Hello, welcome to the Friday, August 9th, 2019 edition of the Sands and the Storms and a Stormcast.

My name is Johannes Ulrich and I am recording from Denver, Colorado.

Now, if you are using containers or if you consider using containers, you probably came across Kubernetes.

Kubernetes is one of these large open source

projects that allows you to better manage and sort of orchestrate container workloads.

The Cloud Native Computing Foundation spent some money last year trying to figure out how secure this particular environment is.

They hired two security company trails of bits and treaties partners to do a fairly extensive security audit of this particular system.

Now, since Kubernetes is really not just sort of one piece of software as such, but really an ecosystem,

they did pick a few of the key components of it to do this security audit.

And, well, with some pretty good results, nothing really that I would call outrageously insecure,

but they found a total of 37 vulnerabilities, at least that's from the Trails of Bits report,

where five of them they considered high severity issues, where for example, authentication

tokens were locked in clear text files.

If you are using Kubernetes, you definitely should take a look at the reports.

And now the report also does include a, essentially, a hardening guide and a guide for pen testers that are investigating

Kubernetes installs. So that itself is probably almost more valuable to end-use of Kubernetes

than the actual security review report of Kubernetes. Now the report was finished a couple months ago and the report was first, of course,

presented to the Kubernetes team. So they were able to address the vulnerabilities that were

pointed out in this report. The Cloud Native Computing Foundation, on the other hand,

sees this as sort of, you know, one major project and they are planning on

conducting similar reviews for other projects. And Apple today announced a significant

expansion of its Buck Bounty program. In the past, Buck Bounties were only available for iOS and only two selected

...