Seth Art
LightNews LightNews
sethsec.bsky.social
Seth Art
@sethsec.bsky.social
610 followers 110 following 9 posts
Security Research and Advocacy @ Datadog. Former Principal and Cloud Penetration Testing lead @BishopFox. I like to build, break, learn, and share. 
CloudFox, CloudFoxable, BadPods, IAM Vulnerable
Posts Replies Media Videos
Reposted by Seth Art
securitylabs.datadoghq.com
The July edition of the Datadog Security Digest is out!

securitylabs.datadoghq.com/newsletters/...

• Cloud image investigator by @sethsec.bsky.social
• Our top picks for Black Hat / DEF CON
• A benchmark for LLM coding accuracy and security
• Malicious Homebrew installation campaign
.. and more
Preparing for Hacker Summer Camp and a new cloud image investigator | Datadog Security Labs
This month’s digest covers Hacker Summer Camp prep, a new cloud image investigator, and supply-chain vulnerabilities associated with the Open VSX Registry.
securitylabs.datadoghq.com
July 31, 2025 at 9:00 PM
Reposted by Seth Art
securitylabs.datadoghq.com
fwd:cloudsec is around the corner! Don't miss these 3 talks from Datadog researchers Seth Sec, Katie Knowles, Greg Foss, and Anthony Randazzo.

fwdcloudsec.org/conference/n...

@sethsec.bsky.social
@siigil.bsky.social
@gregfoss.com
June 27, 2025 at 9:02 PM
Reposted by Seth Art
securitylabs.datadoghq.com
The February edition of the Datadog Security Digest is out!

securitylabs.datadoghq.com/newsletters/...

featuring @sethsec.bsky.social, @mccune.org.uk, @karimscloud.bsky.social, @jcfarris.bsky.social, and more
The whoAMI name confusion attack, modern phishing tactics, and K8s network security fundamentals | Datadog Security Labs
This February edition of the Datadog Security Digest dives into the
securitylabs.datadoghq.com
February 27, 2025 at 4:32 PM
Reposted by Seth Art
securitylabs.datadoghq.com
The Datadog Security Digest is a monthly, practitioner-focused newsletter.

Don't miss our February edition going live tomorrow!

securitylabs.datadoghq.com/newsletters/...
February 26, 2025 at 11:55 AM
Reposted by Seth Art
infosec.skyfleet.blue
whoAMI attacks give hackers code execution on Amazon EC2 instances
whoAMI attacks give hackers code execution on Amazon EC2 instances
Security researchers discovered a name confusion attack that allows access to an Amazon Web Services account to anyone that publishes an Amazon Machine Image (AMI) with a specific name.
www.bleepingcomputer.com
February 13, 2025 at 11:59 PM
Reposted by Seth Art
mhjwork.bsky.social
When I first started reading this I though,t “is this really news, this issue has been around for years…” but then it gets interesting - kudos to the researchers on this one!
sethsec.bsky.social Seth Art @sethsec.bsky.social · Feb 12
I’m excited to share our research on the “whoAMI” attack. We discovered that AWS customers pulling AMI IDs insecurely could accidentally use malicious images instead of the legitimate ones— leading to remote code execution.

securitylabs.datadoghq.com/articles/who...
whoAMI: A cloud image name confusion attack | Datadog Security Labs
Detailing the discovery and impact of the whoAMI cloud image name confusion attack, which could allow attackers to execute code within AWS accounts due to a vulnerable pattern in AMI retrieval.
securitylabs.datadoghq.com
February 12, 2025 at 8:25 PM
Reposted by Seth Art
frichetten.com
Need to hack thousands of AWS customers? What about on internal AWS systems? Datadog Security Research found that a number of tools, including one published by AWS, are susceptible to name confusion attacks, leading to RCE in vulnerable environments!

securitylabs.datadoghq.com/articles/who...
whoAMI: A cloud image name confusion attack | Datadog Security Labs
Detailing the discovery and impact of the whoAMI cloud image name confusion attack, which could allow attackers to execute code within AWS accounts due to a vulnerable pattern in AMI retrieval.
securitylabs.datadoghq.com
February 12, 2025 at 5:19 PM
sethsec.bsky.social
I’m excited to share our research on the “whoAMI” attack. We discovered that AWS customers pulling AMI IDs insecurely could accidentally use malicious images instead of the legitimate ones— leading to remote code execution.

securitylabs.datadoghq.com/articles/who...
whoAMI: A cloud image name confusion attack | Datadog Security Labs
Detailing the discovery and impact of the whoAMI cloud image name confusion attack, which could allow attackers to execute code within AWS accounts due to a vulnerable pattern in AMI retrieval.
securitylabs.datadoghq.com
February 12, 2025 at 4:56 PM
Reposted by Seth Art
securitylabs.datadoghq.com
We discovered a pattern in the way many projects retrieve Amazon Machine Images (AMIs), allowing attackers to publish AMIs with specially crafted names and gain code execution within vulnerable accounts.

securitylabs.datadoghq.com/articles/who...

by @sethsec.bsky.social
whoAMI: A cloud image name confusion attack | Datadog Security Labs
Detailing the discovery and impact of the whoAMI cloud image name confusion attack, which could allow attackers to execute code within AWS accounts due to a vulnerable pattern in AMI retrieval.
securitylabs.datadoghq.com
February 12, 2025 at 3:29 PM
Reposted by Seth Art
ramimac.me
New year, new job!

I've joined the amazing @wiz_io research team

My goal is the "work for the security industry, at Wiz"

I wrote a blog post explaining why, and what that means:
ramimac.me/joining-wiz
🧙 Why I’m Joining Wiz
I’m joining the leading cloud security startup, hoping to “work for the Security Industry, at Wiz.”
ramimac.me
January 28, 2025 at 3:01 PM
Reposted by Seth Art
securitylabs.datadoghq.com
Threat insights from Datadog Security Labs for Q4 2024

securitylabs.datadoghq.com/articles/202...
Datadog threat roundup: top insights for Q4 2024 | Datadog Security Labs
Threat insights from Datadog Security Labs for Q4 2024.
securitylabs.datadoghq.com
January 28, 2025 at 3:14 PM
Reposted by Seth Art
jaredshort.com
I'm not saying I'm an AWS expert… but I am saying I finally tracked down the random AWS account charging me small amounts every month and closed it.
January 2, 2025 at 8:23 PM
Reposted by Seth Art
spavel.bsky.social
Well this is grim
weird interaction with a student this week. they kept coming up with weird "facts" ("greek is actually a combination of four other languages") that left me baffled. i said let's look this stuff up together, and they said ok, i'll open a search bar, and they opened... ch*tgpt and i was like "this is not a search bar" and they were like "yes it is, you can search for anything in here" the thing that made me feel crazy is like. every kid that's using this as a browser is getting new BESPOKE false "facts." this isn't "a widespread misconception about X that stems from how it's taught in schools." each individual kid is now hooked into a Nonsense Machine with the "widespread misconception about X" you can start at a baseline. like, ok, in tenth grade we all talk about X thing from history, and that leaves us with some misguided concepts about X, but we can correct that as students get broader understandings of the world but with this, each child is getting UNIQUE wrong facts they are SURE are correct... because they did what we told them to do! they "looked it up"! they got it from somewhere! it's not a kid making up a belief on hearsay and assumption... it's something they think they LEARNED this kid was extremely combative with me, and i understood why. i was sitting in front of him and telling him that the internet, a computer, technology, all these supposedly authoritative things... were wrong. and that i, one person, was right. he basically *couldn't* believe me. 8 135 3.8K 97K ... stillorangecrushed @stilloranged. 7h he decided that i was simply a teacher who'd made a mistake. he could check it, after all! he could look it up! he could find the REAL facts. i obviously hadn't done that, i was just an adult who'd decided i was smarter than him. hence the defensiveness. like i said: i understood 5 760 3.2K 82K stillorangecrushed @stilloranged. 7h ... it was so fucking rough. i did my best, but i am one person trying to work against a campaign of misinformation so vast that it fucking terrifies me. this kid is being set up for a life lived entirely inside the hall of mirrors
July 6, 2024 at 10:15 PM
Reposted by Seth Art
agarri.fr
Plenty of additional information about the compromise of OpenWRT’s online build service, involving command-injection and hash bypass 🧠
December 8, 2024 at 9:32 PM
Reposted by Seth Art
securitylabs.datadoghq.com
Introducing Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages

securitylabs.datadoghq.com/articles/int... by @ikretz.bsky.social

New open-source tool designed to transparently block known malicious PyPI and npm packages.

github.com/DataDog/supp...
Introducing Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages | Datadog Security Labs
Release of Supply-Chain Firewall, an open source tool for preventing the installation of malicious PyPI and npm packages
securitylabs.datadoghq.com
December 6, 2024 at 12:33 PM
Reposted by Seth Art
theomegabit.xyz
Another cool little tool from Datadog Labs. #cybersecurity

https://github.com/DataDog/supply-chain-firewall
GitHub - DataDog/supply-chain-firewall: A tool for preventing the installation of malicious PyPI and npm packages :fire:
A tool for preventing the installation of malicious PyPI and npm packages :fire: - DataDog/supply-chain-firewall
github.com
December 6, 2024 at 12:43 PM
Reposted by Seth Art
securitylabs.datadoghq.com
We're now officially on Bluesky!

Expect:

➔ New articles on Security Labs about cloud, container and application security
➔ OSS projects for cloud security practioners
➔ Conference talks at community conferences

See also our starter pack bsky.app/starter-pack... with our authors and researchers!
December 3, 2024 at 2:30 PM
Reposted by Seth Art
frichetten.com
The self described “Shodan of AWS” is now live! This is an amazing project from Daniel Grzelak that helps democratize cloud resource enumeration for the masses. Very excited about this!
awseye.com
Awseye - See Inside AWS Accounts
Awseye tracks publicly accessible AWS data to help identify and secure known and exposed AWS resources. Empowering defenders with open-source intelligence.
awseye.com
November 26, 2024 at 2:31 AM
Reposted by Seth Art
carnal0wnage.bsky.social
DualCore and I spoke at the Red Team Village this year. Here are the slides. QR code with link to gist with all the reference links on last page. Unfortunately it wasn't recorded.

docs.google.com/presentation...

#redteam #purpleteam #redteamvillage
Modern Red Teaming: macOS, K8s, and Cloud - RTV 24 (Public)
Modern Red Teaming: macOS, K8s, and Cloud Carnal0wnage int0x80
docs.google.com
November 24, 2024 at 7:35 PM
sethsec.bsky.social
The November edition of the Datadog Security Digest is live!
securitylabs.datadoghq.com/newsletters/...

Featuring:
- Exploring Google Cloud default service accounts: deep dive and real-world adoption trends by Christophe Tafani-Dereeper
🧵(1/3)
Google Cloud Trends, DPRK npm Threats, & Privilege Escalation Walkthroughs | Datadog Security Labs
In the November edition, read about Google Cloud Trends, DPRK npm Threats, & Privilege Escalation Walkthroughs, and more.
securitylabs.datadoghq.com
November 22, 2024 at 7:40 PM
Reposted by Seth Art
mccune.org.uk
Latest video in my Kubernetes Security Fundamentals series is out. Looking at some lesser known bits of Kubernetes authentication, bootstrap and static tokens!

youtu.be/1QNKj1rW5H0?...
Kubernetes Security Fundamentals: Authentication - Part 2
YouTube video by Datadog
youtu.be
November 21, 2024 at 10:00 AM
Reposted by Seth Art
scottpiper.bsky.social
Now as a starter pack: go.bsky.app/5HpWAcM
Cloud Security
Join the conversation
go.bsky.app
November 18, 2024 at 3:40 PM
Reposted by Seth Art
redsiege.com
We made it easy for you to find us!
The Red Siege Starter Pack is now up!
Find the team here - go.bsky.app/ERU72bD

#infosec #cybersecurity
November 19, 2024 at 3:37 PM
Reposted by Seth Art
singe.bsky.social
This is such a good story about how "gotofail" started as a drunken brag in a bar and ended up being disclosed to Apple via a burner phone. It was Ryan all along, finally taking credit after all these years!
rya.nc Ryan Castellucci 🜬 @rya.nc · Nov 17
Oh, I never posted my gotofail story on here.

Early 2014, someone came to me about a catastrophic vulnerability in Apple's TLS implementation.

I shit you not, they'd overheard someone at a bar drunkenly bragging about how they were going to sell it to a FVEY intelligence agency for six figures.
November 18, 2024 at 10:53 AM
Reposted by Seth Art
scottpiper.bsky.social
I created a list of Cloud Security folks on here. bsky.app/profile/scot...
November 18, 2024 at 12:57 AM