DevOoops (Increase awareness around DevOps infra security)
summary
Giving developers sudo causes widespread downtime and misconfiguration; GitHub leaks expose FTP creds, private keys and full DB dumps and leave 219,000 .git-exposed sites that allow full repo cloning. Jenkins instances (a few thousand) leak credentials and offer a groovy script console for remote code execution. Vagrant ships with a default SSH key reused across thousands of boxes. Exposed Elasticsearch, Redis and Memcached lead to malware, session theft and crypto-mining; mounting the Docker socket → host takeover is trivial and common.
AI-written summary · about
chapters (23)
- 0:00Introduction and speaker background
- 1:10What DevOps means for security
- 2:35Common DevOps security issues
- 3:40Developer superpowers gone wrong
- 5:05GitHub information leakage risks
- 8:00Trusting GitHub user identities
- 11:15Git deployment security pitfalls
- 13:50Exposed .git folders on the web
- 16:20Subversion and SQLite vulnerabilities
- 17:21Jenkins remote code execution risks
- 20:59Jenkins credentials and config files
- 22:25Provisioning tools and secret keys
- 23:51Vagrant default SSH key exposure
- 25:39Vagrant shared folder backdoors
- 27:29Elasticsearch exposed on the internet
- 29:16Binding services to localhost
- 30:19Redis and in-memory database risks
- 32:06Redis data loss and clustering attacks
- 33:32Memcached private key exposure
- 34:39Docker socket and container security
- 37:07Docker host takeover via API
- 38:57Embracing DevOps securely
- 39:18Auditing DevOps practices
related talks
33mGaining initial access by exploiting leaked credentials
22mDevSecOps - The Story of 3 Security Breaches
07mDon't Go There! Horrible Devops Security Blunders
51mHow hackers can breach your C.I / C.D systems
32mContainer Security: Exploits, Vulnerabilities and Defense
24mHow to Find if Your Developers are Leaking Secrets?
52mDevOops: Redux
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk