Off to the PTraces

Yesterday, a privilege escalation bug in the ptrace syscall was made public by Jann Horn at Project Zero, deemed CVE-2019-13272. The culprit was broken permission and object lifetime handling by …

How Security Teams Can Learn to Stop Worrying and Love the OODA Loop

A well-loved military operational strategy is the OODA loop, a learning cycle that helps the operator gain an advantage against their opponent by responding with greater agility to unfolding events. …

Customer Interview: Looker

With over 1700 industry-leading and innovative companies such as Sony, Amazon, IBM, Spotify, Etsy and Lyft trusting Looker’s data platform, Looker takes security seriously.  The Looker Security Operations team, managed …

Escaping like a Rocket via rkt enter

Last week, a researcher disclosed three vulnerabilities in rkt, CVE-2019-10144, CVE-2019-10145, and CVE-2019-10147, that let an attacker escape the container. Rkt is an open source container runtime created by CoreOS …

Race Conditions – Cloudy with a Chance of R/W Access

Docker Race Condition: CVE-2018-15664 Today, Aleksa Sarai published a Docker vulnerability, CVE-2018-15664, on the oss-sec mailing list. It turns out that a function inside Docker facilitates a TOCTOU bug (more …

A Buffer Buffet for Data Sampling

CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 Yesterday, three data sampling side channel vulnerabilities were disclosed in Intel CPUs by a whole bunch of smart researchers. Intel is calling them “microarchitectural data sampling” …

Linux Security Fun With Webhooks

At Capsule8, we want to let you work the way you prefer working rather than forcing new workflows on you. To realize this philosophy, we designed Capsule8 to be super …

The Methods to our Madness: How Capsule8’s Detection Methods Work

One of the best weapons in defending against attackers is speed. The ability to detect an attacker’s attempts as soon as it happens, and in turn shut it down before …

Search No Further: Capsule8 Supports Google Cloud Security Command Center with Security Partner Integration

Today is another big day for Capsule8. We officially announced that we are included as a Security Partner Integration within the newly launched Google Cloud Security Command Center (Cloud SCC). …