Vulnerabilities in the public cloud. [Research Saturday]

Published: Sept. 25, 2021, 7 a.m.

b"Guest Ariel Zelivansky, Senior Manager of Security Research at Palo Alto Networks, joins Dave to discuss Unit 42's work on the first cross-account container takeover in the public cloud. The Unit 42 Threat Intelligence team has identified the first known vulnerability that could enable one user of a public cloud service to break out of their environment and execute code on environments belonging to other users in the same public cloud service. This unprecedented cross-account takeover affected Microsoft's Azure Container-as-a-Service (CaaS) platform. Researchers named the finding Azurescape because the attack started from a container escape \\u2013 a technique that enables privilege escalation out of container environments.\\nThe research can be found here:\\n\\nWhat You Need to Know About Azurescape\\n\\nFinding Azurescape \\u2013 Cross-Account Container Takeover in Azure Container Instances\\n\\n\\nNote: Microsoft is a sponsor of the CyberWire, however, we cover them as we would any other company."