14million. That’s the estimate by Qualys of the number of servers potentially vulnerable to CVE 2024-6387 aka regreSSHion that are “exposed to the internet”. That seems like a lot of machines to me. I’m not a security specialist and while we do a little work for some of our smaller clients that involves internet facing services the bulk of what we do is on private corporate networks. I’m not the best person to comment on this, I accept that. But still. I’m still a little surprised at the number of machines that would have a valid use case for having an SSH daemon process exposed to the internet. Or have I just misunderstood the statement by Qualys? Whenever we design systems, HPC or not, cloud or on-prem, large scale enterprise or early stage startup, access to everything is designed to be at the lowest possible level. Servers do not have SSH daemon port exposed to any public networks. That sort of access is always via another level of indirection. A bastion host, a jumpbox, via a corporate secure link. Oh and you write a test case for every bug you fix so they’re not regressed right? (Yea I know race conditions are kind of a pain/impossible to do… )
Hamza M.’s Post
More Relevant Posts
-
According to IBM's X-Force Cloud Threat Landscape report, "The #1 failed security rule in 100% cloud-only environments involved improper configuration of essential security and management settings in Linux® systems." This is precisely why DeployHub manages and stores these configurations from deployments and other security metadata, like SBOMs, real-time CVEs, and OpenSSF Scorecard results. #DevSecOps https://www.deployhub.com/
-
-
VMware vCenter- critical flaw paving the way for remote code execution. The vulnerability CVE-2024-38812 (CVSS score: 9.8), has been described as a heap-overflow vulnerability in the DCE(Distributed Cloud Environment) /RPC (Remote Procedure Call) protocol. "A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution."
-
-
Data Analyst | Cloud Engineer I | Data Management, AWS, CI/CD | Transforming Data & Cloud Infrastructure Through Innovation
Ever felt like Agent 47 from Hitman, slipping past digital barriers with unmatched stealth? 🎮 Well, I've channeled that same energy into my latest blog: "Setting Up a Free VPN Server in AWS"! In this guide, I walk you through how to set up your very own OpenVPN server on AWS—a free-tier safehouse for secure browsing, geo-restricted content access, and more. Whether you're dodging trackers or flexing your cloud skills, this is a mission you don't want to miss. 💻🌐 Suit up and take control of your online privacy today! 🕶️ #AWS #OpenVPN #DevOps #CloudComputing #CyberSecurity #TechBlog
-
Public preview: #Azure Application Gateway introduces support for TLS and TCP protocols. In addition to the existing Layer 7 capabilities (HTTP, HTTPS, WebSockets and HTTP/2), Azure Application Gateway now also supports Layer 4 (TCP protocol) and TLS (Transport Layer Security) proxying. This feature is currently in public preview. Microsoft https://lnkd.in/dSVw_ntp
-
-
https://lnkd.in/dRvM4JEw Upgrade to the cloud they said, move your mainframe applications to the cloud they said, it was the best thing to do. BTW, Z in Z16 means zero downtime and they mean it ;-)
Microsoft ‘Blue Screen of Death’ CrowdStrike outage hits Windows PC globally
thehindubusinessline.com
-
Senior Cloud Technical Architect | Cloud Consultant | Cloud Strategy | Cloud Advisor | Azure | AWS | IaaS | DevOps | Migration | Cloud Security | Cost Optimization | Terraform (IaC) | Bash,Powershell
To connect Azure CosmosDB over private endpoint. 1. Deploy the Azure CosmosDB 2. Create and configure the private endpoint on CosmosDB 3. Make sure VNet is linked to Azure Pricate DNS zone “https://lnkd.in/dYxzzy4m” 4. Open the port tcp 0-65536, on the firewall, if any 5. Connect to CosmosDB from CosmosDB explorer by using the connection string
-
If you're affected, here's CrowdStrike's advice: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching “C-00000291*.sys”, and delete it. 4. Boot the host normally. 5. Repeat 50,000 times (enterprise only) (Can you guess I added number 5? 😛) Edit: Booting into safe mode might be harder if you have Bitlocker enabled. Update: 👇 There are reports of the CS patch being successfully downloaded before a BSOD. This can take anywhere from 3 to 50+ reboots. May the odds be ever in your favour. Also, if you're recovering cloud systems: 1. Unmount the OS drive with the bad CS driver 2. Mount to a new host 3. Delete the .sys file above 4. Mount back to original host
-
Just wanted to share this resource group I created in class via Microsoft azure, I have a virtual network with 4 virtual machines (one with a public IP address) with a load balancer and firewall both with their own sets of rules to filter and monitor traffic. I've attached this diagram as a visual representation of the resource group
-
