Blog
Posts about
Exploits
A critical, high severity vulnerability (CVSS v3.0 10/10 rating) in the Apache Log4j open source Java logging library was disclosed Thursday, December 9 on the foundation’s github page. Enterprises are advised to immediately access the likelihood of being affected by this vulnerability and operate under an ‘assumed breach’ mentality to assess logs and review unusual network activity especially egress connections.
By Fei Huang A new docker vulnerability affecting container security, CVE-2019-5736 was just announced, with some calling it a ‘Doomsday Docker Security Hole.’ This is just 2 months after the critical Kubernetes vulnerability was reported allowing attackers to take control of the api server. From one of the runc maintainers Aleksa Sarai: Aleksa stated that “this docker vulnerability allows a …
By Fei Huang Kubernetes critical vulnerability CVE-2018-1002105 was reported this week and the implication is a big warning to the fast-growing, massive DevOps world. The wide adoption of Kubernetes and Docker workloads is no doubt indicative of a disruptive next generation platform technology. But of course, like the dark side of the moon, every big shiny thing may bring some challenges. So …
By Fei Huang A lot of people were shocked by the recent top headline “Cathay Pacific Cyber Attack Is World’s Biggest Airline Data Breach.” Looking at the past breaches reported by British Airways and Delta Air Lines, it pains me greatly that every couple of months or even weeks we are hearing such bad news. To make things worse, Cathay …
By Dieter Reuter As we talked about before in this blog, containers are just vulnerable to be attacked as non-container workloads. Hackers can use many of their old tricks on new containers, such as application exploits, network attacks, or phishing scams. In this post and demo, I’ll show how to hack a Kubernetes container using the well-publicized Apache Struts vulnerability …
