Infosec Enthusiast & Practiconer. Account mostly inactive. @uchi_mata@infosec.exchange https://xitter.cf/t.co/9zKRHWb1pH
Joined February 2009
- Tweets2.1K
- Following450
- Followers839
- Likes918
Matthias Luft retweeted
Eliminate entire classes of security flaws with these Python libraries
* PyNacl for Cryptography
* Pydantic for input validation
* Casbin for Object/Function Level AuthZ
* Passlib for Password Management
Matthias Luft retweeted
I wanted to solve my problem, so I built a distributed app. Now problems have two I.
Yet another pitfall when extracting archives, this time from @NodyTweet
blog.nody.cc/posts/link-writ…
We need more open audit/security testing reports like this:
blog.trailofbits.com/2024/07…
Matthias Luft retweeted
With the #GhostWrite CPU vulnerability, all isolation boundaries are broken - sandbox/container/VM can't prevent GhostWrite from writing and reading arbitrary physical memory on affected RISC-V CPUs. Deterministic, fast, and reliable - no side channels. ghostwriteattack.com/
Matthias Luft retweeted
AWS wishlist: a single IAM API that returns the policies attached to a user/role. Today, it involves 4-5 calls:
• listRolePolicies
• listAttachedRolePolicies
• getRolePolicy
• getPolicy
• getPolicyVersion
Matthias Luft retweeted
It's great to see Multiplier by @trailofbits being open-sourced! github.com/trailofbits/multi… I believe it exemplifies the kind of foundational, next-generation tools we need for proper software understanding, maintenance, and sustainment.
Matthias Luft retweeted
The next part of our #Kubernetes #Security fundamentals video series is out now! This time we're looking at the Kubelet API. talking about the ports it makes available and some of the potential for information leakage.
youtu.be/OdkFPL7d73E?si=ytdc…
Matthias Luft retweeted
Regarding the SSH bug 1) First OpenSSH vuln discovered in almost 20 years - wow 2) Bug was (re)introduced almost 4 years ago. So remote root in OpenSSH for 4 years and nobody found it? 3) Exploit takes hours/days to run. Watch your logs!
Matthias Luft retweeted
What a great read. RCE in sshd with race conditions requiring hours to days to succeed. I cannot imagine the patience required here. 👏 👏 👏
Also, exposing SSH to 0.0.0.0/0 might be a default in your cloud environment, but CSPs have better remote access patterns available.
Matthias Luft retweeted
If you launch a new FreeBSD (13.2|13.3|14.0|14.1)-RELEASE instance and don't change the default behaviour via EC2 user-data, it will download and install the patch for this before sshd is launched. I decided many years ago that installing updates on first boot was important.
I should probably provide context for people who haven't seen it yet: A pre-auth RCE in OpenSSH was announced a short time ago. Exploitable on Linux; not exploitable on OpenBSD; unclear if exploitable on FreeBSD but we have an advisory out just in case.
qualys.com/2024/07/01/cve-20…
Matthias Luft retweeted
Today seems like a good day to mention that on my servers I use spiped to protect access to OpenSSH -- you can't even send a single byte to sshd unless you have the spiped secret key.
daemonology.net/blog/2012-08…
Matthias Luft retweeted
All the talks from last week have been published to our Youtube channel!
Here's a playlist with all of them: youtube.com/playlist?list=PL…
Matthias Luft retweeted
🎉 It's finally here!
The CloudSec Engineer.
A practical guide on how to enter, establish yourself, and thrive in the Cloud Security industry as an individual contributor.
Now available: engineer.cloudsecbooks.com/
#thecloudsecengineer
I'm excited to discuss Security Engineering and its skillset aspects and organizational requirements at the MSS Munich event tomorrow!
In case you want to join and heckle my ramblings:
Zoom: us02web.zoom.us/webinar/regi…
Event: mssnetwork.com/munich
