Personal tech and security blog about things I like, use, dislike and misuse.
In 2021, I wrote about how offensive actors can leverage AWS SSO device code for phishing, rendering modern security controls like FIDO authentication or identity provider device posture ineffective: Phishing for AWS credentials via AWS SSO device code authentication. In this post, we’ll take a closer look at the newly-released PKCE support for AWS SSO authentication flows. A Short History of…
Kubernetes' 'allowPrivilegeEscalation' is a useful but poorly understood security hardening setting. Let's dive into how it works and debunk some common myths about it. The post Stop worrying about allowPrivilegeEscalation appeared first on Christophe Tafani-Dereeper .
On March 25, AWS released a new feature that helps enforcing IMDSv2 at the region level by default for newly-launched instances. This represents a long-awaited and feature, that still has some quirks. The post IMDSv2 enforcement: coming to a region near you! appeared first on Christophe Tafani-Dereeper .
In this post, we take a look at an anti-forensics technique that malware can leverage to hide injected DLLs. We dive into specific details of the Windows Process Environment Block (PEB) and how to abuse it to hide a malicious loaded DLL. Background: You may be wondering why you re reading a post about Windows internals if I m much more focused on cloud security these days. I initially wrote this…
Today s post is unlike any I ever wrote: a tribute to a dear friend, who, a few months ago, brutally passed away from a heart attack at the age of 28. More than a close friend I ve known for 10 years, Hadrien was a brilliant engineer, a software craftsman, a maker, and a hacker whom I highly regarded and learned so much from over the years. Anyone who met him can testify he was passionate about…
Cloudflare Workers provide a powerful serverless solution to run code that sits between every HTTP request and response. In this post, we ll see how an attacker compromising a Cloudflare account can abuse Workers to establish persistence and exfiltrate sensitive data. The techniques we discuss here have been used in the wild, but largely flew under the radar. Red teamers, read on to learn about…
Today, I'm thrilled to release a new open-source project I've been working on in the past few weeks: Stratus Red Team, an adversary emulation and purple teaming tool, focused on emulating common attack techniques in cloud environments. The post Introducing Stratus Red Team, an Adversary Emulation Tool for the Cloud appeared first on Christophe Tafani-Dereeper .
I m a huge fan of disposable security labs, both for offensive and defensive purposes (see: Automating the provisioning of Active Directory labs in Azure). After writing Cloud Security Breaches and Vulnerabilities: 2021 in Review, I wanted to build a purposely vulnerable AWS lab with a typical attack path including static, long-lived credentials and with a supply-chain security element. CloudGoat:…
As 2021 fades away, we look back on cloud data breaches and vulnerabilities that were publicly disclosed this year. Last updated: March 14th, 2022. Introduction Data about cloud security incidents in the wild is scarce, and often lacks details on tactics, techniques and procedures (TTPs) used by attackers. Breached organizations often don’t disclose the specifics publicly. Available data suffers…
When using AWS in an enterprise environment, best practices dictate to use a single sign-on service for identity and access management. AWS SSO (newly referred to as Identity Center ) is a popular solution, integrating with third-party providers such as Okta and allowing to centrally manage roles and permissions in multiple AWS accounts. In this post, we demonstrate that AWS SSO is vulnerable by…