Guardians of the Cloud Navigating the Depths of Cloud Threat Hunting
summary
Research finds concrete incidents and tools: 80% of a sample of 50,000 repos had orphan commits containing secrets discovered by crawling with git clone --mirror; remediation is to delete commits and immediately invalidate leaked secrets. Honeypots reveal a Redis in‑memory module campaign dubbed “headcrab” that mined ≈$1,600 via a replica injection technique; mitigation is to avoid internet‑exposed Redis, disable unsigned modules or require signatures, and run with least privilege. Detection and hunting use Trivy for images and Tracy (eBPF) plus TracyShark for kernel/network events.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 1:07Cloud native vs classic security
- 4:42Threat hunting research process
- 8:16Tools for cloud threat hunting
- 10:01GitBleed supply chain attack
- 15:00HeadCrab Redis malware attack
- 21:35Mitigating Redis vulnerabilities
- 24:48Community contributions and tools
- 27:39Actionable security recommendations
- 31:13Q&A and closing
related talks
50mThe Anatomy of Cloud Attacks
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
41mIdentifying and Mitigating Cloud and Container Threats
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
30mBelow the Radar: Identifying Hidden Threats Within the Development Ecosystem
18mSecuring cloud innovation: Lessons learned
26mSecret Hunting
37mShift left, shield right: Code-to-cloud strategy for securing apps