CloudSec Wednesday: Rails Security, Git Config Exposed 15k Cloud Credentials, AWS WAF Rules Against Bots

Hey! James here.

Today’s edition covers Cloud Security, Container Security and DevSecOps Practices:

• 📝 15k Cloud Credentials Stolen in Operation Targeting Exposed Git Config Files, How to mitigate bot traffic by implementing Challenge actions in your AWS WAF custom rules!

• 🔥I bought us-east-1[.]com: A Look at Security DNS Traffic and Protecting AWS Users, Typosquat Campaign Targeting npm developers!

• 🧠 The dark side of Github actions, How To Scan The Entire Cloud, The state of security in Rails 8!

• And more…

First time reading? Sign up here.

📰 Top Security News

• Product Security Bad Practices (CISA)

• Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room (Github)

• I bought us-east-1[.]com: A Look at Security, DNS Traffic, and Protecting AWS Users (Dev.to)

📝 Best Of Blogs

• Probing Slack Workspaces for Authentication Information and other Treats (PaperMtn)

• How to mitigate bot traffic by implementing Challenge actions in your AWS WAF custom rules(AWS)

• EMERALDWHALE: 15k Cloud Credentials Stolen in Operation Targeting Exposed Git Config Files (Sysdig)

🧠 Learning Resources

• The dark side of github actions (Adnan Khan)

• How To Scan The Entire Cloud (Ben Sadeghipour)

• The state of security in Rails 8 (Greg Molnar)

🛠️ Tools

• Zizmor - A tool for finding security issues in GitHub Actions setups. (GitHub)

• Whispr - A multi-vault secret injection tool for safely injecting secrets into app environment. (Github)

• Miri - An interpreter for Rust's mid-level intermediate representation. (GitHub)

⚡️ Misc

• Malicious Open Source Library Analysis: llm-oracle and its Payload (Safedep)

• The Hacker that Broke North Korea's Internet (Slidebean)

• Typosquat Campaign Targeting npm Developers (Phylum)

🎯 Favorite Quote

“Success usually comes to those who are too busy to be looking for it.”
_{- Henry David Thoreau}