Think it's time to Log out here. If you're interested in container/kubernetes security I'm posting these days at Blue Sky (@mccune.org.uk), Mastodon (@raesene@infosec.exchange), and Linkedin linkedin.com/in/rorym/

🦋

Fun with Google Cloud's default service accounts (and how to leverage them for offensive purposes) securitylabs.datadoghq.com/a…

If people are thinking of checking out Blue Sky for any reason and are wondering how to find interesting accounts, it's worth knowing about their starter pack feature. Some possibly handy ones below. go.bsky.app/RnNiDb9 go.bsky.app/RCerxDE go.bsky.app/JvFS98y

The density and diversity of infosec people on @bluesky is now high enough to allow for great content and meaningful discussions. Why aren’t you joining? Known benefits: - no ads 😌 - no polarizing "For you" feed 🕊️ - an Open Source simili-TweetDeck 🤖

☁️ State of Cloud Security 2024 update of @Datadog’s report analyzing security posture data from a sample of thousands of orgs across AWS, Azure, and Google Cloud • Long-lived credentials continue to be a major risk. • Adoption of public access blocks in cloud storage services is rapidly increasing, • <1/2 of EC2 instances enforce IMDSv2, but adoption is growing • Securing managed Kubernetes clusters requires non-default, cloud-specific tuning • Insecure IAM roles for third-party integrations leave AWS accounts at risk of exposure • Most cloud incidents are caused by compromised cloud credentials datadoghq.com/state-of-cloud…

Apropos of nothing in particular... I'm more active these days on :- Blue Sky - @mccune.org.uk Mastodon - @raesene@infosec.exchange Linkedin - linkedin.com/in/rorym/

over 100k people have joined bluesky in the last 12 hours alone... welcome! 🦋💙 bsky.app/download

People often ask how many talks/cons my rigs have recorded by now, and I'd just accept any number suggested because, well, 🤷🏻‍♂️. Today I figured oh well, and ran some numbers: Events - 281 spread over 686 days. Talks - 5255 of which 4625 are currently online.

Thanks to the generosity of the community, we have a small number of pre-paid tickets to give away. We want to do our bit to help newcomers, those on low incomes, or those who simply deserve a chance. Our "pay it forward" nomination form is now live! payitforward.hackglasgow.liv…

That's me got my Noddy tickets booked for this one, looking forward to it!

A globally distributed team of people have been...creating a lot of print jobs in the past 24 hours. And by that I mean we've been testing the new big-name RCE. See our detailed analysis here: securitylabs.datadoghq.com/a…

We are kicking off! #BSidesLjubljana

Preparation in full swing @muzej (thx Gaja, Natasa, Marko + boy who did all the heavy lifting). @Ministraitor in the house, making sure there will be recording #BSidesLjubljana

As a reminder for whoever is looking for my old articles such as .NET remoting article, please use my blog instead of the NCC Group research website as they have mangled almost all documents containing XML. e.g.: soroush.me/blog/2019/03/find… They all have a PDF there.

🛎️ AWS Security Digest 176 is out! All about fwd:cloudsec Europe. awssecuritydigest.com/past-i… 1️⃣ undocumented-aws-api-hunter by @frichette_n 2️⃣ A Cloud Access Management Maturity Model: Part 1 & Part 2 by @elrowan 3️⃣ Highlights from fwd:cloudsec Europe 2024 by @christophetd Bonus: A trio of resources from the AWS mothership

Really looking forward to speaking at BSides Ljubljana this week!

📚 tl;dr sec 248 ☁️ 10X Your Cloud Security @ramimacisabird 🛡️ Secure by Design whitepaper @SANSInstitute, @aws, @emjohn20, @paulvixie, @buddykey 📖 @fwdcloudsec overview @christophetd 😈 recaptcha-phish PoC @_JohnHammond 🤖 AI OffSec benchmark @nicowaisman, @Xbow and more! tldrsec.com/p/tldr-sec-248

Are you ready to Hack Glasgow on the 26th April 2025? We are! Tickets, CFV, CFP, and more information available soon!

Still waiting for @nez_ze_nerd to sign the paperwork, but looks like next year's dates will be July 11-13. Plenty of time to book your hotel rooms and pick your outfits for our big 10th birthday party.