Bringing a Machete to the Amazon
summary
Demonstrates concrete attack paths: SSRF or an uploaded URL pulls the metadata API and yields short‑lived IAM credentials, attackers then clone EBS volumes or snapshot RDS instances to steal data without SQLi, or simply delete resources via exposed API keys. Recommends locking keys to IPs, enabling CloudTrail in every region, avoiding sensitive tags, and using least‑privilege IAM. Announces a free read‑only tool (Cloud Atlas) that maps services, monitors CloudTrail near real‑time, and flags risky permissions.
AI-written summary · about
chapters (31)
- 0:00Intro
- 0:38Welcome
- 1:28Agenda
- 1:49Cloud is an Operating System
- 2:41Infrastructure is my code
- 3:08Typical AWS application
- 3:41AppSec perspective
- 4:21The challenge
- 4:44What does AWS offer
- 5:21Problems with AWS
- 6:36AWS as an operating system
- 7:26AWS attack surface
- 8:32Merchant insecurity
- 10:00Strict change control
- 11:04API
- 11:27Vulnerabilities
- 12:31Metadata
- 13:57AWS Metadata
- 15:55Examples
- 18:31Controlling API Access
- 21:24Private IP Addresses
- 25:58Lack of Access Control
- 27:20Tags
- 29:30IP Address
- 30:17Lack of Awareness
- 33:03Cloud Atlas
- 33:30Cloud Out
- 35:12Cloud Trail Data
- 35:45Advanced Cap Capabilities
- 37:19Other Tools
- 38:19Questions
related talks
47mBringing a Machete to the Amazon
46mAttacking AWS: The Full Cyber Kill Chain
20mFantastic AWS Attacks and Where to Find Them
56mPivoting in Amazon Clouds
46mHardening AWS Environments and Automating Incident Response for AWS Compromises
37mLocking Down the Security of IAM
39mPerils of the cloud
26mAWS (mis)configuration from an attacker’s-eye view