Nitesh Surana
10 articles
-
ResearchIt’s By Design: The Use-After-Free of Azure Cloud
Persistent DNS references to deleted Azure resources create opportunities for attackers to take over trusted endpoints, highlighting a critical risk in cloud infrastructure. TrendAI™ Research discusses six real-world scenarios where attackers could exploit lingering DNS names, allowing them to inherit trust and compromise dependent systems.
April 3rd, 2026 15 minNitesh Surana, Nelson William Gamazo Sanchez
Read article -
BlogCracking the Isolation: Novel Docker Desktop VM Escape Techniques Under WSL2
TrendAI™ Research has discovered several new methods that enable attackers to escape Docker Desktop's WSL2 VM and run arbitrary code on the host. Our analysis highlights how trusted development tooling can create unexpected attack surfaces when internal APIs and configuration mechanisms are left exposed.
March 12th, 2026 12 minNelson William Gamazo Sanchez , Nitesh Surana
Read article -
ResearchThe Mirage of AI Programming: Hallucinations and Code Integrity
The adoption of large language models (LLMs) and Generative Pre-trained Transformers (GPTs), such as ChatGPT, by leading firms like Microsoft, Nuance, Mix and Google CCAI Insights, drives the industry towards a series of transformative changes. As the use of these new technologies becomes prevalent, it is important to understand their key behavior, advantages, and the risks they present.
July 25th, 2024 6 minNitesh Surana, Ashish Verma, Deep Patel
Read article -
BlogLeaky Labels: Bypassing Traefik Proxy Leveraging cAdvisor Metrics
While examining the exposed information in the metrics endpoint of cAdvisor, we noticed that it exposes container labels for all the running containers on the “/metrics” endpoint. Container labels are key value pairs that are stored as a string. They are used to store metadata such as licensing information, maintainer information, versioning about container objects such as container images, running containers, volumes, daemons, and networks.
July 11th, 2024 13 minNitesh Surana
Read article -
ResearchObservability Exposed: Exploring Risks in Cloud-Native Metrics
Container Advisor (cAdvisor) is an open-source monitoring tool for containers that is widely used in cloud services. It logs and monitors metrics like network input/output (I/O), disk I/O, and CPU usage. However, misconfigured deployments might inadvertently expose sensitive information, including environment variables such as Prometheus metrics. In this article, we share our findings of the risks we have uncovered and the vulnerable configurations users need to be aware of.
May 2nd, 2024 12 minNitesh Surana
Read article -
ResearchYou Can't See Me: Achieving Stealthy Persistence in Azure Machine Learning
In the latest installment of our ongoing series where we identify and investigate security flaws in Azure Machine Learning (AML), we explore how cybercriminals could manage to covertly gain persistence in AML workspaces.
April 22nd, 2024 12 minNitesh Surana, David Fiser
Read article -
ResearchBuilding Resilience: 2024 Security Predictions for the Cloud
We delve into the multifaceted nature of cloud cyberthreats in 2024, from the stealthy dangers of data poisoning in machine learning models to the complexities of securing APIs, and more.
February 8th, 2024 12 minAlfredo Oliveira , David Fiser, Nitesh Surana, Magno Oliveira…
Read article -
ResearchUncovering Silent Threats in Azure Machine Learning Service: Part 2
In our previous entry, we examined how credentials were being stored and logged in cleartext on compute instances (CIs) created in Azure Machine Learning (AML) service and the risks posed by the same. This article examines an information disclosure bug we found in one of the cloud agents used in the AML service and sheds light on the importance of threat modeling the agents’ features to uncover silent and hidden attack surfaces.
August 30th, 2023 6 minNitesh Surana
Read article -
ResearchUncovering Silent Threats in Azure Machine Learning Service: Part I
We probed the Azure Machine Learning (AML) service to identify security flaws and vulnerabilities and shed light on the unseen aspects of silent threats in managed services like AML.
August 17th, 2023 13 minNitesh Surana
Read article -
BlogCVE-2022-22965: Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
We discovered active exploitation of a vulnerability in the Spring Framework designated as CVE-2022-22965 that allows malicious actors to download the Mirai botnet malware.
April 8th, 2022 11 minDeep Patel, Nitesh Surana, Ashish Verma
Read article