Posts on security
10 posts on security. Notes from public sources and my own test lab.
Trivy: Leveraging the Swiss Army Knife of Container Security
Why looking for CVEs isn't enough. My experience with Trivy in DevSecOps pipelines and how it exposes the 'security illusion' beyond just image scanning.
Can Your Neighbor’s Smart Bulb Lead to Your Local Network? Pushing the Boundaries of IoT Security
Join Sedat Özdemir as he explores the 'dark alleys' of IoT security, from the dangers of Shadow IoT to unencrypted protocols like MQTT, and why your office coffee machine might be your biggest vulnerability.
Smart Devices, Dumb Passwords: Infiltrating the IoT World via Firmware
A deep dive into the reality of IoT security, moving from physical UART pins to firmware reverse engineering, and why 'security by obscurity' is a myth.
Smart Homes, Stupid Mistakes: Leaving the Backdoor Open in the IoT World
Think a tiny smart plug is harmless? From 'admin:admin' nightmares to unencrypted MQTT traffic, let's explore why IoT is the 'Wild West' of cybersecurity and how we can secure these chatty devices.
Is Everyone Root in Your K8s Cluster? Let's Stop the Orchestration Chaos
A deep dive into common Kubernetes security pitfalls like wide-open API servers and over-privileged RBAC roles, and how to secure them from a Red Teamer's perspective.
Betrayal of the Dependencies: The Art of Supply Chain Attacks and Defense
Ever wondered how a single typo in your package.json could compromise your entire infrastructure? Let's dive into the world of Software Supply Chain security and learn how to defend your fortress from the inside out.
Smart Homes or Digital Minefields? The Invisible Backdoors of the IoT World
Standard vulnerability scanners aren't enough for the world of ARM processors and unpatched BusyBox versions. Let's talk about why you need to dig into the hardware and firmware to truly secure IoT devices.
Smart Home, Dumb Holes: The Art of Becoming Root in the IoT World
IoT devices are often built for speed, not security. From default passwords to unencrypted MQTT traffic, let's explore why these 'smart' gadgets are a Red Teamer's favorite playground and how to lock them down.
From Smart Bulbs to Corporate Networks: The 'Default' Disaster in IoT Security
Think that smart coffee machine in the breakroom is harmless? Think again. Let's dive into how 'default' settings and lazy engineering turn IoT devices into a Red Teamer's favorite entry point.
Getting Lost in the Kubernetes Labyrinth: Can You Truly 'Hacker-Proof' Your Cluster?
Ever felt the cold sweat of a cloud bill exceeding your company valuation? Let's look at Kubernetes security through a Red Teamer's lens and fix those common YAML blunders.