Gonçalo Valério @dethos@s.ovalerio.net

"How (and Why) to Use AppRole Correctly in HashiCorp Vault"

https://www.hashicorp.com/blog/how-and-why-to-use-approle-correctly-in-hashicorp-vault

#security #vault #devsecops

"Remove the auth header and you are root!"

https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution

#security #netsec #microsoft #azure #linux

"SSH Lateral Movement Cheat Sheet"

https://highon.coffee/blog/ssh-lateral-movement-cheat-sheet/

#security #pentesting

"Email Authenticity 101: DKIM, DMARC, and SPF"

https://www.alexblackie.com/articles/email-authenticity-dkim-spf-dmarc/

#email #security

"The Rise Of User-Hostile Software"

https://den.dev/blog/user-hostile-software/

#software #apps

"The All-Seeing "i": Apple Just Declared War on Your Privacy"

https://edwardsnowden.substack.com/p/all-seeing-i

#privacy #apple

"Razer bug lets you become a Windows 10 admin by plugging in a mouse"

https://www.bleepingcomputer.com/news/security/razer-bug-lets-you-become-a-windows-10-admin-by-plugging-in-a-mouse/

#security #windows #razer

"Inside Figma: securing internal web apps"

https://www.figma.com/blog/inside-figma-securing-internal-web-apps/

#security #web #internalapps

"Protect domains that do not send email "

https://www.gov.uk/guidance/protect-domains-that-dont-send-email

#security #email #phishing

"The EU decided to let providers search all private chats, messages, and emails automatically for suspicious content – generally and indiscriminately."

https://www.patrick-breyer.de/en/posts/message-screening/

#privacy #europeanunion #eu

🤔

https://www.youtube.com/watch?v=o0aNLtZD9NM

#freemium #saas #startups

Good read about desync attacks that exploit http2 downgrades

https://portswigger.net/research/http2

#security #web #http

"Snapcraft Packages Come With Extra Baggage"

https://blog.ret2.io/2021/08/04/snapcraft-injection/

#security #ubuntu #snap

"Probably Are Gonna Need It: Application Security Edition"

https://jacobian.org/2021/jul/8/appsec-pagnis/

#security #webdev #saas

"The OAuth flow implemented in Mattermost server v5.32 > v5.36 is affected by a reflected XSS. An unauthenticated attacker might gain access to the victim’s session."

https://www.shielder.it/advisories/mattermost-server-reflected-xss-oauth/

#security #netsec #mattermost

"OpenSSH ssh-agent Shielded Private Key Extraction (x86_64 Linux)"

https://security.humanativaspa.it/openssh-ssh-agent-shielded-private-key-extraction-x86_64-linux/

#security #ssh