Christophe Tafani-Dereeper

Latest posts from my blog where I write about things I like, use, dislike and misuse.

• June 29, 2022 MitM at the Edge: Abusing Cloudflare Workers
• Jan 28, 2022 Introducing Stratus Red Team, an Adversary Emulation Tool for the Cloud
• Jan 11, 2022 Implementing a Vulnerable AWS DevOps Environment as a CloudGoat Scenario
• Dec 22, 2021 Cloud Security Breaches and Vulnerabilities: 2021 in Review
• June 9, 2021 Phishing for AWS credentials via AWS SSO device code authentication

Latest posts I wrote with current or past employers.

• Jul 27, 2023 Exploring GitHub-to-AWS keyless authentication flaws
• May 16, 2023 Attacking and securing cloud identities in managed Kubernetes part 1: Amazon EKS
• May 1, 2023 The OverlayFS vulnerability CVE-2023-0386: Overview, detection, and remediation
• Feb 6, 2023 Partially bypassing the AWS Console authentication rate limiting
• Dec 21, 2022 A retrospective on public cloud breaches of 2022
• Nov 23, 2022 Investigating a backdoored PyPi package targeting FastAPI applications
• Nov 15, 2022 Finding malicious PyPI packages through static code analysis: Meet GuardDog
• Nov 1, 2022 The OpenSSL punycode vulnerability (CVE-2022-3602), detailed write-up
• Oct 5, 2022 State of AWS Security in 2022: a look into 600+ real-world AWS environments

Stratus Red Team

Granular, Actionable Adversary Emulation for the Cloud

MKAT

Identify common security issues in managed Kubernetes environments.

CloudFlair

Find origins of websites behind by CloudFlare using Internet-wide scan data from Censys

Adaz

Automate the provisioning of Active Directory labs in Azure

log4shell-vulnerable-app

Vulnerable Spring Boot application for easy reproduction of the Log4shell vulnerability

Threatest

Go framework for end to end testing threat detection rules

censys-subdomain-finder

Subdomain enumeration using the certificate transparency logs from Censys

hunting-mindmaps

Mindmaps for threat hunting using memory captures and Windows event logs

• Mind The Gap! Bringing Together Cloud Services and Managed K8s Environments (KubeCon EU 2023)
• Finding Malicious PyPI Packages in the Wild (Insomni'Hack 2023)
• Purple Teaming & Adversary Emulation in the Cloud (DEFCON Cloud Village 2022)
• Purple Teaming the Cloud with Stratus Red Team (Cloud-Native SecurityCon 2022)
• Fantastic AWS Hacks and Where to Find Them (SANS New2Cyber 2022)
• Scanning Infrastructure-as-Code for security flaws (OWASP DevSlop)
• Can't Take My Lab off You — Automating the Provisioning of Active Directory Labs in Azure   (vOPCDE #7)
• Adaz presentation (Forensic Lunch October 23rd, 2020)
• Switzerland has bunkers, we have Vault  (BlackAlps 2018)
• How hackers exploit weak SSH credentials to build DDoS botnets  (Blackalps 2017, Grehack 2017)

• Scanning Infrastructure-as-Code For Security Issues (Day Two Cloud episode 125)
• What is cloud security? (French only, NoLimitSecu podcast)
• Infrastructure-as-Code Security (French only, NoLimitSecu podcast)
• Service Meshes and their Security Implications (French only, NoLimitSecu podcast)

Technical and non-technical books I particularly enjoyed reading and learning from.

Security:

• Hacking, the Art of Exploitation
• Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
• Violent Python
• The Phoenix Project
• The Goal: A Process of Ongoing Improvement
• Team Topologies
• Building Microservices: Designing Fine-Grained Systems

DevOps / Engineeering:

• The Phoenix Project
• The Goal: A Process of Ongoing Improvement
• Team Topologies
• Building Microservices: Designing Fine-Grained Systems

Quotes I find inspiring. Taken from a book, a movie, a reddit post, a blog post, or an overheard conversation.

• «  Not every problem is a nail, and not every solution a hammer  »
• «  Under-promise, over-deliver  »