#readteam — Public Fediverse posts

«Все работает, но БД утекает»: Как взлом подрядчика привел к eBPF-руткиту и утечке данных

Когда мы говорим об атаках через цепочку поставок, обычно всплывает в голове что-то монументальное - SolarWinds, взлом инфраструктуры гигантов. Но правда в том, что сегодня любой бизнес, который нанимает внешних админов или DevOps-инженеров, рискует заполучить зловреда, способного годами сидеть в периметре и сливать базы данных(БД). И вы об этом даже не узнаете… В этой статье - хочу поделиться реальным случаем из практики. Как взлом ноутбука подрядчика привел к внедрению eBPF-руткита в Linux. Раскрыть атаку помогла… ну, скажем так, случайная оплошность самих злоумышленников.

https://habr.com/ru/articles/1017934/

#APT #readteam #forensic_analysis

Of course, there are other ways to configure sensitive values but I don't think it's necessarily obvious or front of mind when updating config and I honestly can't see (as someone who configures multiple services on Akamai regularly) why this feature is needed.
Unsure if it can be disabled or auth'd but I don't see any way to do that.
There are some docs which cover it a little bit: https://techdocs.akamai.com/download-delivery/docs/test-your-dd-property#4-install-an-extension.
Just though it might not be common knowledge.
2/2
#Akamai #InfoSec #ReadTeam #BlueTeam

Akamai has what I personally think is a seriously risky mechanism for debugging HTTP requests/responses. You can send an HTTP request header of `pragma: akamai-x-get-extracted-values` for a URL served via Akamai & it'll return `x-akamai-session-info` response headers which include user-defined config variables - that's where the main risk is IMO. People may well not realise this feature exists & use the vars for sensitive info e.g. backend auth keys.
1/2
#Akamai #InfoSec #ReadTeam #BlueTeam

Última llamada para la 2ª Edición del Programa de Especialización de "Inteligencia Artificial para Expertos en Ciberseguridad https://www.elladodelmal.com/2024/10/ultima-llamada-para-la-2-edicion-del.html #IA #GenAI #AI #Master #Curso #Formación Es Online y en Español #hacking #hardening #BlueTeam #ReadTeam

Iniciamos la segunda sesión del Único Curso Virtual de Hacking Aplicaciones Web del año 2023. #cybersecurity #hacking #readteam #bugbounty #forensics #osint https://www.reydes.com/d/?q=Curso_de_Hacking_Aplicaciones_Web

I suddenly realize/believe why there is more of a demand for Blue Team Cyber Security professionals.

Is it because there are already enough Penetration Testers or Read Team people out there carrying out hacks in real life? Even though they're malicious?

Ethical Hacking and Red Team for legitimate companies are still preemptive measures to security breaches. If you count unethical activities there are more than enough events "testing" your security and there is more of a need to defend or stop these activities...

Am I correct to assume this? Or am I way off???

#cybersecuritystudent #cybersecurity #RedTeamAnalyst #BlueTeamAnalyst #readteam #blueteam