Security Leftovers and Windows TCO
-
Remote Code Execution in Ansible dynamic inventory plugins
I had reported this to Ansible a year ago (2023-02-23), but it seems this is considered expected behavior, so I am posting it here now.
[...]
Inventory plugins allow Ansible to pull inventory data from a variety of sources. The most common ones are probably the ones fetching instances from clouds like Amazon EC2 and Hetzner Cloud or the ones talking to tools like Foreman.
For Ansible to function, an inventory needs to tell Ansible how to connect to a host (so e.g. a network address) and which groups the host belongs to (if any). But it can also set any arbitrary variable for that host, which is often used to provide additional information about it. These can be tags in EC2, parameters in Foreman, and other arbitrary data someone thought would be good to attach to that object.
And this is where things are getting interesting. Somebody could add a comment to a host and that comment would be visible to you when you use the inventory with that host. And if that comment contains a Jinja expression, it might get executed. And if that Jinja expression is using the pipe lookup, it might get executed in your shell.
Let that sink in for a moment, and then we'll look at an example.
-
Windows TCO
-
India Times ☛ white house unitedhealth ceo: White House meets with UnitedHealth CEO over hack
The meeting was the first to bring together providers such as hospitals and payers such as health insurers, said a spokesperson from the Department of Health and Human Services (HHS), adding that daily individual meetings have been held with all involved parties since the hack.
-
Security Week ☛ EquiLend Ransomware Attack Leads to Data Breach
Fintech firm EquiLend has started sending notification letters to its employees to inform them of a data breach resulting from a January 2024 ransomware attack.
On January 24, the company announced that some of its systems were taken offline due to “a technical issue” and that services would be disrupted for several days.
-
France24 ☛ French state services hit by cyberattacks of 'unprecedented intensity'
A DDoS attack involves using a computer or network of computers to make a massive number of requests of a target system, overwhelming its ability to respond to legitimate users.
According to US cybersecurity firm Cloudflare, Anonymous Sudan is one of many groups employing DDoS attacks and organisations can protect themselves against its methods.
-