Enterprise vaults are meant to be the last line of defense – the trusted stronghold for your organization's most sensitive assets: secrets, credentials, and encryption keys. But what if the vault itself can be breached remotely – without even logging in? In this session, we disclose two novel, confirmed remote code execution (RCE) chains affecting the world's most widely adopted vault systems: HashiCorp Vault and CyberArk Conjur. For the first time, we demonstrate a full RCE chain in HashiCorp Vault, coinciding with its 10-year anniversary. For CyberArk Conjur, we present the kind of pre-auth RCE that keeps admins up at night. This isn't theoretical. We'll show it live on stage – against default, out-of-the-box configurations. And just as importantly, we'll walk through how these attacks can be detected and prevented – before your secrets become outies. By: Shahar Tal | CEO, Cyata Security Yarden Porat | Core Team Engineer, Cyata Security Full Session Details Available at: https://ift.tt/cSlOefs
source https://www.youtube.com/watch?v=KC-8DhS8x5Q
Subscribe to:
Post Comments (Atom)
-
WeChat, with over 1.2 billion monthly active users, stands as the most popular messaging and social media platform in China and third global...
-
Unmasking State-Sponsored Mobile Surveillance Malware from Russia, China, and North Korea – Threat Actors, Tactics, and Defense Strategies S...
No comments:
Post a Comment