#cloudcve - Twitter Hashtag

about 4 years ago

Very proud to be part of this team! @wiz_io helps improve the security of cloud today be releasing the first cloud vulnerability DB website- owned and governed by the community #cloudcve @0xdabbad00 thank you for the partnership!

alon

@41thexplorer

about 4 years ago

Today @amitaico, @0xdabbad00 and I are launching a new website to list cloud vulnerabilities and CSP security issues. The website will be driven by the community, enabling cloud defenders to search and view essential info about cloud vulnerabilities https://t.co/REwMYBvan3 1/6

7

241

102

51

0

11

1

0

alon

@41thexplorer

about 4 years ago

Thanks @wiz_io for sponsoring this project and to the #CloudCVE community (https://t.co/D3kISNv9Fs) for the fruitful discussions that shaped the website. We call the cloud security community to continue the effort for better security and transparency 6/6

2

4

0

1

0

Wiz

@wiz_io

about 4 years ago

A CVE-like database for cloud bugs will make it easier for orgs to evaluate the security of their CSPs and take action when needed. @zpring breaks down why Wiz and many others are advocating for #CloudCVE in his latest @threatpost piece: https://t.co/XsGkMJGVl7 cc @0xdabbad00

0

25

13

2

0

alon

@41thexplorer

over 4 years ago

I pushed 3 cloud vulnerabilities from the past year to the list, what did you do help the cloud security community today? #CloudCVE

Scott Piper

@0xdabbad00

over 4 years ago

I've begun a list of security mistakes made by Cloud Service Providers (AWS, GCP, Azure). Includes CVEs, SOC 2 Type 2 failures, security researchers compromising managed services, and more. https://t.co/J2J1pbPGuB

13

868

280

264

0

2

0

alon

@41thexplorer

over 4 years ago

What's the issue with cloud vulnerabilities? Cloud services are unversioned, remediation is complex, reporting is self governed by CSPs, and there is no centralized DB like the CVE DB. Let’s imagine we had a #CloudCVE system. What could it look like for @Azure #ChaosDB? 1/N

Scott Piper

@0xdabbad00

over 4 years ago

@shirtamari I'm going to do a weekend project to put all the cloud provider issues I know of into a repo. Planning on listing them roughly by date they were found and including cloud provider, researcher, some sort of severity or impact, whether customer action was required, summary.

2

44

4

3

0

3

33

8

3

0

alon

@41thexplorer

over 4 years ago

@msftsecresponse assigned a CVE to a key leak vulnerability in AZURE SERVICES ❗ The CVE page details affected services, timelines, risk and required actions. Kudos to MSFT for learning from #ChaosDB and setting a better standard for cloud vulns #CloudCVE https://t.co/x46vB7a86W

1

14

4

1

0

Ami Luttwak

@amiluttwak

over 4 years ago

@QuinnyPig @Azure The cloud providers are not accountable to no one. This is why we started #cloudCVE, each of us can start from asking @Azure to assign a CVE to #ChaosDB and provide a full disclosure on the incident https://t.co/dr17WGejcV

0

10

3

0

Ami Luttwak

@amiluttwak

almost 5 years ago

@0xdabbad00 Great list! Each of these vulnerabilities exposed a different risk in cloud (IAM policies, secret agents, endpoint clients etc.) showing the growing need for a new #cloudcve system

0

3

0

Ami Luttwak

@amiluttwak

almost 5 years ago

Another reminder that we need a #cloudcve system that can centralize and define what a CVE report for cloud vendors should look like

Péter Szilágyi

@peter_szilagyi

almost 5 years ago

Between the 3 Sept and 10 Sept, secure env vars of *all* public @travisci repositories were injected into PR builds. Signing keys, access creds, API tokens. Anyone could exfiltrate these and gain lateral movement into 1000s of orgs. #security 1/4 https://t.co/i23jFzAjjH

31

2K

1K

131

0

1

0

alon

@41thexplorer

almost 5 years ago

Cloud customers deserve better transparency on these vulnerabilities. A 2nd #Azure vulnerability involving cross tenant data access in 2 weeks. A unique id for tracking them is a must. More info to evaluate risks to our data could be nice too.. #CloudCVE https://t.co/Wv6UPmn8b6

alon

@41thexplorer

almost 5 years ago

Vulnerabilities aren't @FriendsTV episodes. You can't name them "The one in the Azure CosmosDB Jupyter Notebook feature". How will we refer to the next one? @msftsecresponse didn't mention #ChaosDB, that we chose to help the community. #CloudCVE is needed. https://t.co/lXJpIcz5mn

41thexplorer's tweet photo. Vulnerabilities aren't @FriendsTV episodes. You can't name them "The one in the Azure CosmosDB Jupyter Notebook feature". How will we refer to the next one?
@msftsecresponse didn't mention #ChaosDB, that we chose to help the community. #CloudCVE is needed.
https://t.co/lXJpIcz5mn https://t.co/88mj4aa6dI

0

12

3

0

4

0

Ami Luttwak

@amiluttwak

almost 5 years ago

This is exactly the point for #cloudcve

0

2

0

alon

@41thexplorer

almost 5 years ago

Vulnerabilities aren't @FriendsTV episodes. You can't name them "The one in the Azure CosmosDB Jupyter Notebook feature". How will we refer to the next one? @msftsecresponse didn't mention #ChaosDB, that we chose to help the community. #CloudCVE is needed. https://t.co/lXJpIcz5mn

0

12

3

0

Shir @shirtamari

almost 5 years ago

@HackingDave BTW, we try to promote #CloudCVE initiative for a while and everyone is welcome to join the effort- https://t.co/3Wpt7PH4mY

Shir @shirtamari

almost 5 years ago

We have opened a slack group that will allow us all to talk about the issue and promote it. Everyone is welcome to join. https://t.co/OqbuGQljO0

0

2

0

2

0

Shir @shirtamari

almost 5 years ago

After our recent publication on #ChaosDB I see more and more discussions about Cloud CVEs. Identifying and tracking cloud vulnerabilities is critical. Customers have no way of doing that with cloud vulnerabilities. https://t.co/SpeK3dKcI0 #CloudCVE

1

12

1

0

Top Tweets for #cloudcve

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users