Matthias Luft

Infosec Enthusiast & Practiconer. Account mostly inactive.
@[email protected]

[Abhay Bhargav @abhaybhargav]

Eliminate entire classes of security flaws with these Python libraries

* PyNacl for Cryptography
* Pydantic for input validation
* Casbin for Object/Function Level AuthZ
* Passlib for Password Management

[Forrest Brazeal @forrestbrazeal]

I wanted to solve my problem, so I built a distributed app. Now problems have two I.

[Supabase @supabase]

light it up

[Matthias Luft @uchi_mata]

Yet another pitfall when extracting archives, this time from @NodyTweet

https://t.co/y0r7CqEHUV

[Matthias Luft @uchi_mata]

We need more open audit/security testing reports like this:
https://t.co/KqVdIfTEbv

[Michael Schwarz @misc0110]

With the #GhostWrite CPU vulnerability, all isolation boundaries are broken - sandbox/container/VM can't prevent GhostWrite from writing and reading arbitrary physical memory on affected RISC-V CPUs. Deterministic, fast, and reliable - no side channels. https://t.co/qtmosPvuYl

[Matt Fuller @matthewdfuller]

AWS wishlist: a single IAM API that returns the policies attached to a user/role. Today, it involves 4-5 calls:

• listRolePolicies
• listAttachedRolePolicies
• getRolePolicy
• getPolicy
• getPolicyVersion

[sergey bratus @sergeybratus]

It's great to see Multiplier by @trailofbits being open-sourced! https://t.co/9r1WfebMIv I believe it exemplifies the kind of foundational, next-generation tools we need for proper software understanding, maintenance, and sustainment.

[Matthias Luft @uchi_mata]

@cji You realize the real boomer thing was taking the quiz, right? 😀

[Matthias Luft @uchi_mata]

@uncommonengneer Those were great memes - but apparently not appreciated 🙅‍♂️

[Matthias Luft @uchi_mata]

@mikelikesbikes Not really, I think you're good 👍🙃

[Rory McCune @raesene]

The next part of our #Kubernetes #Security fundamentals video series is out now! This time we're looking at the Kubelet API. talking about the ports it makes available and some of the potential for information leakage.

https://t.co/2a9VLyJnVF

[Charlie Miller @0xcharlie]

Regarding the SSH bug 1) First OpenSSH vuln discovered in almost 20 years - wow 2) Bug was (re)introduced almost 4 years ago. So remote root in OpenSSH for 4 years and nobody found it? 3) Exploit takes hours/days to run. Watch your logs!

[Brad Geesaman @bradgeesaman]

What a great read. RCE in sshd with race conditions requiring hours to days to succeed. I cannot imagine the patience required here. 👏 👏 👏

Also, exposing SSH to 0.0.0.0/0 might be a default in your cloud environment, but CSPs have better remote access patterns available.

[Colin Percival @cperciva]

If you launch a new FreeBSD (13.2|13.3|14.0|14.1)-RELEASE instance and don't change the default behaviour via EC2 user-data, it will download and install the patch for this before sshd is launched. I decided many years ago that installing updates on first boot was important.

[Colin Percival @cperciva]

Today seems like a good day to mention that on my servers I use spiped to protect access to OpenSSH -- you can't even send a single byte to sshd unless you have the spiped secret key.

https://t.co/ZH0qgFar1c

[fwd:cloudsec @fwdcloudsec]

All the talks from last week have been published to our Youtube channel!

Here's a playlist with all of them: https://t.co/ITYEHrmw59

[Matthias Luft @uchi_mata]

@0x464D Make that 10 years ago 😀

[Marco Lancini @lancinimarco]

🎉 It's finally here!

The CloudSec Engineer.

A practical guide on how to enter, establish yourself, and thrive in the Cloud Security industry as an individual contributor.

Now available: https://t.co/CBEIv7IZL7

#thecloudsecengineer