Cyber Research #13

Mert Coskuner

3 min readNov 13, 2021

Articles

Zero-Day Disclosure: PAN GlobalProtect CVE-2021-3064

On November 10, 2021 Palo Alto Networks (PAN) provided an update that patched CVE-2021-3064 which was discovered and…

www.randori.com

Detection Engineering for Kubernetes clusters

This blog post details the collaboration between NCC Group's Detection Engineering team and our Containerisation team…

research.nccgroup.com

Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond

Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The…

www.intruder.io

Secure Access to Kubernetes API.

In a Kubernetes cluster, Control Plane controls Nodes, Nodes control Pods, Pods control containers, and containers…

goteleport.com

r2c blog - Semgrep's Fall 2021 Updates

Semgrep 0.70 supports taint-sanitizer-sink rules for smarter data-flow based scanning, parsing Terraform files to cover…

r2c.dev

Detecting NTLM Relay Attacks

It is possible to detect NTLM relaying using only logon events. No magic!

posts.bluraven.io

The Invisible JavaScript Backdoor

A few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying…

certitude.consulting

Automatically Fix Security Issues at the Source

Many static analysis tools exist out there for detecting security issues. These tools are a necessary part of the…

research.kudelskisecurity.com

Continuous Security: Threat Modeling in DevSecOps

A fundamental goal of DevOps is to shorten software release cycles and bring software products to customers faster and…

bishopfox.com

Finding and Fixing DOM-based XSS with Static Analysis - Attack & Defense

Despite all the efforts of fixing Cross-Site Scripting (XSS) on the web, it continuously ranks as one of the most…

blog.mozilla.org

Forensic investigation environment strategies in the AWS Cloud | Amazon Web Services

When a deviation from your secure baseline occurs, it's crucial to respond and resolve the issue quickly and follow up…

aws.amazon.com

Field Notes: Analyze Cross-Account AWS KMS Call Usage with AWS CloudTrail and Amazon Athena |…

Businesses are expanding their footprint on Amazon Web Services (AWS) and are adopting a multi-account strategy to help…

aws.amazon.com

Workload credentials for GKE via CAS | Google Cloud Blog

At the core of a zero trust approach to security is the idea that trust needs to be established via multiple mechanisms…

cloud.google.com

Announcing Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps update: November 2021 By Maayan Bar-Niv, Principal Group Program Manager…

techcommunity.microsoft.com

Tools

Automating cloud governance at scale

How we automate advanced IaC security linting at scale, with latest version of Cfripper

medium.com

GitHub - cloudskiff/driftctl: Detect, track and alert on infrastructure drift

Measures infrastructure as code coverage, and tracks infrastructure drift. IaC: Terraform, Cloud providers: AWS, GitHub…

github.com

GitHub - bridgecrewio/helm-scanner: Open source IaC security scanner for public Helm charts

So far, this code has been used to generate a dataset for investigation into the current state of Helm security…

github.com

GitHub - airbnb/ottr: Serverless Public Key Infrastructure Framework

Serverless Public Key Infrastructure Framework. Contribute to airbnb/ottr development by creating an account on GitHub.

github.com

Thank you for reading!

If you find this newsletter useful and know other people who would too, forward it to them to help spread the knowledge. If you have questions, comments or feedback, reach out via /in/mcoskuner.

Cyber Research #13

Articles

Zero-Day Disclosure: PAN GlobalProtect CVE-2021-3064

On November 10, 2021 Palo Alto Networks (PAN) provided an update that patched CVE-2021-3064 which was discovered and…

Detection Engineering for Kubernetes clusters

This blog post details the collaboration between NCC Group's Detection Engineering team and our Containerisation team…

Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond

Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The…

Secure Access to Kubernetes API.

In a Kubernetes cluster, Control Plane controls Nodes, Nodes control Pods, Pods control containers, and containers…

r2c blog - Semgrep's Fall 2021 Updates

Semgrep 0.70 supports taint-sanitizer-sink rules for smarter data-flow based scanning, parsing Terraform files to cover…

Detecting NTLM Relay Attacks

It is possible to detect NTLM relaying using only logon events. No magic!

The Invisible JavaScript Backdoor

A few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying…

Automatically Fix Security Issues at the Source

Many static analysis tools exist out there for detecting security issues. These tools are a necessary part of the…

Continuous Security: Threat Modeling in DevSecOps

A fundamental goal of DevOps is to shorten software release cycles and bring software products to customers faster and…

Finding and Fixing DOM-based XSS with Static Analysis - Attack & Defense

Despite all the efforts of fixing Cross-Site Scripting (XSS) on the web, it continuously ranks as one of the most…

Forensic investigation environment strategies in the AWS Cloud | Amazon Web Services

When a deviation from your secure baseline occurs, it's crucial to respond and resolve the issue quickly and follow up…

Field Notes: Analyze Cross-Account AWS KMS Call Usage with AWS CloudTrail and Amazon Athena |…

Businesses are expanding their footprint on Amazon Web Services (AWS) and are adopting a multi-account strategy to help…

Workload credentials for GKE via CAS | Google Cloud Blog

At the core of a zero trust approach to security is the idea that trust needs to be established via multiple mechanisms…

Announcing Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps update: November 2021 By Maayan Bar-Niv, Principal Group Program Manager…

Tools

Automating cloud governance at scale

How we automate advanced IaC security linting at scale, with latest version of Cfripper

GitHub - cloudskiff/driftctl: Detect, track and alert on infrastructure drift

Measures infrastructure as code coverage, and tracks infrastructure drift. IaC: Terraform, Cloud providers: AWS, GitHub…

GitHub - bridgecrewio/helm-scanner: Open source IaC security scanner for public Helm charts

So far, this code has been used to generate a dataset for investigation into the current state of Helm security…

GitHub - airbnb/ottr: Serverless Public Key Infrastructure Framework

Serverless Public Key Infrastructure Framework. Contribute to airbnb/ottr development by creating an account on GitHub.

Thank you for reading!

Written by Mert Coskuner