2018 - Martin Holste - An Anatomy Of A Cloud Hack

Martin Holste presents an analysis of real-world cloud security incidents, demonstrating how attackers compromise cloud environments in as little as 48 hours. He emphasizes that credential theft remains the primary attack vector, with developers inadvertently exposing secrets through connection strings and configuration files in cloud storage. Two amalgamated real-world scenarios illustrate attack patterns: Day 1 involves stolen credentials and reconnaissance; Day 2 includes data exfiltration via API calls and snapshot mounting; Day 3 involves resource abuse. Holste explains why cloud attacks move rapidly compared to on-premises incidents: attackers leverage the same APIs as administrators, obtain programmatic reconnaissance results in seconds rather than days, and exploit environment homogeneity to reuse attack patterns across victims.

Cloud-specific attack techniques include mounting database snapshots on separate instances to bypass security controls, enumerating S3 buckets via DNS, over-provisioning instance roles with excessive permissions, spinning up cryptocurrency mining instances on compromised accounts, and creating persistent Lambda functions that delete and recreate themselves to remain invisible to console inspection.

Detection relies on weak signals—login from new IPs, changed user agents, unusual API activity—that individually are insufficient but collectively indicate compromise when correlated over 24+ hour windows. This requires operational SOC involvement rather than post-incident analysis. Holste discusses cloud provider logging: AWS offers CloudTrail (audit), CloudWatch (operational/app logs), VPC Flow Logs (network), and GuardDuty (security alerts); Azure provides Activity Logs, Network Watcher Flows, and Security Center, though basic features like login audit require premium tiers. Application logging is critical for serverless environments (Lambda) and containers, as traditional endpoint telemetry becomes unavailable. A troubling trend is cloud providers and SaaS vendors (Salesforce, Azure) charging premium rates for basic logging visibility, creating security blind spots.

Key takeaways include: visibility must be operationalized daily, not sought post-incident; organizations should specialize in one cloud provider rather than attempting mastery of all platforms; correlation of signals requires understanding development practices and cross-domain telemetry; on-premises and cloud logs must be correlated as attackers pivot between both; phishing remains foundational; the shared responsibility model requires enforced logging standards and role-based access; DevSecOps integration is essential for rapid deployments; and cloud platform changes require continuous learning. Holste emphasizes the importance of verifying heartbeats for critical logging streams, as permissions changes or ephemeral infrastructure can silently interrupt data collection.