Posts by Kelly Shortridge

A Serverless Explainer for Defenders
March 11, 2021
What is all this “serverless” stuff and why should security people care? The tl;dr is that serverless compute services – also known as “function-as-a-service” – are efficient at handling events on-demand in applications that don’t have a constant firehose of requests. Your developers will vibe with not having to worry about anything but their code, […]
Heap Overflow in Sudo: The Struggling Escape Artist (CVE-2021-3156)
January 27, 2021
Yesterday, the Qualys Research Team disclosed a heap overflow vulnerability in sudo, CVE-2021-3156, called “Baron Samedit” (in a show of delightful wordplay with the Haitian Vodou spirit). It allows a local user to become root and gain control over the target system. Why it’s cool: Sudo, short for “superuser do”, is a default utility in […]
Bringing Your A-Game: Availability for Security People
January 26, 2021
The security industry tends to focus on the protection of sensitive data, forgetting that availability falls under the classic C.I.A. triad. This is a mistake, and an especially egregious one considering the rise of the service delivery economy. This post is intended as an overview of why infosec teams stand to substantially benefit from rediscovering […]
From Catastrophe to Chaos in Production
December 1, 2020
Production is the remunerative reliquary where we can realize value from all of this software stuff we wrangle day in and day out. As has been foretold from crystal balls through to magic eight balls, the deployment and operation of services in production is increasingly the new engine of business growth, and few industries are […]
Grubbing Secure Boot the Wrong Way: CVE-2020-10713
July 29, 2020
Today, researchers at Eclypsium disclosed a buffer overflow vulnerability in GRUB2, CVE-2020-10713, affectionately termed “Boothole.” It basically results in a total pwn of Secure Boot in systems using GRUB, which is a lot of them — all Linux distros, a bunch of Windows machines, and more. Additionally, the mitigation process is a certified hot mess, […]
High STEKs: On-path attacks in GnuTLS (CVE-2020-13777)
June 11, 2020
This month, Fiona Klute disclosed a vulnerability in GnuTLS, CVE-2020-13777. It can either enable on-path attackers for TLS 1.3, or facilitate passive decryption of traffic between servers running GnuTLS for TLS 1.2. Either way, it’s not great! Why it’s cool: Attackers could exploit this vuln to recover previously captured network traffic, like conversations (for servers […]
Security Delusions Part 3: Cheat Codes
May 21, 2020
Organizations are unearthing the potential of digital transformation, but security often remains a gatekeeper to this path of promised potential, largely due to its own delusions about what modern infrastructure means. As Herman Melville wrote in Moby Dick, “Ignorance is the parent of fear” – and security is too frequently hindered by its fear of […]
Security Delusions Part 2: Modern Monsters
May 6, 2020
Organizations are unearthing the potential of digital transformation, but security often remains a gatekeeper to this path of promised potential, largely due to its own delusions about what modern infrastructure means. As Herman Melville wrote in Moby Dick, “Ignorance is the parent of fear” – and security is too frequently hindered by its fear of […]
eBPF’s Rollercoaster of Pwn: An Overview of CVE-2020-8835
April 23, 2020
Last Friday, Manfred Paul published a blog post about the vuln he used at Pwn2Own 2020, CVE-2020-8835, a local privilege escalation bug in the Linux Kernel. It affects any Linux distros using Linux kernels 5.5.0 and newer. Why it’s cool: eBPF is the Hacker News hotness for tracing (i.e. monitoring execution of) the Linux kernel, […]
Security Delusions Part 1: A History of Cloud Compunction
April 20, 2020
Organizations are unearthing the potential of digital transformation, but security often remains a gatekeeper to this path of promised potential, largely due to its own delusions about what modern infrastructure means. As Herman Melville wrote in Moby Dick, “Ignorance is the parent of fear” – and security is too frequently hindered by its fear of […]
RAMming Down Hype via Intel CSME
March 6, 2020
Recently, security researchers found new vectors of exploiting a vulnerability in Intel CSME, CVE-2019-0090, affecting all Intel chips other than Generation 10 (Ice Lake). The researchers haven’t released exploitation details yet, but proclaimed that “utter chaos will reign”… but not by exploiting this vulnerability! Instead, there’s a potential for chaos if attackers figure out how […]
What is container security?
What is Container Security?
February 21, 2020
Container Security – Nobody Knows What It Means But It’s Provocative The current understanding of “container security” as a term and market is muddled, especially given containers are used by different teams in different contexts. It could mean scanning image repositories for vulnerabilities or exposed secrets, managing credentials for container deployment, or monitoring running containers […]