AWS CloudQuarry: Digging for Secrets in Public AMIs
Analysis of 3.1 million public Amazon Machine Images uncovering exposed credentials, API keys, and account takeover vectors.
Summary
Scanning Public Cloud Images at Scale
Join us as we unravel another story of public resources from AWS, digging in 3.1 million AMIs for secrets. Beyond the findings, we'll delve into the ominous connection between exfiltrated AWS access credentials from these AMIs and the heightened risk of AWS account takeover. This talk will highlight key methodologies, tools, and lessons learned, emphasizing the critical need for robust security measures in the cloud to prevent both data exposure and potential account compromise.
Related talks
Main Stage·37 min
Yakir Kadkoda · Michael Katchinskiy · Ofek Itach
Six critical attack vectors exploiting implicit and internal shadow resources created by AWS services to achieve cross-tenant and account takeover.
Main Stage·39 min
Nick Frichette
Deep dive into vulnerabilities in AWS services and cloud architectures that enable attackers to gain initial access to customer workloads.
Main Stage·29 min
Ben Sadeghipour
Demonstrates how SSRF vulnerabilities provide a direct path from web application to cloud metadata service, IAM credentials, and full account compromise.