The Cloud is a Spider Web: But with Broken Threads

## Overview

Nitesh Sarana and Nelson William Gamassa Sanchez from Trend Micro presented research on widespread cloud security misconfigurations affecting Azure services. The talk examined 8,000+ subdomain takeovers and credential exposures reported to Microsoft, demonstrating how broken cloud resource management creates supply chain attack vectors.

## Part 1: SAS Tokens and Cloud Credentials in URLs

SAS (Shared Access Signature) tokens are URL parameters delegating access to Azure storage but are frequently misconfigured with overly permissive privileges (read, write, delete). The researchers traced a history of SAS token abuse: a 2019 incident where Azure Functions code could be tampered via tokens, and a 2023 Wiz finding of a token exposing 38 terabytes of Microsoft AI researcher data.

Scanning the top 1 million websites revealed two significant cases. First, a CMS provider distributed JavaScript through Azure blob storage using a SAS token without subresource integrity (SRI) validation. The token, valid until 2030, affected eight initial websites but spread to all customers of the CMS provider via a shared footer. An attacker could modify the JavaScript file, causing credential theft, supply chain compromise, and browser-based cryptomining across unknown numbers of users.

Second, researchers found signed DLLs on VirusTotal containing cloud credentials—a rare finding. An Axis Communications plugin for Autodesk Revit (AEC AB provider) embedded storage account keys and SAS tokens with all permissions. The plugin downloads Autodesk Revit files (RFA) to model network cameras. Attackers with credentials could modify these files; ZDI researchers had discovered RCE vulnerabilities in RFA format, enabling full remote code execution when users opened compromised files through the plugin.

Axis Communications response progressed over three stakes: version 708 contained plaintext credentials; version 710 obfuscated them but new credentials and storage accounts were found; version 718 reduced permissions to read/list only with SAS tokens, though the unrevoked access key for one storage account remained problematic initially.

## Part 2: Universal DNS Zones and Subdomain Takeovers

Cloud providers maintain "universal DNS zones"—shared namespaces where deleted resource names become available to anyone. When customers delete cloud resources, the associated DNS entries become available for attacker registration, creating a use-after-free scenario. Microsoft maintains 27 public universal DNS zones plus 27 additional zones in the China namespace, with many vulnerable to takeover.

Common Crawl scanning revealed millions of publicly facing URLs pointing to Azure universal DNS zones. The researchers demonstrated six cases resulting in immediate remote code execution:

1. **Account Name**: Took over a domain accessed by Microsoft internal systems for document retrieval; required exploiting document vulnerabilities for RCE.

2. **Team Foundation Server**: Takeover of a domain referenced in Team Foundation Server 2017 line for custom Python package repositories; direct RCE via malicious packages; potential for source code exfiltration and database dumping.

3. **Azure Service Bus**: Jenkins automation scripts accessed a takeable Jenkins controller domain; potential credential theft and access to internal infrastructure.

4. **PowerShell Gallery**: Takeover enabled supplying malicious PowerShell modules via Microsoft-documented endpoints.

5. **Microsoft ML Library (2019)**: Old machine learning forecasting library with notebooks referencing a takeable blob storage domain; RCE via malicious Python wheels.

6. **Azure CLI**: Critical case where the MSI installer metadata referenced a takeable domain. After researchers took over, they monitored traffic and observed CI/CD pipelines downloading the old CLI version even after Microsoft fixed the domain. Investigation suggested Microsoft deprecated the CDN service in 2014; the domain became available around April-May, likely due to internal deprecation removing documentation.

## Vendor Coordination and Response

Between January and June, researchers reported 8,000+ resources across 10+ Azure services (container registry images, GitHub repositories, NPM packages). Microsoft's response included removing/archiving inactive repositories, active replacement and sinkholing of resources, documentation changes, and introduction of secure unique default hostnames for services.

## Key Takeaways

- Scan URL parameters and code (DLLs, container images, APKs) for embedded credentials - Maintain clear credential rotation and revocation plans - Subject releases to sandboxing and QA testing before distribution - Trust but verify third-party vendors and their releases - Apply least privilege principles; avoid overly permissive permissions - Monitor internal changes (documentation deprecation, service removal) for external security impact - Proactively scan for takeable domains and monitor dangling cloud resources - Review forks of vulnerable codebases; fixes in original repos don't propagate automatically

AWS showed similar but less prevalent issues with S3 bucket takeovers exploiting cloud formation environment variables and region-based naming patterns.