Weak Links in Cloud IAM - Never Trust. Always Verify!
summary
Red team exercise reproduces two real attack paths: an IAM PassRole with Resource "" lets a developer account attach admin service roles to EC2/Lambda/ECS and spin up instances that inherit full admin rights, and an anonymous assume via "AWS:" trust gives outsiders short‑lived tokens that enumerate EC2 metadata, discover S3 buckets with certs/API keys and KMS‑decrypt secrets. GitHub regex scans surface ~70,000 role names from ~300,000 files and thousands of accessible EC2 snapshots; masscan/pnscan‑style scanners and Kinsing/TeamTNT cryptojackers scrape credentials. Also: 62% GCP VMs run as admins, 68% of keys older than 90 days, 24% group MFA enabled.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:30Agenda
- 2:47AWS Services
- 5:16Misconfigurations
- 7:15Two important concepts
- 9:23Developer Role
- 10:34Service Roles
- 11:27Multiple attack paths
- 12:15Overly permissive IAM trust policies
- 13:17Root cause of the second misconfiguration
- 16:43Decrypting the encrypted message
- 17:47GitHub Research
- 19:06What we found
- 19:34Key Management Service Keys
- 20:26Overly prescribed permissions
- 24:20Cryptojacking
- 24:52Cryptojacking Operations
- 27:37Unit42 Blog
- 28:25RSA Conference Agenda
- 29:44Best Practices
- 31:43Configuration
- 33:01Crypto Checking
related talks
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
37mLocking Down the Security of IAM
36mCloud Hacking Scenarios
44mCloud Metadata Abuse
38mChanging Perspectives: A Deep Dive into the Security Posture of 600+ Real-World AWS Environments
26mAWS (mis)configuration from an attacker’s-eye view
28mYour journey to temporary credentials in the cloud
46mAttacking AWS: The Full Cyber Kill Chain