Alexa, Hack My Server(less) Please

on YouTube ↗48m

" summary

Demonstrates concrete serverless failures: exploiting node-serialize code injection and command injection in Lambda functions to read /tmp and pull down source, stole temporary AWS credentials from environment variables, used those creds to scan a DynamoDB table and exfiltrate the entire database, changed an S3 bucket ACL to public, and used SES/email and signed-upload flows to trigger malicious payloads. Builds a small vulnerable app and an Alexa-to-SQL demo (uses a tokenizer to turn spoken numbers into integers); all demos run successfully against live-like environments.

AI-written summary · about

" chapters (17)

1. 0:00Intro
2. 0:45Flight Ordering
3. 2:03Who am I
4. 3:05Disclaimer
5. 4:23What is Serverless
6. 5:30Who is using Serverless
7. 6:18Serverless Trends
8. 7:33Containers
9. 8:36Shared Responsibility
10. 9:19Service
11. 14:58Cloud Access
12. 18:13AWS Example
13. 24:06Slack Example
14. 26:11Chatboard Example
15. 29:39Database Example
16. 30:53Cloud Storage Example
17. 35:30Email Example

" related talks

• 36mGone in 60 milliseconds: Offensive security in the serverless ageRich Jones · Full Stack Fest 2017
• 33mServerless Security: New Risks Require New ApproachesItay Rozenman · GOTO Copenhagen 2021
• 30mServerless Security Top 10Tal Melamed · Conf42 Cloud Native 2022
• 50mAutomated Serverless Security Testing: Delivering secure apps continuouslyTal Melamed · Global AppSec US 2021 Virtual
• 34mChaos engineering for serverlessGunnar Grosch · Conf42 Chaos Engineering 2022
• 46mOWASP SERVERLESS TOP 10Tal Melamed · Global AppSec Dublin 2023
• 30mServerless Infections - Malware Just Found a New HomeAmit Ashbel · OWASP AppSec Europe 2018
• 57mServerless Security: Attack and DefensePawel Rzepa · Oh My H@ck 2020