Bringing a Machete to the Amazon
summary
Demonstrates that a single exposed credential lets an attacker treat AWS like physical access: clone AMIs or EBS volumes, snapshot RDS, and exfiltrate data or spin up Bitcoin miners within minutes. Shows real exploits (Prey, SSRF variants) that pull the metadata endpoint and harvest rotating keys (≈24h), explains detection with CloudTrail and excessive IAM policies, warns EC2‑Classic and open S3 buckets (≈1 in 7) as common pitfalls, and describes a free tool that maps IAM permissions and resource interactions to find full‑stack vulnerabilities.
AI-written summary · about
chapters (17)
- 0:00Introduction and philosophy
- 2:35AWS infrastructure overview
- 5:54The realities of scaling
- 7:56Risks of lifting and shifting
- 10:22Emergent security properties
- 12:40Security via rapid response
- 14:47The API as attack surface
- 17:44Exploiting API credentials
- 21:03Credential exposure risks
- 22:54Exploiting metadata services
- 26:55Leveraging web vulnerabilities
- 29:41API access control strategies
- 31:14Logging and auditing in AWS
- 34:28Data leaks through tags and IPs
- 38:11Vulnerable services and EBS
- 39:34Tooling for cloud security
- 43:42Q&A and summary
related talks
40mBringing a Machete to the Amazon
26mAWS (mis)configuration from an attacker’s-eye view
46mAttacking AWS: The Full Cyber Kill Chain
46mHardening AWS Environments and Automating Incident Response for AWS Compromises
43mThink like a HACKER
36mGone in 60 milliseconds: Offensive security in the serverless age
56mPivoting in Amazon Clouds
44mCloud Metadata Abuse