Cloud vulnerabilities I'm finding on penetration tests, bug bounties, and seeing in data breaches

1. Real World Cloud Compromise
Teri Radichel, CEO | @teriradichel |

2. Alternatively,
How I’m going to hack your cloud

3. Expectations: Not a DefCon talk.

4. @teriradichel

5. “Misconfigured storage services in 93 percent
of cloud deployments have contributed to
more than 200 breaches over the past two
years, exposing more than 30 billion records.”
The State of DevOps Report, Summer 2020, Accuris

8. Internet Exposure

9. Software Vulnerabilities

10. Pivot.

11. Server-Side Request Forgery (SSRF)
Web API
X

12. Open Redirect
301
Metadata Service
AWS
Credentials

13. Initial Approach to Protect Credentials
301
Metadata Service
AWS
Credentials
Firewall Rules
May still be bypassed…

14. DNS Rebinding
301
Metadata Service
AWS
CredentialsDNS Server
Evil
Site

15. Open Redirect
301
Metadata Service
AWS
Credentials
Validate Redirects

16. Host Header Redirect
[Host
Header]
Evil
Site

17. Subdomain Hijacking
DNS
[CNAME]
3rd Party
Service

18. Network Protocol Manipulations
Network
Packets
AWS IOT
IOT Device

19. Malicious File Upload
Malicious
File
File Upload
Form

20. Bypass File Upload Restrictions
Malicious
File
File Upload
Form
S3 Bucket
Bypass

21. Obtain Credentials
Web
Page
Service
Exposure
Social Engineering

22. Authentication
Login MFA
?

23. X
X
Authorization

24. Injection
<Evil Input>
Execute SQL or other
executable code to Obtain
Malicious Objective.
Many, many options!

25. Cross Site Scripting (XSS)
<SCRIPT>
Script
Reflected
from Server
in Browser

26. DOM XSS
<SCRIPT>
Script
Executes in
Browser
Never sent to web server.

27. Blind XSS
<SCRIPT>
Stored
Executes
Sends data
to attacker
Retrieved

28. Clickjacking
Evil Site
Your Site
Evil Button

29. Cross Site Request Forgery (CSRF)
TAB 1 TAB 2
Undesirable Action in Current Session

30. Caching
<EVIL CONTENT>
Inject
Request

31. Sensitive Data Exposure
Referrer: https://site.com?param=secret

32. Web
Server
API
Server
Request Smuggling
Response
1
Response
2
Request 1
Request 2

33. API Attacks
Web
Server
API
Server

34. This was not a complete list.

35. Prevention:
Follow Best Practices
Cloud Providers, CIS, OWASP
Deployment Pipeline
Monitoring
Cloud Penetration Test!

36. Thank You
Teri Radichel, CEO | @teriradichel | |
https://2ndSightLab.com
https://linkedin.com/in/teriradichel
https://medium.com/cloud-security