239 - Public Private Android Keys and Docker Escapes [Bug Bounty Podcast]

This week we have a crazy crypto fail where some Android devices had updates signed by publicly available private keys, as well as some Docker container escapes.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/239.html

[00:00:00] Introduction
[00:00:22] Missing signs: how several brands forgot to secure a key piece of Android
[00:13:37] ModSecurity: Path Confusion and really easy bypass on v2 and v3
[00:21:24] runc process.cwd & leaked fds container breakout [CVE-2024-21626]
[00:24:23] Buildkit GRPC SecurityMode Privilege …

android android devices bounty bug bug bounty container crypto devices docker fail introduction key keys missing modsecurity path piece podcast private private keys public updates week