Kodem’s Post

Kodem is leveraging patented sensor technology and eBPF to redefine application security. Download the brief to learn how you can gain deep insights and comprehensive coverage with our advanced runtime intelligence. #ApplicationSecurity #eBPF #Cybersecurity

Kodem just published its new executive brief 📝 Read how Kodem's platform sets a new standard in application security by leveraging its patented sensor technology and the power of eBPF. Kodem can see and subscribe to events at the kernel level without impacting the overall stability or security of the system. That gives the Kodem platform access to system events, so it can see everything your application is doing. Check it out: https://hubs.ly/Q02GwfL80 #linux #opensourcesoftware #devsecops

At the rapid pace of a post every 3-ish months, my efforts to bootstrap a blog continue! In this quarter-year's installment, I've spent some time getting hands-on with eBPF, a technology in the Linux kernel that allows us to safely bind small programs to kernel and user-space hooks, enabling a plethora of use cases in the monitoring/security/SDN space. It is the magic on which tools like Cilium, Pyroscope and Katran rest on. I work through an example using it to capture unencrypted OpenSSL sessions by hooking the libraries API in user space. https://lnkd.in/eRAXhGRi

Kubernetes 1.30: Beta Support For Pods With User Namespaces The Linux kernel offers user namespaces to isolate container UIDs and GIDs from the host. This enhances security by restricting the container's access to host files and processes. Kubernetes 1.30 has moved user namespaces to beta, offering enhanced features including custom UID/GID mapping and runtime feature enforcement. The feature mitigates container breakout vulnerabilities and is supported by specific kernel versions and container runtimes. For further details, consult the documentation.

🚀 For all Windows forensics enthusiasts! 🚀 If you're familiar with Plaso2timeline, the powerful timeline tool, then you know how essential it is for forensic analysis. But whether you're team Ubuntu or team Windows, I've got you covered! I've just created a posts that walks you through running Plaso on both Ubuntu and Windows. My goal was to make the guide as straightforward as possible, so you can get the most out of this incredible tool, no matter your OS preference. 🔍 What's unique in Windows? The process to parse all artifacts separately using Eric Zimmerman's tools and then collect all outputs into a single .plaso file for analysis. While it may be time-consuming, it's a highly effective method. The best Method (I have showed how to parse most artifacts with Plaso while using Eric Zimmerman's MFTECmd tool(Best tool for MFT Analysis) for the $MFT—ensuring a thorough and precise analysis. Than combining both Plaso files and making into one than either forwarding the parse artifact to Timesketch or Elasticsearch or Further parsing artifact into excel format for analysis into timeline explorer) Check out the posts and let me know your thoughts! 🌐 Windows Version:- https://lnkd.in/ddfbey_8 Ubuntu Version:- https://lnkd.in/dwkh5dub #Forensics #CyberSecurity #Plaso #DigitalForensics #WindowsForensics #Ubuntu #EricZimmermanTools #TimelineAnalysis

New blog post! Dive into Linux detection engineering with Auditd & Elastic's Auditd Manager integration. Learn setup, log interpretation, & how we leverage Auditd (Manager) for detection engineering. Check it out: https://lnkd.in/eCvYcgJF #linuxsecurity #elasticsecurity #auditd #linux #detectionengineering

Nmap, short for "Network Mapper," is a free and open-source utility designed for network exploration and security auditing. It proves beneficial for system administrators, aiding in network inventory, service upgrade scheduling, and host/service uptime monitoring. Nmap utilizes unique methods with raw IP packets to determine available hosts, offered services, operating systems, and firewall configurations. Compatible with major operating systems like Linux, Windows, and Mac OS X, Nmap includes an advanced GUI (Zenmap) and specialized tools for data transfer, result comparison, and packet analysis. TryHackMe

CVE-2024-1086 Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques An incredibly detailed and well-presented article by notselwyn about exploiting a logical bug in the netfilter subsystem. The shared exploit leverages the bug to get a page double-free primitive and then execute the Kernel Space Mirroring Attack (KSMA) via a novel Dirty Pagedirectory technique. The amount of knowledge shared in the article is impossible to encompass in a brief summary, so go check it out yourself! 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 1.8 5.9 Google Inc. 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 1.8 5.9 NIST 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H N/A N/A RedHat-CVE-2024-1086

Critical Vulnerability in OpenSSH (CVE-2024-6387). Potential for remote code execution or DoS attack due to a signal handler race condition. Update or mitigate ASAP. Learn more: https://lnkd.in/dEJV7sKu

Just getting deeper into understanding nmap, metasploit, and everything metasploit has to offer through tryhackme!