Serverless Infections: Malware Just Found a New Home

on YouTube ↗34m

" summary

Claiming the first-ever RCE stored and viral PoC, the team implements a payload on Amazon Lambda that reads the Lambda task root, compresses and curls entire function code and sensitive keys, then uses the AWS SDK list and update APIs to overwrite other functions. The payload becomes a self-duplicating cross-contamination implant that survives by altering function code, successfully exfiltrates API keys on AWS, and is reported as tested against Azure and Google Cloud with results summarized in the description.

AI-written summary · about

" chapters (20)

1. 0:00Intro
2. 2:13Evolution
3. 5:30Life cycle
4. 6:57Benefits and downsides
5. 12:07Common Use Cases
6. 12:45Serverless Security
7. 14:05Challenge Accepted
8. 16:07Code Injection
9. 18:52Checkmarks
10. 19:34payload
11. 20:43AWS SDK
12. 22:27Persistence
13. 23:50Onetime infection
14. 24:31Cross contamination
15. 27:16Lambda security
16. 27:40Lambda security parameters
17. 28:10Execution roll
18. 28:24Documentation
19. 29:38Virtual Private Cloud
20. 30:44Summary

" related talks

• 30mServerless Infections - Malware Just Found a New HomeAmit Ashbel · OWASP AppSec Europe 2018
• 36mGone in 60 milliseconds: Offensive security in the serverless ageRich Jones · Full Stack Fest 2017
• 26mExploring Malicious Lambda LayersElijah Lord, Maxwell Bruce · LambdaConf 2024
• 35mAccount Jumping Post Infection Persistency & Lateral Movement in AWSDan Amiga, Dor Knafo · Black Hat USA 2016
• 48mAlexa, Hack My Server(less) PleaseTal Melamed · Black Hat Europe 2019
• 57mServerless Security: Attack and DefensePawel Rzepa · Oh My H@ck 2020
• 33mServerless Security: New Risks Require New ApproachesItay Rozenman · GOTO Copenhagen 2021
• 46mLiving off the Cloud: A Server-Free Approach to Malware OpsAvishay Zawoznik, Etay Maor · RSA Conference 2023