FirewallFables https://firewallfables.com/ Cybersecurity stories, one breach at a time. A static blog — no accounts, no ads, no tracking. en Thu, 29 Oct 2026 07:40:43 GMT No Auth, 164 Million Records: The Malawi Credit Bureau Exposure https://firewallfables.com/blog/malawi-credit-bureau-exposure/ https://firewallfables.com/blog/malawi-credit-bureau-exposure/ Thu, 15 Oct 2026 00:00:00 GMT A Kibana dashboard with zero authentication exposed the entire Malawian credit bureau — 2.4 million full identity profiles, 49 million loan records and live application logs — to anyone who knew the IP. FirewallFables Data Exposure Cloud Security Hardening The Registry That Called Everyone: 265 Million Numbers Exposed at India's DND https://firewallfables.com/blog/india-dnd-registry-exposure/ https://firewallfables.com/blog/india-dnd-registry-exposure/ Wed, 14 Oct 2026 00:00:00 GMT Two unauthenticated CouchDB nodes held India's entire Do-Not-Disturb registry — 245 million phone preferences, 7 million consent records and full residential PII — behind nothing but an open port. FirewallFables Data Exposure Cloud Security Incident Response Shai-Hulud Supply Chain Attack https://firewallfables.com/blog/shai-hulud-supply-chain-attack/ https://firewallfables.com/blog/shai-hulud-supply-chain-attack/ Sat, 10 Oct 2026 00:00:00 GMT How a self-spreading npm worm turned stolen maintainer tokens into a cascading supply-chain compromise across hundreds of packages. FirewallFables Supply Chain Malware npm The SQLite File That Exposed a Monitoring Environment https://firewallfables.com/blog/grafana-to-zabbix-chain/ https://firewallfables.com/blog/grafana-to-zabbix-chain/ Thu, 08 Oct 2026 00:00:00 GMT A three-year-old Grafana path traversal led to a plaintext database, then to Zabbix API access, then to a full infrastructure map. FirewallFables Incident Response Monitoring Hardening 365,000 Attacks in Seven Days: What a TPOT Honeypot Sees on the Open Internet https://firewallfables.com/blog/tpot-honeypot-on-azure/ https://firewallfables.com/blog/tpot-honeypot-on-azure/ Tue, 06 Oct 2026 00:00:00 GMT One Azure VM, one week, 365,000 logged events. root/123456 at the top of the credential charts, SIP and SSH at the top of the port charts, and cloud providers doing most of the shooting. FirewallFables Threat Intelligence Honeypot Cloud Security It Types Faster Than You Do: USB HID Attacks with a Rubber Ducky https://firewallfables.com/blog/usb-hid-attacks-rubber-ducky/ https://firewallfables.com/blog/usb-hid-attacks-rubber-ducky/ Tue, 06 Oct 2026 00:00:00 GMT A stick that looks like a thumb drive enumerates as a keyboard — no driver, no prompt, no consent. In a lab: Defender switched off, a logon-triggered PowerShell reverse shell on Windows, and root persistence with the logs wiped on Linux. FirewallFables Hardware Security Red Teaming Persistence Harbor Default Credentials: A Case Study in Container Registry Security https://firewallfables.com/blog/harbor-registry-default-credentials/ https://firewallfables.com/blog/harbor-registry-default-credentials/ Sat, 03 Oct 2026 00:00:00 GMT An exposed container registry with default credentials hands an attacker the entire software supply chain — images, secrets, source code. FirewallFables Container Security Supply Chain Hardening One GET Request, One Production Backend: Anatomy of a .env Exposure https://firewallfables.com/blog/one-get-request-one-production-backend/ https://firewallfables.com/blog/one-get-request-one-production-backend/ Sat, 15 Aug 2026 00:00:00 GMT A single unauthenticated HTTP GET returned the entire production secrets bundle for a customer-facing WhatsApp lead-generation bot — database, messaging provider, voice AI, LLM proxy and webhook secrets, all served as plain text. FirewallFables Incident Response Hardening Secrets Management