Lacework

MAY 25, 2021

The Takeaways TeamTNT targets exposed Docker API to deploy malicious images. Docker images containing TeamTNT malware are being hosted in public Docker repos via account takeovers. TeamTNT leverages exposed Docker hub secrets within GitHub to stage malicious Docker images.

Malware 78

Malware 78

Aqua Security

JULY 15, 2020

We at Team Nautilus - Aqua’s cyber security research team - discovered a new type of attack against container infrastructure. The attacker exploits a misconfigured Docker API port in order to build and run a malicious container image on the host.

Infrastructure 124

Infrastructure Research Analysis 124

Xebia

FEBRUARY 17, 2023

A DAST tool scans by sending HTTP Requests with malicious payloads and analyzes the corresponding HTTP Responses to identify potential vulnerabilities. However, make sure the DAST tool you want to use, contains policies/rules that define vulnerability types that are important to your context. You can download Docker here.

Applications 130

Applications Testing Authentication How To 130

Prisma Clud

JUNE 22, 2023

Enterprises taking advantage of cloud-native architectures now have 53% of their cloud workloads hosted on public clouds, according to our recent State of Cloud-Native Security Report 2023. Using WildFire in 2021 to analyze malicious files, our threat research team discovered a 73% increase in Cobalt Strike malware samples compared to 2020.

Malware 76

Malware Linux Windows Operating System 76

CircleCI

OCTOBER 11, 2022

Virtualization is the technology on which many popular development tools like containers and virtual machines (VMs) are built. In this article, you will learn the difference between containers and VMs, the important role each plays in modern software development, and how you can incorporate containers and VMs in your development pipelines.

Virtualization 52

Virtualization Microservices Hardware Resources 52

Lacework

MARCH 29, 2022

Docker APIs continue to be an enticing and abundant target for adversaries. Specifically, compromising Docker sockets and deploying malicious container images, some of which are being downloaded and deployed by thousands of unsuspecting users, ultimately leading to cryptomining infections. Cloud Security Posture.

Report 91

Report Cloud Malware Linux 91

Palo Alto Networks

OCTOBER 11, 2021

The most recent Unit 42 Cloud Threat Report contains the high-level results of a red team exercise performed against a SaaS customer’s continuous integration and continuous development (CI/CD) pipeline. This brings us to malicious attackers. The organization did not have these security measures enabled on their other 49+ AWS accounts.

Cloud 79

Cloud Exercises Weak Development Team AWS 79

Lacework

MAY 10, 2022

Docker and Kubernetes have simplified the development process, so developers can now write new applications and deploy them in multiple places at scale. Create a registry of pre-approved images to use in your code. To prevent this, it’s important for developers to use only approved images in their code.

Weak Development Team 52

Weak Development Team Development DevOps Malware 52

CircleCI

JULY 11, 2019

This article assumes that you have a fundamental understanding of the following technologies and tools: Docker - Used to create, deploy, and run applications using containers. Docker provides repeatable development, build, test, and production environments. Create a container cluster on GKE with the name circle-ci-cluster.

Google Cloud 90

Google Cloud Applications Open Source Cloud 90

Xebia

JULY 20, 2023

The inaugural Wasm I/O conference was hosted in Barcelona, it has become significant enough for the Cloud Native Computing Foundation to dedicate a day to it at CloudNativeCon , and Docker has released their second technical preview for the holy union of containers and Wasm. Ok, let’s dispense with the setup.

Serverless 100

Serverless Software Review Technical Review Systems Review 100

AlienVault

MARCH 14, 2019

Compromised Container Management Platforms. We've seen attackers using open APIs and unauthenticated management interfaces to compromise container management platforms. The report details the container commands showing the malicious request. Following the attention of the report by RedLock, the owners of xaxaxa[.]eu

Cloud 40

Cloud AWS Malware Infrastructure 40

Lacework

APRIL 6, 2022

The Log4j vulnerability was a good reminder that securing cloud-native applications start with using safe container images free of critical vulnerabilities. A good container image pipeline not only reduces the number of vulnerabilities present in running containers, but it also helps companies to quickly respond to such emergencies.

Software Review 52

Software Review Policies Continuous Integration Testing 52

Tenable

NOVEMBER 21, 2019

Proof-of-concept (PoC) code for a security flaw in Docker, the popular containerization platform, is now public. On November 19, researchers at Unit 42, Palo Alto Networks’ research team, published their analysis of a severe vulnerability in the popular container deployment platform, Docker. Background. Proof of concept.

Analysis 15

Analysis Research Network Video 15

CircleCI

MAY 21, 2019

This causes a problem if you want a Continuous Integration service to run tests that need access to credentials or sensitive data as a malicious developer could propose code that exposes the credentials to CI logs. jobs : test : docker : - image : circleci/openjdk:8u171-jdk. Marking code as trusted by pushing upstream.

Software Review 49

Software Review Technical Review Systems Review Testing 49

Codegiant

NOVEMBER 9, 2020

Graphical reports in Jira cannot be downloaded as images. Using other methods alters the resolution of the images. Hosted git repositories. Features Self-contained, platform-agnostic, Java-based program, ready to run with packages for multiple popular operating systems. Limited file size upload. Performance tracker.

Software Review 64

Software Review Tools Weak Development Team Development 64

Codegiant

NOVEMBER 9, 2020

Graphical reports in Jira cannot be downloaded as images. Using other methods alters the resolution of the images. Hosted git repositories. Features Self-contained, platform-agnostic, Java-based program, ready to run with packages for multiple popular operating systems. Limited file size upload. Performance tracker.

Software Review 52

Software Review Weak Development Team Tools Development 52