BREAKING: Internal #DeepSeek database publicly exposed 🚨

Wiz Research has discovered "DeepLeak" - a publicly accessible ClickHouse database belonging to DeepSeek, exposing highly sensitive information, including secret keys, plain-text chat messages, backend details, and logs. 🔍 How did we find it?

Following a simple recon on DeepSeek's public infrastructure, we discovered a publicly exposed ClickHouse database that was completely open and required no authentication at all.

🚨 BREAKING: Wiz Research discovers a massive 38TB data leak by Microsoft AI researchers, including 30,000+ internal Teams messages.

Here's what you need to know 🧵 🔒 What happened?

While releasing open-source training datasets, Microsoft's AI research team accidentally left the vault door open 👀

Over 38TB of data (!), including personal backups of employee workstations, private keys, and internal Microsoft Teams messages, were exposed.

🚨 BREAKING: History written with just 9 lines of code!

We've discovered #PyLoose, the FIRST documented Python-based fileless attack targeting cloud workloads.

See the power of 9 lines of Python code below 👇🏽 Fileless attacks are known but rarely seen in the wild. The last reported instance in cloud workloads was 2.5 years ago 📉

Despite their rarity, fileless attacks pose significant threats due to their elusive nature and difficulty in detection.

3 cloud-to-K8s best practices to mitigate the risk of a lateral movement attack 🛡

1️⃣ Avoid storing long-term #cloud keys in workloads
2️⃣ Remove kubeconfig files from publicly exposed workloads
3️⃣ Restrict access to container registries

Details in thread 🧵👇 #kubernetes 1️⃣ Avoid storing long-term #cloud keys in workloads

✅ Attach IAM roles/service accounts/managed identities to workloads and define minimum permissions.

✅ Generate and rotate temporary credentials using the IMDS for improved #cloudsecurity.

🧵 2/5

State of the #Cloud 2023: An in-depth report on the latest trends and risks ⛈

#cloudsecurity #CNAPP #CISO #Engineer

Report highlights in thread 🧵 or download the full report for free here 👇
wiz.io/blog/the-top-c… ☁️ The responsibility of #security professionals to stay up-to-date on the state of the #cloud has never been greater.

🛡 With cloud adoption continuing to grow, it is crucial to proactively address potential threats and ensure secure deployment of solutions.

🧵2/6

Are you taking advantage of Rego's policy language for your #cloudsecurity needs?

If you're not, you need to check out these amazing resources to help get you started 🧵👇

#CSPM #Coding #CNAPP #CISO #DevSecOps Gettting started with Open Policy Agent (OPA) to improve your #cloudsecurity!

💙 What is OPA and why should you use Rego
💙 How to write your first OPA policy

#CSPM #Coding #CNAPP #CISO #DevSecOps

🧵2/5
wiz.io/blog/getting-s…