Because sometimes it’s not possible to change sender and receiver and you must have a man in the middle.. import java.io.IOException; import java.io.OutputStream; import java.net.InetSocketAddress; import java.net.URI; import java.net.URLEncoder; import java.nio.ByteBuffer; import java.util.Base64; import java.util.concurrent.atomic.AtomicReference; import java.util.regex.Pattern; import java.util.zip.DataFormatException; import java.util.zip.Deflater; import java.util.zip.Inflater; import com.sun.net.httpserver.HttpExchange; import com.sun.net.httpserver.HttpHandler; import com.sun.net.httpserver.HttpServer…

As of time of writing Guacamole 1.4.0 available from DockerHub is built on old Debian with old libssh2 1.8.0 not supporting EC cryptography. To be able to use modern SSH we must bake own guacd container image. I decided to do it one time manually, so the Dockerfile is simplified…

The first choice for API security in the microservice architecture is OpenID Connect 1.0 and JWT. It’s important to know that there many ways to use JWT incorrectly. The JWT created as a result of interactive user authentication is copied to next (nested) API calls. It’s very easy to copy…

You installed very cool container security tool on every Kubernetes cluster in your enterpise. Some containers crush or hang, REST calls don’t work. Can we decompile the software to analyze what’s wrong? Yes, provided that we are in EU (see: https://eur-lex.europa.eu/EN/legal-content/summary/computer-programs-legal-protection.html) Decompilation * Prior authorisation from the rights-holder is not…

Incident Response on AWS EC2 instance is easy. You need remote access and you just execute Incident Response script. What about EC2 instance hosting Kubernetes node without remote access to host OS? We can use privileged pod with host filesystem mounted. CONTAINERD=$(ps aux | grep -c “/usr/bin/containerd-shim-runc-v2”) INSIDE_PRIV_CONTAINER=0 [ $CONTAINERD -gt 0…

Mature organization uses internal reusable Malware Scanning API. Except clamav and standard command-line anti-virus Cyber Defence Center can expose as API malware detonation sandbox. Malware should not be run in a standard container because it can escape and infect the host. It should be run in the Firecracker or Kata…

The observation that people using complex, heavy and formal security frameworks miss and don’t understand very basic security gaps of modern IT ecosystem led me to the decision to write about the need for simple cloud threat modelling. Well established security frameworks are very formal and resemble waterfall. In ever…