Category: IT Security

When applying generative AI to work, many people first wonder, “What kind of prompt should I write to get a good answer?” However, in security-critical environments, simply improving the quality of the answer is not enough. It is necessary to consider whether the AI acts only within the allowed scope, does not expose sensitive information,…

Hello, security analysts! 🕵️‍♀️ Last time, we learned how to cut a huge obfuscated code into ‘bite-sized chunks’ that AI can digest. Now it’s time to feed these chunks to AI for analysis… but wait! ✋ The code thrown at us by attackers is truly a ‘Junk Yard’. It’s mixed with meaningless mathematical operations, if…

Hello, everyone! 🕵️‍♂️ In the last theory session, we learned about ‘obfuscation techniques’ and how malicious scripts cleverly hide their true form. (If you don’t remember, review! 📝) Now that we’re armed with theory, it’s time to dive into practice! It’s our turn to hand over this complex code to our reliable ally, Generative AI…

Hello everyone! Today, we’re going to delve deep into Pod Security Admission (PSA), a core component of Kubernetes security configuration. With v1.25, the existing Pod Security Policy (PSP) was completely removed, and PSA has now taken its place. Breaking the prejudice that “security configuration is difficult,” we’ll provide a detailed overview of everything about PSA,…

Hello, security researchers striving for efficient analysis! 🕵️‍♀️ Up until last time, we went through a lot of trouble chunking obfuscated scripts, cleaning up junk code, and untangling twisted threads (Deobfuscation) to finally create ‘readable plaintext code’. 🎉 You’ve all worked incredibly hard! But… as I stare blankly at the code, another sigh escapes me.…

Hello, persistent security researchers! 🕵️‍♂️ When analyzing malware, you sometimes encounter code so complex that you might think, “How twisted must the person who made this be?” Instead of code executing sequentially from top to bottom, it’s code that abuses GOTO statements, jumping here and there… like tangled earphone cords or ramen noodles. 🧶 We…

Hello, aspiring security professionals! 🌱 When studying malware analysis or reverse engineering, you inevitably encounter a huge barrier: Assembly Language. Seeing a black screen filled with unknown English acronyms like MOV, LEA, CMP, JE… naturally makes you wonder, “Who am I? Where am I?” 😵‍💫 But don’t be intimidated! Assembly language is not alien. It’s…

Hello, security analysts who dig deep to the end! 🕵️‍♂️ Until last time, we decrypted obfuscated code and even added neat comments. Now we have a rough idea of what the code means. At this point, your fingers might be itching. “Should I just double-click and run it? If I run it in a sandbox,…

Hello everyone! In our last post, we explored the concept and application of Pod Security Admission (PSA). Today, as a follow-up, we’ll delve deep into the core of PSA: the three security standards (Pod Security Standards), specifically examining “what configurations” they block and allow. Are your Pods constantly falling into an Error state after applying…

Hello, security researchers who track to the end! 🕵️‍♂️ The world of cybersecurity is an endless game of ‘tag’. When a security vendor detects a specific piece of malware, hackers release a slightly modified ‘variant’ of the code a few days later (or even a few hours later). Some just change their outer shell, some…