Cyber Research #23

Mert Coskuner

2 min readJan 29, 2022

Articles

Patterns for Authorization in Microservices

In the past five months, I've talked to over 50 companies about their authorization systems. More than half of them are…

www.osohq.com

Linux Auditd for Threat Detection

A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology…

izyknows.medium.com

Webcam Hacking (again) - Safari UXSS | Ryan Pickren

Gaining unauthorized camera access via Safari UXSS: the story of how a shared iCloud document can hack every website…

www.ryanpickren.com

Finding vulnerabilities in Swiss Post's future e-voting system - Part 1

In September '21, I came across this story "Swiss Post Offers up to €230,000 for Critical Vulnerabilities in e-Voting…

www.reversemode.com

What the newest kernel exploit - CVE-2022-0185 - mean for Kubernetes?

Linux maintainers disclosed a broadly available Linux kernel vulnerability - CVE-2022-0185 - that enables attackers to…

www.armosec.io

Abusing Reverse Proxies, Part 1: Metadata

IntroductionMany cloud service providers offer a "metadata" service on their virtual machines. These services offer…

blog.projectdiscovery.io

Fuzzing101 with LibAFL - Part V: Fuzzing LibXML2 -

Twitter user Antonio Morales created the Fuzzing101 repository in August of 2021. In the repo, he has created exercises…

epi052.gitlab.io

CVE-2021-45467: CWP CentOS Web Panel - preauth RCE

CentOS Web Panel or commonly known as CWP is a popular web hosting management software, used by over 200,000 unique…

octagon.net

CVE-2022-0185: Detecting and mitigating Linux Kernel vulnerability causing container escape …

This week, Linux maintainers and vendors disclosed a heap overflow vulnerability in the Linux Kernel. The vulnerability…

sysdig.com

Continuous compliance monitoring using custom audit controls and frameworks with AWS Audit Manager…

For most customers today, security compliance auditing can be a very cumbersome and costly process. This activity…

aws.amazon.com

Announcing Azure Active Directory (Azure AD) workload identity for Kubernetes - Microsoft Open…

Today, we are excited to announce an open-source project called Azure AD workload identity for Kubernetes. It leverages…

cloudblogs.microsoft.com

Tools

GitHub - outsideris/citizen: A Private Terraform Module Registry

docker run -d -p "3000:3000" ghcr.io/outsideris/citizen:latest To launch the registry server Because Terraform CLI…

github.com

GitHub - ministryofjustice/aws-root-account: Terraform for the Ministry of Justice AWS root account

This repository holds infrastructure as code for the Ministry of Justice AWS Organizations root account, and two…

github.com

GitHub - mufeedvh/moonwalk: Cover your tracks during Linux Exploitation by leaving zero traces on…

moonwalk is a 400 KB single-binary executable that can clear your traces while penetration testing a Unix machine. It…

github.com

Thank you for reading!

If you find this newsletter useful and know other people who would too, forward it to them to help spread the knowledge. If you have questions, comments or feedback, reach out via /in/mcoskuner.

Cyber Research #23

Articles

Patterns for Authorization in Microservices

In the past five months, I've talked to over 50 companies about their authorization systems. More than half of them are…

Linux Auditd for Threat Detection

A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology…

Webcam Hacking (again) - Safari UXSS | Ryan Pickren

Gaining unauthorized camera access via Safari UXSS: the story of how a shared iCloud document can hack every website…

Finding vulnerabilities in Swiss Post's future e-voting system - Part 1

In September '21, I came across this story "Swiss Post Offers up to €230,000 for Critical Vulnerabilities in e-Voting…

What the newest kernel exploit - CVE-2022-0185 - mean for Kubernetes?

Linux maintainers disclosed a broadly available Linux kernel vulnerability - CVE-2022-0185 - that enables attackers to…

Abusing Reverse Proxies, Part 1: Metadata

IntroductionMany cloud service providers offer a "metadata" service on their virtual machines. These services offer…

Fuzzing101 with LibAFL - Part V: Fuzzing LibXML2 -

Twitter user Antonio Morales created the Fuzzing101 repository in August of 2021. In the repo, he has created exercises…

CVE-2021-45467: CWP CentOS Web Panel - preauth RCE

CentOS Web Panel or commonly known as CWP is a popular web hosting management software, used by over 200,000 unique…

CVE-2022-0185: Detecting and mitigating Linux Kernel vulnerability causing container escape …

This week, Linux maintainers and vendors disclosed a heap overflow vulnerability in the Linux Kernel. The vulnerability…

Continuous compliance monitoring using custom audit controls and frameworks with AWS Audit Manager…

For most customers today, security compliance auditing can be a very cumbersome and costly process. This activity…

Announcing Azure Active Directory (Azure AD) workload identity for Kubernetes - Microsoft Open…

Today, we are excited to announce an open-source project called Azure AD workload identity for Kubernetes. It leverages…

Tools

GitHub - outsideris/citizen: A Private Terraform Module Registry

docker run -d -p "3000:3000" ghcr.io/outsideris/citizen:latest To launch the registry server Because Terraform CLI…

GitHub - ministryofjustice/aws-root-account: Terraform for the Ministry of Justice AWS root account

This repository holds infrastructure as code for the Ministry of Justice AWS Organizations root account, and two…

GitHub - mufeedvh/moonwalk: Cover your tracks during Linux Exploitation by leaving zero traces on…

moonwalk is a 400 KB single-binary executable that can clear your traces while penetration testing a Unix machine. It…

Thank you for reading!

Written by Mert Coskuner