Lateral Movement & Privilege Escalation in GCP
Dylan Ayrey and Allison Donovan dissect Google Cloud Platform's security model, exploiting default service account permissions and `actAs` delegation to escalate privileges.
Summary
Contrasting GCP and AWS Cloud Security Architectures
While AWS enforces explicit least-privilege defaults, Google Cloud Platform (GCP) frequently assigns powerful default service accounts to managed compute instances, Cloud Functions, and Jupyter notebooks.
Abusing the `actAs` IAM Permission
Dylan Ayrey and Allison Donovan analyze the mechanics of `iam.serviceAccounts.actAs`, illustrating how unprivileged identities can impersonate high-privilege service accounts.
Chaining GCP Services for Full Organization Compromise
The researchers demonstrate novel lateral movement paths through Cloud Build, Compute Engine, and Cloud Storage to escalate privileges to Organization Administrator.
Hardening IAM Policies and Least Privilege
Actionable recommendations provide cloud architects with automated auditing scripts to eliminate dangerous default service account roles and enforce fine-grained IAM conditions.
Related talks
Main Stage·27 min
Dylan Ayrey · Allison Donovan
Dylan Ayrey and Allison Donovan answer questions regarding Google Cloud IAM nuances, default service accounts, and cloud lateral movement.
Main Stage·37 min
Yakir Kadkoda · Michael Katchinskiy · Ofek Itach
Six critical attack vectors exploiting implicit and internal shadow resources created by AWS services to achieve cross-tenant and account takeover.
Main Stage·24 min
Sharon Brizinov · Tal Skverer
Tal Skverer details GhostToken, a critical zero-day vulnerability in Google Cloud Platform allowing third-party OAuth apps to become invisible and unremovable.