Research
Kubernetes Testing Environment: An Open Source Resilience Platform for EKS, GKE and AKS
It will come as no surprise that Kubernetes deployments are growing exponentially across many industries. According to the Cloud Native...
All articles by Roi Nisimi
‘Orca Watch’ Series
Mitigating CVE 2024-38063: Critical RCE Vulnerability On Windows Systems With IPv6
Microsoft recently advised of a critical TCP/IP Remote Code Execution Vulnerability dubbed CVE 2024-38063, which is a critical unauthenticated Remote...
Discovered Vulnerabilities
LeakyCLI: AWS and Google Cloud Command-Line Tools Can Expose Sensitive Credentials in Build Logs
Table of contentsExecutive Summary:What are Azure, Gcloud and AWS CLI?Exposure of Serverless environment variablesAWS CLI LeakageGcloud CLI LeakageExploitation Proof of...
‘Orca Watch’ Series
‘Leaky Vessels’ Docker Vulnerabilities Found in Many Cloud Environments: RunC (60%) and BuildKit (28%)
On January 31st, Snyk unveiled the discovery of four novel container vulnerabilities that target the runC and BuildKit components within...
Discovered Vulnerabilities
Sys:All: How A Simple Loophole in Google Kubernetes Engine Puts Clusters at Risk of Compromise
The Orca Research Pod has uncovered a dangerous loophole in Google Kubernetes Engine (GKE) that could allow an attacker with...
Discovered Vulnerabilities
Unauthenticated Access to GCP Dataproc Can Lead to Data Leak
The Orca Research Pod has made an important discovery that puts Google Cloud Dataproc clusters at risk for data theft,...
Discovered Vulnerabilities
Bad.Build: A Critical Privilege Escalation Design Flaw in Google Cloud Build Enables a Supply Chain Attack
Bad.Build is a critical design flaw discovered by the Orca Research Pod in the Google Cloud Build service that enables...
Discovered Vulnerabilities
From listKeys to Glory: How We Achieved a Subscription Privilege Escalation and RCE by Abusing Azure Storage Account Keys
Here at Orca Security, our team of cloud researchers are continually pushing the cloud security limits to ensure that we...
Research
Elastic IP Transfer: Identifying and Mitigating Risks from a New Attack-Vector on AWS
Elastic IPs (EIPs) are public and static IPv4 addresses provided by AWS. EIPs can be viewed as a pool of...
Personalized Demo
See Orca Security in Action
Gain visibility, achieve compliance, and prioritize risks with the Orca Cloud Security Platform.