Daniel Liberal

Cloud Security - Incident Response & Blue team

[Hillai Ben-Sasson @hillai]

I hacked into a @Bing CMS that allowed me to alter search results and take over millions of @Office365 accounts.
How did I do it? Well, it all started with a simple click in @Azure… 👀
This is the story of #BingBang 🧵⬇️

[alon @41thexplorer]

Today @amitaico, @0xdabbad00 and I are launching a new website to list cloud vulnerabilities and CSP security issues. The website will be driven by the community, enabling cloud defenders to search and view essential info about cloud vulnerabilities https://t.co/REwMYBvan3 1/6

[Daniel Liberal @dlibSec]

@jsnover All the best on your new adventure!

[Daniel Liberal @dlibSec]

@SeanWrightSec your head and use the same everywhere so you don't forget it

[Daniel Liberal @dlibSec]

Most of them apply to any serverless ecosystem

[Luca Mezzalira @lucamezzalira]

Mistakes to Avoid When Implementing #Serverless Architecture with #AWS #Lambda. AWS highlights eight common #anti-#patterns they have seen and provide some recommendations to avoid them to ensure your system is performing at its best. https://t.co/CaBk2VThYq

[Kelly Shortridge @swagitda_]

My depth of knowledge on GraphQL security stuff was basically that it’s a data leakage minefield, so I found @simran_khalsa’s explainer on the security implications of GraphQL super useful: https://t.co/Kpt7HOPE2Q

(The suggestions on which features to disable are esp valuable)

[Daniel Liberal @dlibSec]

@AlyssaM_InfoSec Almost like a swimming pool 😅

[James van den Berg MVP ☁ @JamesvandenBerg]

Private AKS and ACR Using Private Endpoint – Part 1/2 🚀
https://t.co/rzujMvxHtd
#Azure #AKS #ACR #endpoint #Kubernetes #Containers #DevOps #AzOps via @HoussemDellai

[Daniel Liberal @dlibSec]

Robot mono for the win!

[Javi Moreno @ciberado]

Esto estás chulísimo: vas desempatando entre distintos ejemplos de tipografía monspaced y termina diciéndote qué letra te gusta más. Voy a repetirlo unos cuantos días, quizá sea buena idea cambiar. https://t.co/dVuBnt9cFW

[Javi Moreno @ciberado]

Esto estás chulísimo: vas desempatando entre distintos ejemplos de tipografía monspaced y termina diciéndote qué letra te gusta más. Voy a repetirlo unos cuantos días, quizá sea buena idea cambiar. https://t.co/dVuBnt9cFW

[Daniel Liberal @dlibSec]

Nice feature, but as any other debug capability don't enable it on prod...
"...Ephemeral containers allow you to create a container image that includes all the debugging tools you might need... deploy the ephemeral container into the running pod of your choice...'

[Cloud Native Yoda @cloudnativeyoda]

planning to deploy kubernetes with a few homegrown bash scripts and kubeadm, you are?

if once you start down that dark path, forever will it dominate your destiny. consume you, it will.

learn from the pain of others you should, young padawan.

[Cory Doctorow NO LONGER ON TWIT TER @doctorow]

I flatter myself that I'm pretty secure online. I've written global bestsellers about #infosec, worked for @EFF for nearly 20 years, given keynotes at some of the world's largest infosec conferences. And yet, I have been hacked. It wasn't even very sophisticated! 1/

[Daniel Liberal @dlibSec]

Interesting. Aftermath of the SkyScanner four-and-a-half hour full global outage
https://t.co/fhxT8Ui6iZ

[Daniel Liberal @dlibSec]

@amiluttwak @BlackHatEvents Lot of bad decisions on the azure back end design...

[Daniel Liberal @dlibSec]

@kmcquade3 Does Cloud Guardrails support to apply policies to management groups instead of subscriptions?
This will simplify deployment on tenants with too many subscriptions

[Daniel Liberal @dlibSec]

No excuses anymore to store passwords or keys in the code...

[Daniel Liberal @dlibSec]

I really love this #Ignite talk: PowerShell unplugged with
@jsnover & @theJasonHelmick (what happen to your eye?)

[Oste @oste_ke]

A refresher on Linux File system structure