Peter Ewane - Cloudy With A Chance of Persistence

### Shifting Threat Landscapes in Amazon Web Services At 00:00, Peter Ewane opens by examining the rapid migration of modern enterprise infrastructure to Amazon Web Services (AWS). While cloud computing provides unmatched scalability and deployment speed, security teams frequently struggle to adapt traditional on-premises defensive concepts to cloud environments. Ewane explains that once an adversary compromises initial AWS credentials, the game shifts to establishing stealthy, resilient persistence mechanisms that survive credential rotation.

### Post-Exploitation and Initial IAM Compromise At 05:45 and 10:20, Ewane outlines common initial access vectors, such as leaked access key pairs in public GitHub repositories, server-side request forgery (SSRF) vulnerabilities accessing the EC2 instance metadata service (`169.254.169.254`), and overly permissive IAM roles. He demonstrates how an attacker evaluates initial privileges, using AWS CLI commands to enumerate permissions, discover attached policies, and map accessible cloud resources without generating immediate alarms.

### Establishing Stealthy Persistence in AWS Environments At 16:40, the presentation explores sophisticated persistence techniques within AWS. Ewane details how an attacker can create secondary administrative access keys on dormant IAM user accounts, attach custom policy versions with subtle privilege escalation paths, or inject malicious startup commands into EC2 User Data launch configurations. He also demonstrates deploying rogue AWS Lambda functions triggered by S3 bucket events, creating serverless backdoors that execute automatically upon legitimate business activity.

### Evasion of CloudTrail and Security Telemetry At 22:15 and 27:30, Ewane examines how attackers evade detection from AWS monitoring services like CloudTrail and GuardDuty. He reviews methods for locating unmonitored AWS geographic regions where logging is disabled by default, modifying CloudTrail trail configurations, and creating ephemeral compute instances that are spawned, executed, and terminated between standard log aggregation polling cycles.

### Cloud Incident Response and Hardening Methodologies Concluding between 30:50 and 33:47, Ewane provides comprehensive defensive guidance for cloud security architects. He advocates enforcing strict least-privilege IAM policies, activating multi-region CloudTrail logging with cryptographic log file validation, implementing service control policies (SCPs) via AWS Organizations, and utilizing automated security auditing tools to continuously identify shadow administrator permissions and exposed cloud assets.

(AI summary — Gemini 3.8 Flash)