Gonçalo Valério @dethos@s.ovalerio.net

"GoDaddy Employees Used in Attacks on Multiple Cryptocurrency Services"

https://krebsonsecurity.com/2020/11/godaddy-employees-used-in-attacks-on-multiple-cryptocurrency-services/

#security #socialengineering

"Optimizing Your Web App 100x is Like Adding 99 Servers"

https://lukerissacher.com/blog/optimizing_your_web_app

"NAT Slipstreaming allows an attacker to remotely access any TCP/UDP service bound to a victim machine, bypassing the victim's NAT/firewall (arbitrary firewall pinhole control), just by the victim visiting a website."

https://samy.pl/slipstream/

#security #netsec

https://twitter.com/patrickwardle/status/1327726496203476992

🤷‍♂️

#security #infosec #macos #apple

"How to get root on Ubuntu 20.04 by pretending nobody’s /home"

https://securitylab.github.com/research/Ubuntu-gdm3-accountsservice-LPE

#security #ubuntu

"Your Computer Isn't Yours"

https://sneak.berlin/20201112/your-computer-isnt-yours/

#security #computers #apple #privacy

"Git LFS (git-lfs) - Remote Code Execution (RCE)"

https://seclists.org/oss-sec/2020/q4/98

#git #security #windows #infosec

"A Practical Introduction to Container Security"

https://cloudberry.engineering/article/practical-introduction-container-security/

#security #containers

"Is a billion-dollar worth of server lying on the ground?"

https://cerebralab.com/Is_a_billion-dollar_worth_of_server_lying_on_the_ground

🤔

"Scaling Yourself" ...

https://www.youtube.com/watch?v=FS1mnISoG7U

"Security hardening for GitHub Actions"

https://docs.github.com/en/free-pro-team@latest/actions/learn-github-actions/security-hardening-for-github-actions

"The Surprising Impact of Medium-Size Texts on PostgreSQL Performance"

https://hakibenita.com/sql-medium-text-performance

#postgresql

"GitHub Gist - Account takeover via open redirect"

https://devcraft.io/2020/10/19/github-gist-account-takeover.html

#security #oauth #infosec

"The Zerologon vulnerability has been reported to affect some versions of QTS.

If exploited, this elevation of privilege vulnerability allows remote attackers to bypass security measures via a compromised QTS device on the network. The NAS may be exposed to this vulnerability if users have configured the device as a domain controller..."

https://www.qnap.com/en/security-advisory/QSA-20-07

#security #qnap

"Discord Desktop app RCE "

https://mksben.l0.cm/2020/10/discord-desktop-rce.html

#security #infosec #discord #electron

"Chrome exempts Google sites from user site data settings"

https://lapcatsoftware.com/articles/chrome-google.html

Is anyone surprised?

#privacy #google

"Not all attacks are equal: understanding and preventing DoS in web applications"

https://jacobian.org/2020/sep/11/analyzing-dos-vulnerabilities/

#security #netsec #dos

"Introduction to HashiCorp Boundary"

https://www.youtube.com/watch?v=tUMe7EsXYBQ

Interesting, looking forward to see how it evolves.

#security