Internet-Scale Analysis of AWS Cognito Security
summary
Internet-scale scan extracts ~3,100 Cognito IDs (2,500 usable), uses APKMirror/APKPure, Common Crawl and GitHub to pull IDs, then CC Lambda (1,000 concurrent Lambdas) to grep 2.5B pages and EnumerateIAM to brute-force-check read-only APIs. Result: access to about 13,000 S3 buckets, ~1,200 DynamoDB tables and ~1,500 Lambda functions; 900 S3 buckets and 37 databases flagged by name as sensitive, 80 secrets recovered, and 280 hardcoded creds (25 root).
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:35Cognito Security Finding
- 2:34Exploiting Cognito
- 5:42Cognito Architecture
- 8:51Role Configuration
- 11:45Mobile App Analysis
- 15:22Web App Analysis
- 20:06Permission Enumeration
- 24:21Analysis Results
- 27:52Insecure Configurations
- 30:31Sensitive Data Access
- 33:35Root Cause Analysis
- 37:18Security Best Practices
- 38:34Hard-coded Credentials
- 40:04Key Takeaways
- 43:15Q&A
related talks
52mStaying ahead of threat actors with Amazon Cognito
45mMigrating to Amazon Cognito, featuring approaches from
20mFantastic AWS Attacks and Where to Find Them
38mChanging Perspectives: A Deep Dive into the Security Posture of 600+ Real-World AWS Environments
40mWeak Links in Cloud IAM - Never Trust. Always Verify!
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had
35mThe Good, the Bad and the Ugly — one year of integrating AWS security services
48mKnock knock, who's there Identifying assets in the cloud