Dan GoodinIs anyone following this breach involving the j-actions/changed-files GitHub Action? Seems pretty major, but I'm still trying to figure out exactly what's going on, who's affected, and what people (and how many) are affected. If you can help me get up to speed please DM me on Signal -- DanArs.82, or on Mastodon https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
Jerry Dixon
- 215 Followers
- 39 Following
- 20 Posts
CISO @ CrowdStrike -former DHS NCSD/US-CERT Alum & Desert Storm Vet (AATW)
@JosephMenn still crazy to me that vendors require you to buy the “security log SKU” to be able to monitor for attacks or build alerting to enable rapid response. Microsoft and Salesforce are two big firms that hold lots of sensitive data but require you to spend big bucks for telemetry for their apps/infra!
@briankrebs Damon is a sharp dude and thanks for sharing!
BrianKrebsThere's an important vulnerability being disclosed today that allows attackers to massively increase the size of DDoS attacks.
The flaw is being tracked as CVE-2023-44487, a.k.a. "HTTP/2 Rapid Reset Attack." According to Damian Menscher at Google, the attack "works by sending a request and then immediately cancelling it (a feature of HTTP/2). This lets attackers skip waiting for responses, resulting in a more efficient attack."
More info:
https://aws.amazon.com/blogs/security/how-aws-protects-customers-from-ddos-events/
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
@RyanWelsh in the mid-Atlantic :)
@binsk exactly - my thoughts
Fun doc visit today-power goes out comes back quickly then all the Windows machines started updates-took 15 minutes before they were able to view X-rays or access electronic health records - Doc apologizing and then we talked about PC hygiene :) meanwhile waiting room getting full due to delays from the updates - plus entertaining with nurses running to each room to see if there was a machine back up and running …15 minute ripple effect FTW
@mdfranz already regretting looking… :)
@mdfranz now I have to go look …
Eric Capuano1Password to begin collection anonymous telemetry (no user/site/vault info) to help measure application performance.
I can appreciate their over-the-top transparency and commitment to not collect actual user data, but making this opt-out versus opt-in is a head scratcher.
Give your users the option to actively opt-in, not an opt-out they will probably never see. @1password
https://blog.1password.com/privacy-preserving-app-telemetry/ #1password
