Serverless Infections - Malware Just Found a New Home
summary
A live RCE proof of concept targets AWS Lambda by injecting evalable JavaScript that zips and exfiltrates the function code, revealing secrets and using the built‑in AWS SDK and updateFunctionCode to overwrite other functions, producing a stored viral payload via S3 and function code updates. Attack requires excessively broad execution role or misconfigured VPC defaults and leads to self‑duplicating infections across functions. Demos reproduce persistence on Lambda and note limitations on Azure and GCP.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:20The Advantages of Server Less Infrastructure
- 4:55Disadvantages
- 7:12Different Use Cases for Server Less Environments
- 10:21What Is the Code Injection
- 20:35How Can We Prevent some Such Attacks
- 25:42Code Injection
related talks
34mServerless Infections: Malware Just Found a New Home
36mGone in 60 milliseconds: Offensive security in the serverless age
26mExploring Malicious Lambda Layers
33mServerless Security: New Risks Require New Approaches
57mServerless Security: Attack and Defense
48mAlexa, Hack My Server(less) Please
30mServerless Security Top 10
35mAccount Jumping Post Infection Persistency & Lateral Movement in AWS