Thoughts, stories and ideas from a human in cloud and identity security research.
A confused deputy is nothing more than a privileged intermediary tricked into acting for a caller who lacks the authority itself. In the cloud, it has two distinct flavors, one leveraging a non-human identity (NHI) owned by you, the customer, and one leveraging a non-human identity (NHI) owned
Congratulations, everybody—we might be entering the outer bands of the Vuln-apocalypse storm. The traditional, polite security timeline where we had weeks to patch a vulnerability is dead, replaced by a hyper-accelerated, AI-fueled reality where the time to exploitation is essentially zero. Those massive, "keystone&
I remember life before phones and Google Maps. Even before MapQuest, we all used to get lost a lot more. Back then, I’d stop at random gas stations to ask for directions, and my knowledge of highways, city streets, and far-flung roadways was actually pretty decent. But
Last week at the [un]prompted conference in San Francisco, the question on everyone's mind was: What happens when Time-to-Exploit reaches zero? The Problem, As Told By The Clock The Zero Day clock project shows a single, collapsing trendline. In 2018, the median time between a
In vulnerability and CVE hunting, you have a search space problem. Your attack surface is seemingly unlimited, so much so that target selection is often considered the most important skill of a bug bounty hunter. In this article, I'll recount the process I used to narrow the search
In the OAuth 2.0 specification, a scope defines the limits of an access token. When applied to Google APIs, a scope specifies which APIs and resources the token can access. If you only take away one thing about OAuth 2.0 Scopes for Google APIs, it is: do not
This blog outlines three vulnerabilities with user-associated HMAC keys in Google Cloud. Vulnerability #1 - Insufficient Logging Vulnerability #2 - Unmanagable Long-Term Credentials Vulnerability #3 - Unauditable Long-Term Credentials TLDR; HMAC keys serve a practical purpose. They can be used to create Sigv4 signed headers used to authenticate against the
This post aims to answer the question, 'What can go wrong when using Google Cloud services that leverage Service Agents/P4SAs?' For an introduction to Service Agents, see GCP IAM 201 - Service Agents . Below, you'll find an overview of possible threats to Google Cloud customers due
Service Agents are nothing more than a type of a Service Account . Also known as a P4SA (Per-Project, Per-Product; Service Account), a Service Agent is typically created automatically whenever its associated Google API is enabled in a Project. Service Agent and Service Account Comparison Customer-managed SAs Google-
Recently, a friend admitted to me they were resorting to a 'Hail Mary' approach for their upcoming talk, scribbling notes on notecards like a nervous high school student. "But no! That's actually a pro move," I assured them, not just a desperate scramble to
The GCP IAM 101 series is intended to give a brief, succinct overview of essential Google Cloud authorization concepts, answering questions like 'How does Alice gain access to the Bucket?' These pages are the TLDR; for Google Cloud IAM, supplemented with links to official, more verbose Google documentation
Leverage The DeRF for attacker simulations, validating security controls or enhancing cloud detection capabilities. DeRF (Detection Replay Framework) is an "Attacks As A Service" framework, allowing the emulation of offensive techniques and generation of repeatable detection samples in the cloud. Built on Google Workflows The DeRF is open-
The cloud has scrambled the context defenders are accustomed to leaning on for understanding the attack surface. No longer do attackers move along a linear network-plane, from one asset to another where visibility can be traced at a predictable layer in the network stack. In the cloud, every move
Cybersecurity experts have been quick to respond to the details of the LastPass breach in recent months. Opinion pieces have been published both addressing the critical remediation steps for customers and doling out deserved criticism of incident communication. Absent from the public discourse has been a discussion of the indicators
But how would you distinguish between legitimate backup activity and malicious data exfiltration on AWS S3? In this blog post , I walkthrough a malicious use of the S3 Replication service and how selective data event logging on the S3 service will result in a gap in S3 exfiltration visibility since