Seth Art

Cloud Security Research and Advocacy @Datadoghq. Previous: Cloud Penetration Testing lead @BishopFox. Also on Mastodon

[AWS Cloud Security Weekly @awscloudsec]

📣 Issue 84 is out. Highlights:

- Amazon Inspector enhances the security engine for container images scanning.
- AWS CloudTrail network activity events for VPC endpoints now generally available.
- whoAMI: A cloud image name confusion attack by Seth Art.
- Uncovering a Hidden CloudTrail Bug by Tracing AWS AssumeRole Chains in a Graph Database by Or Aspir.
- Tool: Cloud Trail Discover cheat sheet.

https://t.co/rIXmb7qrXm

[Seth Art @sethsec]

@BleepinComputer @billtoulas Thanks @BleepinComputer and @billtoulas!!!

[BleepingComputer @BleepinComputer]

whoAMI attacks give hackers code execution on Amazon EC2 instances - @billtoulas
https://t.co/TKPhz89Tx6

https://t.co/TKPhz89Tx6

[Terrance DeJesus @_xDeJesus]

whoAMI research by DataDog. I immediately thought about all the user-data scripts that me be attached to those launched EC2 instance images 🥶

Kudos to @sethsec for the discovery, research, and tool!

#aws #cloudsecurity

https://t.co/r5w4Jcmjmy

[Rami McCarthy @ramimacisabird]

The prior name confusion issue: https://t.co/Ci1MDZ1yBC

[Seth Art @sethsec]

@ramimacisabird Thanks so much @ramimacisabird! Your SSM Command Document research is a must read for sure.

[Rami McCarthy @ramimacisabird]

Excellent research here from @sethsec and crew - including responsible disclosure, AWS hardening enhancement, detection guidance, etc.

🤔 I did report a name confusion in SSM Documents impacting Datadog right before this was found... 😜

[Seth Art @sethsec]

The post also includes many ways you can check to see if you are vulnerable!

[Seth Art @sethsec]

My Datadog Security Labs research is finally live! The whoAMI research highlights how a malicious actor could gain remote code execution in thousands of AWS accounts that are vulnerable to this attack.
https://t.co/dTtEftS36S

[Seth Art @sethsec]

@_xDeJesus Thanks for sharing @_xDeJesus. Spot on about the user-data. And just think about all of the attached IAM roles and permissions as well!

[Matt Johansen @mattjay]

What. The.

[Christophe Tafani-Dereeper @christophetd]

Fun with Google Cloud's default service accounts (and how to leverage them for offensive purposes)

https://t.co/tCeGtjqsGn

[Seth Art @sethsec]

@0xLupin @mattjay @HashiCorp Nice post!

[Lupin @0xLupin]

🔗In this article we talk about how I exploited a Fortune 500 Through Hidden Supply Chain Links

Link 👇

https://t.co/K5vo4M1Rap

Thanks to the entire @HashiCorp team ! 🤟

Enjoy 🔥

[Clint Gibler @clintgibler]

☁️ State of Cloud Security

2024 update of @Datadog’s report analyzing security posture data from a sample of thousands of orgs across AWS, Azure, and Google Cloud

• Long-lived credentials continue to be a major risk.

• Adoption of public access blocks in cloud storage services is rapidly increasing,

• <1/2 of EC2 instances enforce IMDSv2, but adoption is growing

• Securing managed Kubernetes clusters requires non-default, cloud-specific tuning

• Insecure IAM roles for third-party integrations leave AWS accounts at risk of exposure

• Most cloud incidents are caused by compromised cloud credentials

https://t.co/3nJyFrMhwA

[Daniel Bohannon @danielhbohannon]

Mine &amp; @sabi_elezi's #MaLDAPtive presentation from @defcon is now posted on YouTube! LDAP obfuscation, deobfuscation &amp; detection - all built on our 100% custom LDAP parser.

Recording: https://t.co/pDAqDUrAOF
Tool: https://t.co/ZoDhXt4AxT

@permisosecurity #LDAP #ClippyGotJokes

[Christophe Tafani-Dereeper @christophetd]

Excited to share some research I've been working on for the past few months, based on real-world data from thousands of environments using AWS, Azure and Google Cloud!

https://t.co/2CFZmm4Cwz

[CNY Hackathon @CNY_Hackathon]

Registration for the 2024 CNY Hackathon is now open!
https://t.co/N9yylU0DwL

[Nicolas Grégoire @Agarri_FR]

How it feels to be on the other side… #Bluesky

[Seth Art @sethsec]

I had such a great time speaking about Cloud Security at @BsidesORL! I saw some great talks, made some new friends, and got to hang with old ones. A huge thank you to all of the volunteers that made this epic event possible!