Unit 42

Consider the possible ways for a string to be injected into any of the following: Apache Solr Apache Druid Apache Flink ElasticSearch Flume Apache Dubbo Logstash Kafka If you've got any of them, they're likely exploitable too. That list comes from: https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-202… The attack surface is quite a bit larger than many realize. I recently had a conversation with a person who wasn't at a Java shop so wasn't worried... until he said "oh, wait, ElasticSearch is vulnerable too?" You'll even see it in things like the connector between CouchBase and ElasticSearch ( https://forums.couchbase.com/t/ann-elasticsearch-connector-4-3-3-4-2-1… ).

https://unit42.paloaltonetworks.com/new-os-x-ransomware-keranger-infec… It turned out to be ransomware, for anyone not following.

Palo Alto Networks - Unit 42 | Principal Security Automation Engineer | Full-Time | Remote | https://unit42.paloaltonetworks.com/ We are looking for a principal level engineer with experience in React and Python to work on the Unit 42 Engineering organization inside Palo Alto Networks. Day to day, the candidate will help build the tools/services that Palo Alto Networks researchers rely on to better understand threats and help them collaborate across our products. We are looking for someone with strong React skills, who feels at home working with REST APIs. Some of our technology stack: - Python (API/backend/clients) - JS (React) - Kubernetes - GCP - GitLab CI Some no BS reasons you would want to work on the Unit42 Engineering org: 1) We are an internal team helping researchers across Palo Alto Networks find and squish threats to our customers and the internet as a whole 2) If you are interested in security work, there is an incredible diversity of talent on the team and a deep rooted culture of sharing knowledge 3) You get to work with really interesting data and there are always interesting engineering challenges to be solved More information about the job: Principal Security Automation Engineer - https://jobs.paloaltonetworks.com/job/13435047/principal-security-auto…

Definitely not secure. The author did a great job explaining container runtimes in basic terms, but there's a lot of security features missing. Mainly: * Reducing the container's capabilities * Restricting access to resources through cgroups * Applying seccomp filters to prevent certain syscalls. As another comment suggested, user namespaces are another hardening feature, but not all container runtimes enable it by default. Podman does, Docker doesn't. In fact user namespaces are so powerful that I believe they pretty much cover most of the hardening provided by the three features I listed above. If you're wondering why they're not enabled by default in Docker, take a look at this [1]. Exploiting the missing isolation mechanisms, the following bash commands will allow you to escape from the author's containers: $ ls -al /sys/dev/block # find the root fs device (e.g. /dev/sda1) major and minor device numbers (e.g. {maj=8, min=1}, {maj=259, min=1}) $ mknod --mode 0600 /dev/host_fs_dev b $major $minor $ mkdir /host_fs && mount /dev/host_fs_dev /host_fs (warning: shameless plug to my posts follows:) If you want more details, I wrote a post on this exact same problem in the context of three vulnerabilities I found in rkt (another container runtime) [2]. Beside the issues above, the author's runtime also exposes host file descriptors like /proc/self/exe that can be used to escape the container. This is a post I wrote on runC CVE-2019-5736 that explains this kind of…

That is what the tj-actions attacker did: https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack…

We work in the arena of automated AI workflows where consistency of success is vital. When you threaten an LLM you are drawing the LLM into the texts where threats occur (flame wars, parody, etc.). So intuitively you would expect it to work sometimes, but also fail with even more ardent refusal (increasing the variance of success). Jailbreak approaches like "Bad Likert Judge" ( https://unit42.paloaltonetworks.com/multi-turn-technique-jailbreaks-ll… ) and similar persuasive techniques (see https://xthemadgenius.medium.com/how-persuasion-techniques-can-jailbre… ) move the text domain to more policy, analysis, or scientific papers, where deeper analysis, discussion, and compliance is the norm. So I'm curious about the extremes (variance) of success with threatening vs. polite discussion, but I haven't seen direct research on that.

Original source: https://unit42.paloaltonetworks.com/malicious-payloads-as-bitmap-resou… (https://news.ycombinator.com/item?id=43941757)

How Azure isolates VM's is completely unrelated, because containers are not VM's. And if you meant to assert that Azure uses hardware assisted isolation between tenants in general, that was not the case for azurescape [1] or chaosDB [2]. [1] https://unit42.paloaltonetworks.com/azure-container-instances/ [2] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerabili…

There are always new security vulnerabilities found on these network devices and they directly face the internet. Most of these companies tend to EOL them after a few years and often continue to sell that close to or after the EOL date. This link is from a quick query on dlink routers. https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found…

The dark remix version of this is fast flux hosting and what a lot of the bulletproof hosting providers use. https://unit42.paloaltonetworks.com/fast-flux-101/

They were able to spoof tokens for a long time, access mailboxes, etc. If this isn't enough for you, there's also ChaosDB, the cross-account vulnerability Palo Alto found (https://unit42.paloaltonetworks.com/azure-container-instances/), among many others. This isn't an isolated instance, that's a pattern.

Source: https://unit42.paloaltonetworks.com/fake-cve-2023-40477-poc-hides-veno…

In some cases, localhost is not just accessible from localhost :) https://unit42.paloaltonetworks.com/cve-2020-8558/ Also SSRF risks as mentioned elsewhere ...

I have a vague memory about a security talk where they used TXT records to deliver a payload to a machine and they had to write such code that the rows returned in the TXT records could be run in any order because the order the TXT records are returned is not deterministic. I couldn't find the talk, but I found this nice article: https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abuse…

You can find the original writeup here: https://unit42.paloaltonetworks.com/jsonwebtoken-vulnerability-cve-202… It's pretty much yet another one one the pile of object deserialization vulnerabilities.

your code may be secure, but your cloud neighbor or VM host may be not. if VM host machine is taken over, then your VMs are at risk too https://unit42.paloaltonetworks.com/azure-container-instances/

It's not generally something browsers can do as there's no distinction about local addresses in IP (except localhost and IPv6 link-local addresses...) Also see DNS rebinding attacks: https://unit42.paloaltonetworks.com/dns-rebinding/

Corollary is, spyware can use DNS to exfiltrate data [0]. Or, send out client-side metrics with cleverly drafted DNS requests [1], or use it as a 3p-cookie replacement [2]. [0] https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abuse… [1] https://github.com/Jigsaw-Code/choir (disclosure: I co-develop hard-forks of two other related Jigsaw-Code projects) [2] http://dnscookie.com/

CVEs for breaking out of a docker container come along as well [1]. Usually you need root in the docker container, but if you combine it with an escalation from non-root to root.. well, you can see how that's less secure than a VM [1] https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explainin…

The one in recent memory for me is the KeRanger ransomware that was distributed in the official Transmission installer. https://unit42.paloaltonetworks.com/new-os-x-ransomware-keranger-infec… >Transmission representative John Clay told Reuters via email that the ransomware was added to disk-image of its software after the project's server was compromised in a cyber attack. >"We're not commenting on the avenue of attack, other than to say that it was our main server that was compromised," he said. "The normal disk image (was) replaced by the compromised one."

How do you be careful? You can't trust the cloud provider: https://unit42.paloaltonetworks.com/windows-server-containers-vulnerab… https://media-exp1.licdn.com/dms/image/C5622AQH70okwLkMlNg/feedshare-s… What about the concept of not having roommates? Plenty of infrastructure alternatives exist besides "containers".

You can use https://www.wireshark.org to see HTTP traffic and MITM yourself for HTTPS(https://unit42.paloaltonetworks.com/wireshark-tutorial-decrypting-http… That will only work for the data that you send to them yourself. You can't possibly see any data that they send to third parties that they send through their servers.

Query params often end in stuff like web server (WAF, load-balancer, reverse proxy, ...) access logs and they might get accidentally exposed. They shouldn't get exposed of course, but they do. [EDIT: redacted an example of some random dude's access log] If you search for "password" in there you will likely see a new Mirai bot variant [1] bouncing credentials off the server looking for weblogin.cgi on vulnerable Zyxel devices. I imagine PA highlit this detail in their post ("weblogin.cgi accepts both HTTP GET and POST") exactly to ensure sure defenders don't restrict themselves to blocking or investigating only the more normal POST mechanism. [1] https://unit42.paloaltonetworks.com/new-mirai-variant-mukashi/

Research shows that "more than 70% of NRDs are “malicious” or “suspicious” or “not safe for work.” This ratio is almost 10 times higher than the ratio observed in Alexa’s top 10,000 domains." https://unit42.paloaltonetworks.com/newly-registered-domains-malicious…

Normal DNS over UDP can also contain arbitrary data, which completely hypothetcally could be used to send identifying data about the client. E.g. https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abuse… But that's not really a strike against the protocol, that would be a fault of the implementation.

For the people that think this is legitimate software, this is not legitimate software. It is sold and encouraged as malware, used to blackmail girls (barely women) - that's what "cam capture" is for - keylogger, general malware, backconnect proxy, auto-start and persistence. See https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/ for more details and screenshots/quotes of posts by the creator of the tool. This is _not_ for server administration. This is _not_ like PuTTY or Remote Desktop. This is like Blackshades or Orcus. It is malicious, only sold for malicious usage.

There are two solutions GitHub Actions people will tell you about. Both are fundamentally flawed because GitHub Actions Has a Package Manager, and It Might Be the Worst [1]. One thing people will say is to pin the commit SHA, so don't do "uses: randomAuthor/some-normal-action@v1", instead do "uses: randomAuthor/some-normal-action@e20fd1d81c3f403df57f5f06e2aa9653a6a60763". Alternatively, just fork the action into your own GitHub account and import that instead. However, neither of these "solutions" work, because they do not pin the transitive dependencies. Suppose I pin the action at a SHA or fork it, but that action still imports "tj-actions/changed-files". In that case, you would have still been pwned in the "tj-actions/changed-files" incident [2]. The only way to be sure is to manually traverse the dependency hierarchy, forking each action as you go down the "tree" and updating every action to only depend on code you control. In other package managers, this is solved with a lockfile - go.sum, yarn.lock, ... [1] https://nesbitt.io/2025/12/06/github-actions-package-manager.html [2] https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack…

I did apologize, didn't I? :-) Perspective is everything, I guess. You look at that three year old comment and think it's not particularly informative. I look at that comment and see an experienced infosec pro at Fly.io, who runs billions of container workloads and doesn't trust the cgroups+namespaces security boundary enough so goes to the trouble of running Firecracker instead. (There are other reasons they landed there, but the security angle's part of it.) Anyway if you want some links, here are a few. If you want more, I'm sure you can find 'em. CVE-2022-0492: https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups CVE-2022-0847: https://www.datadoghq.com/blog/engineering/dirty-pipe-container-escape… CVE-2023-2640: https://www.crowdstrike.com/en-us/blog/crowdstrike-discovers-new-conta… CVE-2024-21626: https://nvd.nist.gov/vuln/detail/cve-2024-21626 Some are covered off by good container deployment hygiene and reducing privilege, but from my POV it looks like the container devs are plugging their fingers in a barrel that keeps springing new leaks. (To be fair, modern Docker's a lot better than it used to be. If you run your container unprivileged and don't give it extra capabilities and don't change syscall filters or MAC policies, you've closed off quite a bit of the attack surface, though far from all of it.) But keep in mind that shared-kernel containers are only as secure as the kernel, and today's secure kernel syscall can turn insecure…

> While in no ways perfect, Apple's walled garden gets rid of a huge amount of the enshittification found on other platforms, and makes it so that downloading a random app is relatively safe and unlikely to nuke your phone, steal your data, etc. Yes all the "allow access to location/photos/etc." are annoying, but at least the user has some level of control and consent. Better than Android sure, but let's not get too hyperbolic. There's less outright malware, but a ton of questionable crapware with bad practices. Let's not forget that Android phones definitely also do sandboxing and just-in-time permission prompts. Even among major apps, maybe especially among major apps, the Apple App Store is full of apps that blatantly violate Apple's own policies, often including Apple's own apps too, much like the Google Play store. As a simple example, apps that put crucial notifications in the same category as advertisements are all over the place, despite this being a clear violation of the policies. There is plenty of enshittification on Apple platforms. Beyond that, I can go onto my iPad and search something that is likely to be popular and find a ton of very questionable apps. For example, search "Grand Theft Auto". Scroll down slightly. That sure looks like a lot of very questionable garbage apps full of questionable advertisements. You can repeat this with tons of popular search terms. Yes, it's one thing to trust the sandbox, but are you really sure you feel safe installing…