Alle afleveringen
66 afleveringen, van nieuw naar oud
-
CROC News: Automotive Code Leak & Midnight Blizzard's Heist
22 februari 2024 · 28 min
Loading from the Cloud... Lees meer
Season 2 of "CRYING OUT CLOUD" is here!
Join our hosts, Eden and Amitai, as they dive into the latest cloud stories that we can't wait to share with you
Here's a sneak peek into the season's opening:
🚗 Mercedes-Benz Source Code Exposure:
A public GitHub Repo was exposed - allowing unauthorized access to the company's internal servers, including AWS and Azure subscriptions. The credentials remained publicly accessible for 3-4 months. 😱🌨️ Midnight Blizzard Hits Microsoft:
Russian actors (Midnight Blizzard) got into Microsoft's network and stole employee emails, finding a misconfigured account with a weak password. Among other things, they tried to find out what Microsoft knew about their activity.🔐 Ivanti Vulnerabilities:
Ivanti's VPN products exposed vulnerabilities, allowing remote code execution and authentication bypass, exploited by a Chinese Threat Actor. -
#15 - Yinon Costica on AI risks, the importance of positivity and his new year's resolutions
21 december 2023 · 34 min
🛡️ Join Eden Naftali & Amitai Cohen's exclusive interview with Yinon Costica, as he brings unparalleled expertise to the table. From his beginnings in Israel's 8200 intelligence unit, through Adallom, which was acquired by Microsoft, to co-founding Wiz Lees meer
-
#14 - On Executive Orders And AI (Special Guest - Chris Hughes)
10 december 2023 · 35 min
🎙️ NEW SPECIAL PODCAST EPISODE WITH @CHRIS HUGHES! 🎙️ Lees meer
Here's a sneak peek into our chat:
🛡️ Join Chris, Amitai, and Eden as they unveil intriguing security nuances between public and private sectors. Gain exclusive insights into FedRAMP, straight from Chris's expertise, and his take on the implications of President Biden's AI order for the cybersecurity landscape.
🌐 How exactly does SBOM adoption act as a shield against supply chain breaches? What other strategies can fortify against such attacks?
🔍 Delve into the post-COVID startup world. Chris touches on the intricacies of the challenges faced, offering a glimpse into how these innovative ventures navigate a changed landscape.
Tune in for a captivating talk below!
-
#13 - Leaky CLIs, glitchy CPUs and risky HARs
30 november 2023 · 23 min
🎙️ NEW PODCAST EPISODE ALERT!
Eden and Amitai are back with another wild ride through the cloudy skies on "Crying Out Cloud"! Lees meerHere's the scoop for today's adventure:
01:36 - Okta Support System Compromise: 🕵️♂️
We unravel the mystery surrounding an unknown threat actor's access to Okta's customer support system. What's an HAR file, and why should you care?06:30 - Azure CLI Credential Leak (CVE-2023-36052): 💻
Get the lowdown on Microsoft's Azure CLI vulnerability and how this leak happened, why defaults matter, and what the patch means for your Azure CLI setup.13:17 - Reptar and Cachewarp CPU Vulnerabilities: 💡
CPU vulnerabilities are a trend we can't ignore! Discover why Reptar and Cachewarp CPU vulnerabilities might sound daunting but aren't necessarily the cloud apocalypse. Plus, the juicy details on who's patched and who's snoozing on this issueLinks:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36052
https://cloud.google.com/blog/products/identity-security/google-researchers-discover-reptar-a-new-cpu-vulnerability
https://lock.cmpxchg8b.com/reptar.html
https://cachewarpattack.com/
https://sec.okta.com/harfiles -
#12 - Chomping at the Bits with Chompie
19 oktober 2023 · 33 min
In our new Crying Out Cloud podcast episode, we're joined by the LEGENDARY Valentina Palmiotti, the one and only Chompie 🚀 Lees meer
✨ In this episode, you'll find:
1. The surprising story behind her hacker alias - "Chompie," 🕵️♀️
2. Valentina's insights from her Blackhat presentation, where she challenges security boundaries with kernel post-exploitation techniques 🤯
3. A peek into her day-to-day at IBM X-Force, from research to code auditing and vulnerability analysis 💼And more!
-
#11 - From SAS token to AI data exposure (with special guest - Hillai Ben-Sasson)
21 september 2023 · 22 min
More info here:
https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers -
#10 - fwd:cloudsec With Special Guest Scott Piper
19 september 2023 · 29 min
fwd:cloudsec event highlights podcast special - Featuring our special wizard guest Scott Piper, who is also the co-founder of fwd:cloudsec! A non-profit conference on cloud security that discusses all the major cloud platforms, both attack and defense research, limitations of security features, the pros and cons of different security strategies, and more! Lees meer
fwd:cloudsec 2023 videos:
https://www.youtube.com/playlist?list=PLCPCP1pNWD7MR1SwekwbZls9TGzqo_LHx
-
#9 - The collapse of LAPSUS$ and the risks of AI data poisoning
14 september 2023 · 27 min
👀 Here's a sneak peek at today’s episode: Lees meer
🔒 Stay ahead of the game! LAPSUS$ Hackers may be making waves. Two members of this notorious group faced consequences in the UK, but shockingly, they continued their hacking activities even while under house arrest.
🤖 Data Poisoning in AI Training is a growing concern. Hackers can manipulate the data used to train AI models, introducing risks and vulnerabilities. Validating data integrity and randomizing data ingestion times are useful mitigations against this threat.
💻 The WinRAR Vulnerability (CVE-2023-38831)! This flaw was exploited against crypto-traders to infect their devices with malware, but should be considered a low concern for cloud customers unless using virtual desktops.
Important links:
https://gizmodo.com/hackers-lapsus-uber-nvidia-rockstar-games-microsoft-1850766324
https://www.bbc.com/news/technology-66549159
https://www.cisa.gov/resources-tools/resources/review-attacks-associated-lapsus-and-related-threat-groups-executive-summary
https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf
https://duo.com/decipher/lapsususd-analysis-finds-need-for-better-iam-mfa-deployments
https://www.youtube.com/watch?v=h9jf1ikcGyk
https://arxiv.org/pdf/2302.10149.pdf
https://www.blackhat.com/us-23/briefings/schedule/#poisoning-web-scale-training-datasets-is-practical-32112
https://arstechnica.com/security/2023/08/winrar-0-day-that-uses-poisoned-jpg-and-txt-files-under-exploit-since-april/
-
#8 - GameOverlay – privilege escalation vulnerabilities in Ubuntu
30 augustus 2023 · 23 min
🍿🤏 Everything you need to know about this month's cloud security drama in the latest "Crying Out Cloud" episode! Lees meer
In this edition, we explore THREE captivating stories 📚🔍
1️⃣ "GameOverlay" unveiled: Ubuntu's privilege escalation vulnerabilities 😱 — Wiz Research uncovered a pair of vulnerabilities that's affecting 40% of Ubuntu cloud machines! We've got the scoop on what you must know.
2️⃣ Unmasking "P2PInfect": The botnet targeting Redis! 🤖 — Ever wondered how a botnet hijacks your exposed Redis instances? Let's get into the nitty-gritty of this attack and find out how to defend your environment.
3️⃣ Jumpcloud's dance with North Korea: A supply chain saga 🕊️ -—Join us as we uncover the tale of Jumpcloud's breach and its uncanny link to North Korea. Dive deep into the investigation with us.
Important links:
1. https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability
2. https://ubuntu.com/security/CVE-2023-2640
3. https://ubuntu.com/security/CVE-2023-32629
4. https://www.cadosecurity.com/redis-p2pinfect/
5. https://unit42.paloaltonetworks.com/peer-to-peer-worm-p2pinfect/
6. https://www.mandiant.com/resources/blog/north-korea-supply-chain
7. https://www.sentinelone.com/labs/jumpcloud-intrusion-attacker-infrastructure-links-compromise-to-north-korean-apt-activity/
8. https://jumpcloud.com/blog/security-update-incident-details
9. https://jumpcloud.com/support/july-2023-iocs
10. https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/
11. https://blog.phylum.io/sophisticated-ongoing-attack-discovered-on-npm/ -
#7 - The Future Of The Cloud (Special Guest - Corey Quinn)
16 augustus 2023 · 36 min
🔥 SPECIAL EPISODE ALERT 🔥 Lees meer
@Corey Quinn Joins the Party — in this week's incredible episode of "Crying Out Cloud" 🥳
Meet our remarkable hosts:
✨ @Eden, the tech-savvy wizard from the CTO Team at Wiz
✨ @Amitai, our expert from the Threat Research Team at WizAnd for this special occasion, we're rolling out the red carpet for:
🎊 COREY QUINN! 🎊
Chief Cloud Economist at The Duckbill Group, the mastermind behind Last Week in AWS, and the charismatic host of the Screaming in the Cloud podcast. Corey is not just a cloud icon – he's a cloud ROCKSTAR 🎸On the producer's desk:
🕹️ @Alon Schindel, our powerhouse Director of Data and Threat Research at Wiz—
In this unforgettable episode, we explore:
💥 The Microsoft MSA incident – a turning point or a fading memory?
💡 The cloud's revolutionary journey over the past decade
🌍 Cloud usage in today's economic climate
💎 Often overlooked but golden cloud services
🛡 Why cloud misconfigurations are still a major issueAND...
We put Corey in the hot seat with a speed round that's packed with laughs and surprises! -
#6 - Chinese Spies Acquire Keys To The Azure Kingdom
31 juli 2023 · 31 min
Popcorn ready? 🍿
Ep. 6 of "Crying Out Cloud" is now LIVE — and it's a thriller! 🤯 Lees meer1:42 📬 Chinese Hackers Steal US Gov Emails
12:53 🧨 Silent Bob & the Team TNT Comeback
18:41 🇷🇺 Russian Hackers Exploit Office Zero Day
26:10 🐍 Footloose's 2023 Object-Oriented Sequel: PyLooseImportant links:
https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a
https://blogs.microsoft.com/on-the-issues/2023/07/11/mitigation-china-based-threat-actor/
https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/
https://www.wired.com/story/microsoft-cloud-attack-china-hackers/
https://arstechnica.com/security/2023/07/microsoft-takes-pains-to-obscure-role-in-0-days-that-caused-email-breach/
https://blog.aquasec.com/threat-alert-anatomy-of-silentbobs-cloud-attack
https://blog.aquasec.com/teamtnt-reemerged-with-new-aggressive-cloud-campaign
https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/
https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
https://twitter.com/AbbyMCH/status/1679509312132005888
https://sysdig.com/blog/scarleteel-2-0/
https://twitter.com/maddiestone/status/1678843059294076928
https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
https://twitter.com/cyb3rops/status/1680962212804939776
https://twitter.com/serghei/status/1679246339698315265
https://www.wiz.io/blog/pyloose-first-python-based-fileless-attack-on-cloud-workloads -
#5 - MOVEit Transfer 0day vulnerabilities (Special Guest: Scott Piper)
26 juni 2023 · 34 min
Join your favorite hosts, @Eden and @Amitai, on the latest "Crying Out Cloud" rollercoaster 🎢 Spoiler Alert: We've got @Scott Piper, the cloud security guru, joining the conversation too! His insights are amazing, so we've reserved a special upcoming episode just for him 😎 Lees meer
On today's journey, we are:
1️⃣ Peeling back the layers of MOVEit Transfer 0day vulnerabilities 🕵️
2️⃣ Breaking down CVSSv4💥
3️⃣ Sharing insider takeaways from fwd:cloudsec 2023 (FOMO, anyone?).🔮
4️⃣ Getting real about the Barracuda ESG 0day vulnerability (we're not fishing around! 🐠).Important Links:
https://www.first.org/cvss/v4-0/
https://thehackernews.com/2023/06/third-flaw-uncovered-in-moveit-transfer.html
https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
https://fwdcloudsec.org/schedule.html -
#4 - Daisy Chain - A Double Supply Chain Attack
18 mei 2023 · 25 min
Join our lively hosts, Eden and Amitai, as they explore the most fascinating cloud security news of the month. Lees meer
On this episode:
🧃🔗 More juice on 3CX supply chain attack
✂️💔 PaperCut vulnerabilities
📦🔓 Capita exposed a bucket with sensitive data for 7 years
🚗☁️ Toyota cloud misconfiguration leaked customer data for 10 years
🚢🔄 Trend of hijacking containers for traffic routing
Important links:
1. https://techcrunch.com/2023/05/12/toyota-japan-exposed-millions-locations-videos/
2. https://zetter.substack.com/p/updates-and-timeline-for-3cx-and
3. https://doublepulsar.com/capitas-standard-industry-practice-633gb-open-cloud-storage-5d87e7e96a70
4. https://therecord.media/iranian-state-sponsored-hackers-exploiting-printer-vulnerability
5. https://www.trendmicro.com/en_us/research/23/d/attackers-use-containers-for-profit-via-trafficstealer.html
-
#3 - The BingBang Vulnerability (Special Guest: Ami Luttwak)
24 april 2023 · 32 min
For crying out #cloud! Episode 3 of our cloud security podcast is live and you haven't tuned in yet? Lees meer
Hot off the cloud servers! ☁️📰🎙️
🔎 The #BingBang misconfiguration on Microsoft Bing search engine
🕵️ North Korean supply-chain attack targets crypto companies
🌩️ Iranian cloud destruction operation is making headlines
💻 QueueJumper: The Windows vulnerability disclosed last Patch Tuesday
Eden and Amitai on the mic🎤 With special guest Ami Luttwak, Wiz Co-Founder and CTO!
Important Links:
https://www.wiz.io/blog/bingbang
https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration
https://www.wired.com/story/3cx-supply-chain-attack-north-korea-cryptocurrency-targets/
https://www.3cx.com/blog/news/security-incident-updates/
https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/
https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment/
https://research.checkpoint.com/2023/queuejumper-critical-unauthorized-rce-vulnerability-in-msmq-service/ -
#2 - Hijacked Websites In China Redirect Traffic
16 maart 2023 · 27 min
🎉🎙️ Hold on to your headphones! Lees meer
The newest episode of the "Crying Out Cloud" podcast is here, and it's an absolute rollercoaster 🎢
Join our charismatic hosts, Eden and Amitai, as they uncover the most captivating cloud security news of the month.
In this action-packed episode:
🕵️♂️ Mysterious redirections to adult websites in East Asia
🎣 Crafty hackers using fake Google ads for credential theft
🦪 Don't panic, stay clam: The ClamAV vulnerability
🕹️ Gaming industry under fire: Minecraft and Dota 2 incidents
🇺🇸 US Department of Defense data exposure drama
🔗 And the GoDaddy supply chain attack that everyone's talking about!Important Links:
1. https://www.wiz.io/blog/redirection-roulette
2. https://aboutus.godaddy.net/newsroom/company-news/news-details/2023/Statement-on-recent-website-redirect-issues/default.aspx
3. https://www.sentinelone.com/blog/cloud-credentials-phishing-malicious-google-ads-target-aws-logins/
4. https://permiso.io/blog/s/watering-hole-attack-targets-aws-users/
5. https://blog.gradle.org/wrapper-attack-report
6. https://lunarlogs.com/2023/01/29/double-jeopardy-mcos-backdooring-players-get-shut-down/
7. https://techcrunch.com/2023/02/21/sensitive-united-states-military-emails-spill-online/
8. https://thehackernews.com/2023/02/critical-rce-vulnerability-discovered.html
9. https://decoded.avast.io/janvojtesek/dota-2-under-attack-how-a-v8-bug-was-exploited-in-the-game/ -
#1 - CI/CD Supply Chain Attack
2 maart 2023 · 26 min
Welcome to "Crying Out Cloud," the monthly podcast that keeps you up to date with the latest cloud security news. Hosted by experts Eden Naftali and Amitai Cohen, each episode provides in-depth coverage of the most important vulnerabilities and incidents from the previous month. Tune in for insightful analysis and expert recommendations to help you safeguard your cloud infrastructure. Lees meer
Important links:
https://circleci.com/blog/jan-4-2023-incident-report/
https://www.wiz.io/blog/cve-2022-44877-critical-rce-in-centos-control-web-panel-exploited-in-the-wild
https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/
https://therecord.media/hackers-exploiting-vulnerability-affecting-zoho-manageengine-products-rapid7
https://www.theverge.com/2023/1/24/23569109/goto-hack-lastpass-breach-encrypted-backups-key