Aggregator

案例分析 | 某软件外包的供应链安全问题

洞源实验室
1 year 2 months ago
在最近的一次安全漏洞事件处理中，需要验证某上市公司网站的一个安全漏洞。但由于漏洞信息的不完整，需要人工基于报告内容进行二次漏洞定位、复现。在这个过程中，我们发现存在的一个典型的关于软件外包的供应链安全问题。

Romanian Healthcare System Laid Low by Attack on Shared Software Platform

Ransomware.org
1 year 2 months ago

Cybercriminals, it is widely observed, have a fondness for weekends. This is not by chance—at weekends organizations are short-staffed, making this the best time to launch a cyberattack. It’s a pattern that played out in a ransomware attack on the Romanian health system on Sunday, Feb. 11, that sent some of the country’s most important […]

The post Romanian Healthcare System Laid Low by Attack on Shared Software Platform appeared first on Ransomware.org.

John E. Dunn

Not the Access You Asked For: How Azure Storage Account Read/Write Permissions Can Be Abused for Privilege Escalation and Lateral Movement

Friends & Security
1 year 2 months ago
In this blog we will dive into some unexpected techniques that allow an Azure user with Storage Account permissions to abuse them for privilege escalation and lateral movement. We will discuss prior work on storage to Azure Cloud Shell & Azure Function App and share a new technique around Azure Standard Logic App.
Yehuda Smirnov

Managed ad