Trust issues: Because Zero Trust Isn't Optional Anymore
summary
Claims that React2Shell lets an attacker send a malicious React server component, execute it and get a credentialless reverse shell because outbound traffic is allowed, and that a recent Axios compromise shipped a malicious version that was live for about 3 hours. Demo runs a vulnerable app on Kubernetes, shows a reverse shell, then hardens with distroless images and mTLS plus DB RLS and CSP and CSRF, and finally blocks the exploit with Cilium+Kyverno deny-by-default policies.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:21Shell vulnerability explained
- 3:11Zero Trust security model
- 5:15Zero Trust in frontend
- 8:04Securing backend and infra
- 10:10Microsegmentation and least privilege
- 12:43Distroless containers
- 14:07CSRF tokens and service mesh
- 17:00Live demo: React to Shell
- 22:58Cilium and Kyverno security
- 24:41Summary
related talks
39mProtect Your Application, Not the Network. Add Zero Trust Superpowers to Your Critical...
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
30mTales of Red Teaming
01h 02mIntroduction to Zero Trust Security
45mZero Trusting as a True Cloud Native Dev
47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
17mZero Trust access with zero waiting, zero pain, and zero compromises
27mBeyond the Basics: Securing JavaScript Applications