The July edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... • Cloud image investigator by @sethsec.bsky.social • Our top picks for Black Hat / DEF CON • A benchmark for LLM coding accuracy and security • Malicious Homebrew installation campaign .. and more

fwd:cloudsec is around the corner! Don't miss these 3 talks from Datadog researchers Seth Sec, Katie Knowles, Greg Foss, and Anthony Randazzo. fwdcloudsec.org/conference/n... @sethsec.bsky.social @siigil.bsky.social @gregfoss.com

The February edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... featuring @sethsec.bsky.social, @mccune.org.uk, @karimscloud.bsky.social, @jcfarris.bsky.social, and more

The Datadog Security Digest is a monthly, practitioner-focused newsletter. Don't miss our February edition going live tomorrow! securitylabs.datadoghq.com/newsletters/...

whoAMI attacks give hackers code execution on Amazon EC2 instances

When I first started reading this I though,t “is this really news, this issue has been around for years…” but then it gets interesting - kudos to the researchers on this one!

Need to hack thousands of AWS customers? What about on internal AWS systems? Datadog Security Research found that a number of tools, including one published by AWS, are susceptible to name confusion attacks, leading to RCE in vulnerable environments! securitylabs.datadoghq.com/articles/who...

I’m excited to share our research on the “whoAMI” attack. We discovered that AWS customers pulling AMI IDs insecurely could accidentally use malicious images instead of the legitimate ones— leading to remote code execution. securitylabs.datadoghq.com/articles/who...

We discovered a pattern in the way many projects retrieve Amazon Machine Images (AMIs), allowing attackers to publish AMIs with specially crafted names and gain code execution within vulnerable accounts. securitylabs.datadoghq.com/articles/who... by @sethsec.bsky.social

New year, new job! I've joined the amazing @wiz_io research team My goal is the "work for the security industry, at Wiz" I wrote a blog post explaining why, and what that means: ramimac.me/joining-wiz

Threat insights from Datadog Security Labs for Q4 2024 securitylabs.datadoghq.com/articles/202...

I'm not saying I'm an AWS expert… but I am saying I finally tracked down the random AWS account charging me small amounts every month and closed it.

Well this is grim

Plenty of additional information about the compromise of OpenWRT’s online build service, involving command-injection and hash bypass 🧠

Introducing Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages securitylabs.datadoghq.com/articles/int... by @ikretz.bsky.social New open-source tool designed to transparently block known malicious PyPI and npm packages. github.com/DataDog/supp...

Another cool little tool from Datadog Labs. #cybersecurity https://github.com/DataDog/supply-chain-firewall

We're now officially on Bluesky! Expect: ➔ New articles on Security Labs about cloud, container and application security ➔ OSS projects for cloud security practioners ➔ Conference talks at community conferences See also our starter pack bsky.app/starter-pack... with our authors and researchers!

The self described “Shodan of AWS” is now live! This is an amazing project from Daniel Grzelak that helps democratize cloud resource enumeration for the masses. Very excited about this! awseye.com

DualCore and I spoke at the Red Team Village this year. Here are the slides. QR code with link to gist with all the reference links on last page. Unfortunately it wasn't recorded. docs.google.com/presentation... #redteam #purpleteam #redteamvillage

The November edition of the Datadog Security Digest is live! securitylabs.datadoghq.com/newsletters/... Featuring: - Exploring Google Cloud default service accounts: deep dive and real-world adoption trends by Christophe Tafani-Dereeper 🧵(1/3)

Latest video in my Kubernetes Security Fundamentals series is out. Looking at some lesser known bits of Kubernetes authentication, bootstrap and static tokens! youtu.be/1QNKj1rW5H0?...

Now as a starter pack: go.bsky.app/5HpWAcM

We made it easy for you to find us! The Red Siege Starter Pack is now up! Find the team here - go.bsky.app/ERU72bD #infosec #cybersecurity

This is such a good story about how "gotofail" started as a drunken brag in a bar and ended up being disclosed to Apple via a burner phone. It was Ryan all along, finally taking credit after all these years!

I created a list of Cloud Security folks on here. bsky.app/profile/scot...

Backdated posts are possible, and given what the API exposes, they are indistinguishable from normal posts 🤔

Office wall art #aws

New confused deputy vuln found in an AWS service! Nice work TrustOnCloud team! trustoncloud.com/blog/confuse...

I’m very excited for this to be released! RCPs cover a need to restrict external access to resources across your organization. Plus its a whole new policy type to consider! aws.amazon.com/about-aws/wh...

Carrying on my series on #Kubernetes networking, I took a look at how a basic Kubernetes network plugin works. As with most parts of Kubernetes there's a lot of variety possible here, but a basic example actually shows how traffic can get from container to container raesene.github.io/blog/2024/11...

While preparing for my BSides Orlando talk about cloud privilege escalation, I made some updates to CloudFox and pushed v1.15.0: github.com/BishopFox/cl... Most changes were to fix bugs in the cape command but I also some cool updates to the iam-simulator and principals commands.

Some interesting research by my colleague @christophetd.fr on default service accounts in GCP. Looks at how default rights can be in place and some of the risks to GKE environments. securitylabs.datadoghq.com/articles/goo...

SANS CloudSecNext videos: www.youtube.com/watch?v=2L98... And visual summaries: www.sans.org/blog/a-visua...

Katie has written an excellent intro guide on contributing to Stratus. If you've ever wanted to add a new attack technique, this is for you! kknowl.es/posts/stratu...

I had such a great time speaking about Cloud Security at BSides Orlando! I saw some great talks, made some new friends, and got to hang with old ones. A huge thank you to all of the volunteers that made this epic event possible!