Incident Response Investigations in the Age of the Cloud
summary
Startup IoT build has AWS with EKS and a third‑party‑managed Jenkins; misconfigured Bitbucket SSO leaves public Jenkins via Bitbucket SSO and a script console that dumps credentials. Attacker uses one‑liner tooling (noted as Endgame user agent "hot dogs are sandwiches") to grant permissions, attach KMS keys and make an S3 bucket public. Investigation finds CloudTrail JSON available but S3/VPC logs and container API logs disabled, untagged EKS snapshots and no Jenkins logs; fixes: centralize logs, create an IR cloud account, automate snapshots via EventBridge.
AI-written summary · about
chapters (28)
- 0:00Intro
- 1:47Who is vipsecure
- 2:36Research
- 3:41Chainsaw
- 4:10Agenda
- 4:52Client
- 5:51External Vendor
- 6:27Open Source
- 7:11VPN logs
- 7:54Bitbucket logs
- 9:31Cloud trail logs
- 10:09Endgame
- 10:58CloudTrail
- 12:23EOS Snapshots
- 14:17Case Lead
- 14:56The Mistake
- 16:08Script Console
- 17:50SAS Products
- 18:59Log Extraction
- 19:48Kubernetes
- 21:30Default Logging
- 22:33Prepare for a Cloud Incident
- 23:21Build an IR Analysis Environment
- 24:54Active Monitoring
- 26:16Readiness Strategies
- 26:49Default Logging is Not Enough
- 27:27Reverse Engineer Your Infrastructure
- 27:44Establish Responder Accounts
related talks
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
31mCloud Hacking Scenarios
36mCloud Hacking Scenarios
16mLessons from the SOC: Analyzing and remediating cloud attack paths
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
33mLive Hacking Cloud Architectures - Thorsten Jakoby and Mirna Alaisami
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
39mPerils of the cloud