3 ms·
> notice any of the outbound traffic Outbound traffic is allowed unrestricted in 95% of the deployments, it is just a life fact, people trust their own systems
by auslander 8y ago
> notice any of the outbound traffic
Outbound traffic is allowed unrestricted in 95% of the deployments, it is just a life fact, people trust their own systems.
- nineteen999 8y agoYep, lack of egress filtering everywhere. Scary how many cloud deployments I see that are like this. Improvements in automation tools and the ability of cheap cloud resources enable people to roll out instance after instance with the same basic configuration mistakes.
- auslander 8y agoYum update, pip install whatever :)
- nineteen999 8y agoRubygems for everybody! Or arbitrary docker containers. My current deployments allow outbound SMTP only. All software packages (rpm or whatever) get pushed in via rsync from the outside, or are built in an adjacent lab behind the firewalls and pushed across.
- auslander 8y agoIt may affect the very source box you are using for package downloads. I bet it is allowed to go outside unrestricted. Funny you mentioned Docker, it is a security nightmare in itself.
- nineteen999 8y agoIndeed, although it is connected via rather restrictive corporate proxy. I'd rather have one box on my network exposed where I can monitor it than a thousand instances with unrestricted outbound access in AWS though. Oh yeah - docker. I thought this one was pretty funny: https://threatpost.com/malicious-docker-containers-earn-crypto-miners-90000/132816/ https://threatpost.com/malicious-docker-containers-earn-cryp...
- Kalium 8y agoIt's sometimes surprising who gets unhappy when you tell them they can't just run arbitrary code from places unknown in prod.