Exfiltrating ECS Task Metadata Credentials
AWS · ECS · disclosed · Aug 2024
Your production credentials are about one small bash script away from being somebody else's production credentials. Took an afternoon. Should not have.
Side B — things that were fine until they weren't
The research
Written the way I would explain it at a conference bar: what everyone assumed, why that assumption was wrong, and exactly what it let you do next.
Persistence via Shared Sessions on Cloud Workstations
GCP · shared sessions · Nov 2023
You logged out. The session did not. It is still there. It says hello.
Bypass CloudTrail Detection via AppStream
AWS · audit logging · Sept 2023
Your audit log is the record of what happened, right up until the part where it quietly is not. Everything looked fine. That was the problem.
Tracking Outbound Traffic from NAT Gateways
AWS · networking · Jul 2022
Everything leaving your network goes through one door, and for years nobody had bothered to check who was walking out of it. Turns out: a lot of things.