, Mass hunt and Exploit Moodle.Continue reading on Medium » (https://dewangpanchal98.medium.com/mass-hunting-xss-moodle-ed4b50c82516?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Mass Hunting XSS — Moodle
Hello friends! In this article, We are going to see How to Identify, Mass hunt and Exploit Moodle.
My name is Calogero and I just started my journey into Bug Bounty Hunting just a little under a…
When I was younger and playing video games, I seen kids cheating and hosting 10th prestige lobbys. Being a kid that had to know how…Continue reading on Medium »
Read more...
When I was younger and playing video games, I seen kids cheating and hosting 10th prestige lobbys. Being a kid that had to know how…Continue reading on Medium »
Read more...
Part 2: Easy XSS On Mostly Educational Websites Via Moodle
Hello!! everyone, I had already created one on this topic using Shodan in Part-1 and now let's find this vulnerability again through Spyse.Continue reading on Medium »
Read more...
Hello!! everyone, I had already created one on this topic using Shodan in Part-1 and now let's find this vulnerability again through Spyse.Continue reading on Medium »
Read more...
hacking: security in practice
Hacking me softly
Dear hackers,
how easy is it for you to find out a Reddit User's real identity based on their User Profile?
submitted by /u/TheArchitectCode
[link] [comments]
Hacking me softly
Dear hackers,
how easy is it for you to find out a Reddit User's real identity based on their User Profile?
submitted by /u/TheArchitectCode
[link] [comments]
reddit
Hacking me softly
Dear hackers, how easy is it for you to find out a Reddit User's real identity based on their User Profile?
My name is Calogero and I just started my journey into Bug Bounty Hunting just a little under a…
https://medium.com/@jp07rr/my-name-is-calogero-and-i-just-started-my-journey-into-bug-bounty-hunting-just-a-little-under-a-35fa9b5a49b1?source=rss------bug_bounty-5
When I was younger and playing video games, I seen kids cheating and hosting 10th prestige lobbys. Being a kid that had to know how…Continue reading on Medium » (https://medium.com/@jp07rr/my-name-is-calogero-and-i-just-started-my-journey-into-bug-bounty-hunting-just-a-little-under-a-35fa9b5a49b1?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@jp07rr/my-name-is-calogero-and-i-just-started-my-journey-into-bug-bounty-hunting-just-a-little-under-a-35fa9b5a49b1?source=rss------bug_bounty-5
When I was younger and playing video games, I seen kids cheating and hosting 10th prestige lobbys. Being a kid that had to know how…Continue reading on Medium » (https://medium.com/@jp07rr/my-name-is-calogero-and-i-just-started-my-journey-into-bug-bounty-hunting-just-a-little-under-a-35fa9b5a49b1?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
Medium
My name is Calogero and I just started my journey into Bug Bounty Hunting just a little under a…
When I was younger and playing video games, I seen kids cheating and hosting 10th prestige lobbys. Being a kid that had to know how…
Part 2: Easy XSS On Mostly Educational Websites Via Moodle
https://darklotus.medium.com/part-2-easy-xss-on-mostly-educational-websites-via-moodle-7c7a3ee84b70?source=rss------bug_bounty-5
https://darklotus.medium.com/part-2-easy-xss-on-mostly-educational-websites-via-moodle-7c7a3ee84b70?source=rss------bug_bounty-5
Hello!! everyone, I had already created one on this topic using Shodan in Part-1 and now let's find this vulnerability again through Spyse.Continue reading on Medium » (https://darklotus.medium.com/part-2-easy-xss-on-mostly-educational-websites-via-moodle-7c7a3ee84b70?source=rss------bug_bounty-5)
Link - A Command And Control Framework Written In Rust
link is a command and control framework written in rust. Currently in beta. Introduction link provides MacOS, Linux and Windows implants which may lack the necessary evasive tradecraft provided by other more mature command and control frameworks. Tested on Linux only.Features Hopefully this list expands for humans to actually want to use this: HTTPS communication Process injection In-memory .NET assembly execution SharpCollection tools sRDI implementation for shellcode generation Windows link reloads DLLs from disk into current process Feedback Feel free to file an issue. Build Process Clone or download the repo cargo run if you are eager to run it right now cargo build --release to build the link server executable For more information check out Installation and Usage. Acknowledgments A non-exhaustive list of those who have in some way inspired this project by means of writing code, snippets, ideas or inspiration: @rust @moloch-- @djhohnstein @lesnuages @Flangvik @monoxgas @b4rtik Download Link
Read more...
___________________________
@hacking_Attack
@Hacking_Video
link is a command and control framework written in rust. Currently in beta. Introduction link provides MacOS, Linux and Windows implants which may lack the necessary evasive tradecraft provided by other more mature command and control frameworks. Tested on Linux only.Features Hopefully this list expands for humans to actually want to use this: HTTPS communication Process injection In-memory .NET assembly execution SharpCollection tools sRDI implementation for shellcode generation Windows link reloads DLLs from disk into current process Feedback Feel free to file an issue. Build Process Clone or download the repo cargo run if you are eager to run it right now cargo build --release to build the link server executable For more information check out Installation and Usage. Acknowledgments A non-exhaustive list of those who have in some way inspired this project by means of writing code, snippets, ideas or inspiration: @rust @moloch-- @djhohnstein @lesnuages @Flangvik @monoxgas @b4rtik Download Link
Read more...
___________________________
@hacking_Attack
@Hacking_Video
how to eliminate false positives during content discovery ?
https://www.reddit.com/r/Pentesting/comments/nv46y2/how_to_eliminate_false_positives_during_content/
submitted by /u/_dotrb (https://www.reddit.com/user/_dotrb)
[link] (https://www.reddit.com/r/bugbounty/comments/nv4550/how_to_eliminate_false_positives_during_content/) [comments] (https://www.reddit.com/r/Pentesting/comments/nv46y2/how_to_eliminate_false_positives_during_content/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/nv46y2/how_to_eliminate_false_positives_during_content/
submitted by /u/_dotrb (https://www.reddit.com/user/_dotrb)
[link] (https://www.reddit.com/r/bugbounty/comments/nv4550/how_to_eliminate_false_positives_during_content/) [comments] (https://www.reddit.com/r/Pentesting/comments/nv46y2/how_to_eliminate_false_positives_during_content/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
how to eliminate false positives during content discovery ?
Posted in r/Pentesting by u/_dotrb • 1 point and 0 comments