Account Jumping Post Infection Persistency & Lateral Movement in AWS
summary
Shows concrete attacks and defenses for AWS including a live demo where STS temporary tokens continue to work after original access keys are deleted enabling actions like starting EC2 and assuming instance roles, an account jumping technique using poisoned AMIs and transferred accounts with prepaid credits, credential exfiltration via task definitions and DataDog logs, CloudTrail evasion by abusing S3 lifecycle Lambda and KMS keys to drop or unread logs, persistent backdoors via Lambda that auto recreates users keys and role trust, and VPC lateral entry through API Gateway to reach on prem.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:40Code Spaces Breach
- 2:22Hide and Seek
- 3:04AWS Intro
- 4:39Infection Phase
- 6:29Infection Through AWS
- 8:48Infection Through ThirdParty Services
- 10:48Survival From Attackers Perspective
- 11:55Demo
- 21:12Custom Key
- 24:32Persistency
- 25:09New Users
- 30:21Summary
- 31:53What can you do
related talks
46mAttacking AWS: The Full Cyber Kill Chain
26mAWS (mis)configuration from an attacker’s-eye view
36mGone in 60 milliseconds: Offensive security in the serverless age
20mFantastic AWS Attacks and Where to Find Them
47mBringing a Machete to the Amazon
56mPivoting in Amazon Clouds
43mThink like a HACKER
39mPerils of the cloud