Top all-time · #7231
Appsecco
Company blog · blog.appsecco.comsecurity
Appsecco is the company blog at blog.appsecco.com, writing about security. Since 2017, 10 different Hacker News readers have linked it 10 times, most often “Breaking Full Disk Encryption from a Memory Dump”. No feed was found, so read it on the site itself.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN commenters link Appsecco's security posts as sources on SSRF in cloud and Kubernetes environments, full-disk encryption key extraction from RAM, and an exploit against the Kubernetes control plane. The comments do not judge the writing.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Security research and technical deep dives from the Appsecco team — cloud attacks, Kubernetes security, vulnerability analysis, and AppSec engineering.
Most-linked posts?
- Breaking Full Disk Encryption from a Memory Dump3 people · 3 mentions · first linked 2018-08-03
What Hacker News says?
I'm glad SSRF is getting more attention. It's incredibly potent, especially in cloud/k8s/micro services eras. Some good examples: - From screenshot service to Kubernetes account takeover at Shopify: https://hackerone.com/reports/341876 - SSRF and the Capital One breach: https://blog.appsecco.com/an-ssrf-privileged-aws-keys-and-th...
Comment linking /an-ssrf-privileged-aws-keys-and-the-capital-one-breach-4c3c2cded3af
on “OWASP Top 10 2021”Submitted A penetration tester’s guide to sub-domain enumeration as a story · 308 points
HN discussionMay I suggest to turn off logging for your own server too? :-) Anyone with physical access to the server can access the logs, maybe even when the disks are encrypted, I can imagine someone with the right knowledge can extract the key from RAM on a running server: https://blog.appsecco.com/breaking-full-disk-encryption-from...
Comment linking /breaking-full-disk-encryption-from-a-memory-dump-5a868c4fc81e
on “Show HN: A small bootstrapped independent VPN company in the Netherlands”Submitted Exploiting weak configurations in Amazon Cognito (2021) as a story · 2 points
HN discussionI'll have to look it up, but there was an unauthenticated exploit against the control plane a while ago. Probably https://blog.appsecco.com/analysing-and-exploiting-kubernete... CVE-2018–1002105
Comment linking /analysing-and-exploiting-kubernetes-apiserver-vulnerability-cve-2018-1002105-3150d97b24bb
on “Why the hell is your Kubernetes API public?”Submitted AWS changed its PenTesting permission requirement as a story · 2 points
HN discussionSubmitted Breaking Full Disk Encryption from a Memory Dump as a story · 2 points
HN discussionSubmitted Breaking Full Disk Encryption from a Memory Dump as a story · 2 points
HN discussionSubmitted Exploiting CSRF on JSON endpoints with Flash and redirects (2018) as a story · 1 points
HN discussionSubmitted Open Source Intelligence Gathering 201 (Covering 12 additional techniques) as a story · 1 points
HN discussion