DEF CON 32 - Breaching AWS Through Shadow Resources - Yakir Kadkoda, Michael Katchinskiy, Ofek Itach
Source: YouTube · DEFCONConference · published Oct 16, 2024 · 37:13
An attacker can exploit predictable S3 bucket names in AWS services to achieve account takeover via shadow resources and bucket squatting, highlighting a critical vulnerability in AWS's automatic resource creation. 3:01
Key Takeaways:
• Shadow resources—automatically created S3 buckets (e.g., by CloudFormation) with predictable names—can be claimed by attackers to enable information disclosure and remote code execution 5:26.
• Bucket name patterns (e.g., CF-template--) allow attackers to perform bucket squatting, leading to data leakage, injection of malicious scripts, and admin role creation 9:00.
• AWS Glue and EMR vulnerabilities enable remote code execution and stored XSS via modified scripts stored in attacker-controlled buckets 19:14.
• The "bucket monopoly" technique scales attacks by claiming buckets across all AWS regions, increasing the likelihood of victim compromise 30:03.
• Mitigations include using resource account conditions in IAM policies, verifying bucket ownership via the x-amz-bucket-owner header, and making bucket names less predictable with random strings 35:00.
AWS account IDs are not adequately protected, and their exposure enables severe cloud breaches—researchers urge immediate adoption of defensive practices. 35:15
Sources:
- 3:01 Introduction to shadow resources and AWS account ID secrecy debate
- 5:26 Explanation of bucket naming patterns and bucket squatting
- 9:00(https://www.youtube.com/watch?v=m9QV
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
so hello everybody we are very exciting to be here and welcome to the session breaching AWS accounts through Shadow resources and in this session we will demonstrate several vulnerabilities that we found on AWS the most severe of this vulnerability could allow an attacker to add an admin role to another account so let's start let's start by discussing the most debatable topic on AWS which is AWS account ID so each AWS account has a unique identifier associated with it this identifier consist of 12 digits and the most important thing about this is that some treat it as a secret and some don't and along the history of AWS we have many different opinion whether it is a secret or not although AWS in their documentation state that this account ID should shared carefully they do not consider thi…