Most Security Teams Lack Detection Rules for Cloud IAM Attacks, Experts Warn

·2 views

Security teams with mature endpoint detection capabilities are often blind to cloud-native attacks because their rules assume a process tree exists, which IAM-based attacks do not have. A stolen AWS access key can enable full account reconnaissance through a burst of IAM API calls that leave no trace in EDR or host-based tools, only in CloudTrail logs. Attackers can escalate privileges by chaining legitimate permissions such as iam:PassRole with lambda:CreateFunction and lambda:InvokeFunction, a well-documented AWS escalation path that triggers no traditional alerts. Experts say effective cloud detection requires understanding normal API behavior per identity and flagging unusual permission combinations across providers including Azure, GCP, and Kubernetes. The same detection engineering discipline used for host and network threats can be applied to audit logs, but that translation must be deliberately built rather than assumed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Capgo's Capacitor Updater auto-rolls back broken OTA bundles in 10 seconds

The open-source @capgo/capacitor-updater plugin uses a native handshake mechanism to detect and recover from failed over-the-air JavaScript bundle updates on mobile devices. When a new bundle is deployed, the native layer starts a 10-second timer and waits for the app's JavaScript to call notifyAppReady(), confirming a successful boot. If the call is never made — due to a crash or hang — the timer expires and the plugin automatically restores the last known working bundle without any cloud dashboard intervention. Developers can monitor rollback events via the updateFailed listener and retrieve details of the failed bundle using getFailedUpdate(). Testing is recommended on an isolated channel with a single device before any changes reach the production build.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Stopped Container Can Prevent nginx From Starting — Here Is the Fix

A single stopped Docker container can prevent nginx from starting entirely, taking down all proxied services including frontends and APIs. This happens because nginx resolves hostnames literally at config-parse time, making every upstream a hard startup dependency. The fix involves using a variable for proxy_pass targets along with Docker's internal DNS resolver, which defers resolution to request time and limits failures to a 502 on the affected route only. However, switching to variable-based proxy_pass breaks nginx's automatic URI prefix stripping, requiring manual rewrites for location blocks with trailing slashes. A further side effect involves CORS preflight handling, where the interaction between rewrite and if directives can cause subtle, hard-to-diagnose failures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Timeline Studio: Open-Source AI Video Editor That Runs Entirely in the Browser

A developer has built Timeline Studio, an open-source, local-first AI video editor that processes media directly in the browser rather than uploading footage to remote servers. The tool supports multi-track timelines, captions, voiceovers, visual effects, and offline export, using WebGPU and WebAssembly for AI inference. To manage large AI models efficiently, the editor lazy-loads them only when a feature is first used, caches them via a service worker, and mirrors files across Hugging Face and ModelScope for reliability. Models are pinned to specific versions so upstream changes cannot silently affect editing workflows, and a shared cache identity ensures fallback downloads do not duplicate files on the user's device. Export quality is kept consistent by treating the timeline as declarative state and using a dedicated offline rendering path, rather than simply recording live on-screen playback.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds 45M-parameter on-device LLM fabricates numbers with full confidence

A developer built react-native-needle, described as the first React Native binding for Cactus Compute's Needle 2, a 45-million-parameter language model that runs entirely on a mobile device without any server or network connection. During testing on an arm64 emulator, the model performed reliably on simple, single-intent commands such as controlling lights or setting timers, with response times as low as 136 milliseconds. However, the developer discovered a consistent flaw: when processing numbers embedded in complex strings, the model fabricated incorrect values while simultaneously reporting a confidence score of 1.0 and even flagging the exact fabricated field in its own validation output. Additional limitations included the model failing to parse multi-intent inputs and string fields occasionally capturing unrelated adjacent text. The package is restricted to 64-bit devices due to an ABI mismatch in the prebuilt binary, and adds roughly 28 MB to an APK rather than the advertised 14 MB.

0 comments Read more at DEV Community