WorkSpace RCE, M365 Basic Auth Disabled, VMware vCenter cve-2021-22005, ZeroTrust Kubernetes

Intro

Welcome Dear listeners, I’m Viktor your host and as a weekly basis I will share news, articles, techniques, tools that is related to Cloud, SaaS, IaaC security. All the URLs for the news, articles and tools can be found here: https://www.buzzsprout.com/1844597

Basic Authentication for All Exchange Online Tenants Stops in October 2022 - https://office365itpros.com/2021/09/24/basic-authentication-exchange-online-tenants-stops-october-2022/

AWS WorkSpaces Remote Code Execution - https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/

Revisiting Lambda Persistence - https://frichetten.com/blog/revisiting_lambda_persistence/

The Fault in Our Stars: Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion - https://www.tenchisecurity.com/blog/thefaultinourstars

Announcing the winners of the 2020 GCP VRP Prize - https://security.googleblog.com/2021/03/announcing-winners-of-2020-gcp-vrp-prize.html

Common AWS Security Vulnerabilities - https://twitter.com/devansh3008/status/1441071846011465731

How AWS dumps the mental burden of inconsistent APIs on developers - https://www.lastweekinaws.com/blog/how-aws-dumps-the-mental-burden-of-inconsistent-apis-on-developers/

VMware CVE-2021-22005 Technical & Impact analysis - https://censys.io/blog/vmware-cve-2021-22005-technical-impact-analysis/, https://gist.github.com/testanull/c2f6fd061c496ea90ddee151d6738d2e, https://testbnull.medium.com/quick-note-of-vcenter-rce-cve-2021-22005-4337d5a817ee

AWS Economic Investment Study - #AWS Investment in New Zealand - https://twitter.com/jeffbarr/status/1441069455316897795, https://anz-resources.awscloud.com/new-aws-region-in-aotearoa-new-zealand/aws-investment-in-new-zealand-aws-economic-impact-study

Amazon Detective supports S3 and DNS finding types, adds finding details - https://aws.amazon.com/about-aws/whats-new/2021/09/amazon-detective-s3-dns/

Stream Azure AD Identity Protection events to Azure Sentinel/ Log Analytics - https://jeffreyappel.nl/stream-azure-ad-identity-protection-events-to-azure-sentinel-log-analytics/

IAM roles for Kubernetes service accounts - deep dive - https://mjarosie.github.io/dev/2021/09/15/iam-roles-for-kubernetes-service-accounts-deep-dive.html

Deploy multi-cloud, Zero Trust Kubernetes in less than an hour - https://netfoundry.io/multi-cloud-kubernetes-zero-trust/

Secure containerized environments with updated threat matrix for Kubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/

Extracting all the Azure Passwords - Karl Fosaaen (DEF CON 29 - Cloud Village) - https://www.youtube.com/watch?v=CUTwkuiRgqg

DEF CON 29 Cloud Village - Felipe Pr0teus - Hunting for AWS Exposed Resources - https://www.youtube.com/watch?v=uLI24keCKFs

Azure Sentinel Notebooks Ninja series released - https://twitter.com/rodtrent/status/1439964596299870213

September 2021 update for Microsoft 365 Security for IT Pros - https://twitter.com/vanhybrid/status/1440017512142364675

Auditing used Power Automate Connections - https://365bythijs.be/2021/09/20/auditing-used-power-automate-connections/

Azure AD Conditional Access Policy Design Baseline with Automatic Deployment Support - https://danielchronlund.com/2020/11/26/azure-ad-conditional-access-policy-design-baseline-with-automatic-deployment-support/

Gitoops - https://github.com/ovotech/gitoops/

That’s all for this episode. Thank you for listening and have a secure day!