Archive

NewsletterNewsletter
[tl;dr sec] #22 - Post AppSec Cali, K8s Security Monitoring at Scale

[tl;dr sec] #22 - Post AppSec Cali, K8s Security Monitoring at Scale

DevSecOps talks & tools from AppSec Cali, PoCs to decrypt WhatsApp messages, Kubernetes monitoring and CTF, Python static analysis tools.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #21 - AppSec Cali, Bezos's Phone, Fuzzing

[tl;dr sec] #21 - AppSec Cali, Bezos's Phone, Fuzzing

I'm speaking at AppSec Cali 2020, details on Bezos's phone being hacked, fuzzing talks and tools, Java deserialization, K8s and GraphQL tools.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #18 - \"GitHubification\" of Infosec, Ring Privacy, Ransomware Economics

[tl;dr sec] #18 - \"GitHubification\" of Infosec, Ring Privacy, Ransomware Economics

Blue teams can become highly leveraged by sharing knowledge effectively, Ring's partnerships with the police, viewing ransomware through an economic lens.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #17 - AWS Re:Invent, Supply Chain Security, Absolute AppSec

[tl;dr sec] #17 - AWS Re:Invent, Supply Chain Security, Absolute AppSec

A number of interesting new AWS services, backdoors on PyPI, I had a blast on the Absolute AppSec podcast, and tl;dr sec hits 500 subscribers! 🚀

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #16 - Art of Vulnerability Management, Cloud Security, Flan Scan, SCORE Bot

[tl;dr sec] #16 - Art of Vulnerability Management, Cloud Security, Flan Scan, SCORE Bot

Building an effective vulnerability management process, K8s/AWS tips, network & code scanning tools, privacy preserving VA, and the Siege of Gondor.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #15 - OSINT + Screenshots, Fuzzing, and 2 Fast 2 Discoverious

[tl;dr sec] #15 - OSINT + Screenshots, Fuzzing, and 2 Fast 2 Discoverious

Summary of an AppSec Cali 2019 talk on more efficient network penetration tests via clustering similar screenshots, fuzzing tools and articles, Bugcrowd/Bitdiscovery asset inventory partnership.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #14 - DevSecCon TLV, Slack's Secure Overlay Network, Dangers of Struct Padding

[tl;dr sec] #14 - DevSecCon TLV, Slack's Secure Overlay Network, Dangers of Struct Padding

DevSecCon Tel Aviv 2019 talk notes, Slack releases Nebula, AWS instance metadata hardening, OSINT tips, struct padding can leak heap memory, deadlock challenges, formal methods.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #13 - Being Powerful While Powerless, Sadcloud, and Bugcrowd's Asset Inventory Service

[tl;dr sec] #13 - Being Powerful While Powerless, Sadcloud, and Bugcrowd's Asset Inventory Service

Gusto's Nathan Yee on being impacful as an IC without a senior title in a start-up, intentionally vulnerable AWS infrastructure for training, and even more asset inventory offerings.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #12 - Killing CSRF, MITRE ATT&CK Cloud, Cache Poisoned DoS

[tl;dr sec] #12 - Killing CSRF, MITRE ATT&CK Cloud, Cache Poisoned DoS

Browser default *SameSite* cookie settings will mostly kill CSRF, and a malicious header can block any web resource served by a CDN or proxy cache.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #11 - ShellCon 2019 Roundup

[tl;dr sec] #11 - ShellCon 2019 Roundup

Some ShellCon talk summaries, Dropbox and Twilio on detection and response automation, updates from the Chrome security team.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #10 - Cloudflare on Security, IAM Least Privilege, & Finding XSS in Firefox's UI

[tl;dr sec] #10 - Cloudflare on Security, IAM Least Privilege, & Finding XSS in Firefox's UI

Cloudflare's CTO on how they think about security, Salesforce's tool to make IAM least privilege policy generation easier, and finding XSS in Firefox's UI using AST matching.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #9 - Autonomous Bug Reporting, HTTP Desync Attacks, & Censorship

[tl;dr sec] #9 - Autonomous Bug Reporting, HTTP Desync Attacks, & Censorship

Fuzzing is finding security bugs faster than CVEs can be issued, HTTP desync attacks advance, China's censorship power is felt around the world.

Clint Gibler
Clint Gibler
FirstBack
212223242526
Next Last