IAM Confused: Decoding 8 Real World Cloud Identity Breaches
summary
Eight real breaches show repeatable failure modes: attackers use credential harvesting (open buckets, GitHub, Terraform state), tools like AWS CLI and pacu, and pivots via assumeRole or SSH public‑key APIs to run crypto miners or ransomware. Notable specifics: a single case‑sensitive IAM typo lets attackers create access keys; a misconfigured Kubernetes API + stealthy clusterrole/serviceaccount combo runs Monero via a fake kubernetes.io image; MGM’s Okta compromise uses MFA reset + inbound federation and costs ~$8M/day; Uber’s breach stems from hard‑coded PAM creds discovered in a PowerShell script. 2% of permissions used and 10 minutes average cloud attack are highlighted; use CSPM, CloudTrail, runtime ML, secrets vaulting and strict least‑privilege.
AI-written summary · about
chapters (11)
- 0:00Cloud identity security challenges
- 4:42Kubernetes misconfiguration breach
- 8:13Cloud credential exploitation
- 11:26Overly permissive IAM policies
- 13:52MGM Resorts social engineering breach
- 17:47Kubernetes RBAC abuse
- 21:37Uber hard-coded credentials breach
- 24:25S3 bucket ransomware
- 27:40Strawberry Tempest tactics
- 31:37Identity security tools and processes
- 35:08Conclusion
related talks
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
48mNine Cloud Security Reasons for Resting Breach Face
32mDo This, Not That – Lessons from 7 Headline Grabbing Security Breaches
40mWeak Links in Cloud IAM - Never Trust. Always Verify!
45mProtecting you from you: Misconfiguration-caused breaches
36mCloud Hacking Scenarios
33mCloud Hacking Scenarios
39mPerils of the cloud