Cloud Security Research and Advocacy @Datadoghq. Previous: Cloud Penetration Testing lead @BishopFox. Also on Mastodon https://xitter.cf/t.co/R1KYbwIdme
Ithaca, NY
Joined June 2010
- Tweets1.1K
- Following371
- Followers1.4K
- Likes3K
Seth Art retweeted
📣 Issue 84 is out. Highlights:
- Amazon Inspector enhances the security engine for container images scanning.
- AWS CloudTrail network activity events for VPC endpoints now generally available.
- whoAMI: A cloud image name confusion attack by Seth Art.
- Uncovering a Hidden CloudTrail Bug by Tracing AWS AssumeRole Chains in a Graph Database by Or Aspir.
- Tool: Cloud Trail Discover cheat sheet.
aws-cloudsec.com/p/issue-84
Seth Art retweeted
whoAMI attacks give hackers code execution on Amazon EC2 instances - @billtoulas
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Seth Art retweeted
whoAMI research by DataDog. I immediately thought about all the user-data scripts that me be attached to those launched EC2 instance images 🥶
Kudos to @sethsec for the discovery, research, and tool!
#aws #cloudsecurity
securitylabs.datadoghq.com/a…
Seth Art retweeted
The prior name confusion issue: ramimac.me/poisoning-ssm-com…
Seth Art retweeted
Excellent research here from @sethsec and crew - including responsible disclosure, AWS hardening enhancement, detection guidance, etc.
🤔 I did report a name confusion in SSM Documents impacting Datadog right before this was found... 😜
Need to hack thousands of AWS customers? What about on internal AWS systems? Datadog Security Research found that a number of tools, including one published by AWS, are susceptible to name confusion attacks, leading to RCE in vulnerable environments!
securitylabs.datadoghq.com/a…
Seth Art retweeted
Fun with Google Cloud's default service accounts (and how to leverage them for offensive purposes)
securitylabs.datadoghq.com/a…
Seth Art retweeted
🔗In this article we talk about how I exploited a Fortune 500 Through Hidden Supply Chain Links
Link 👇
landh.tech/blog/20241028-hid…
Thanks to the entire @HashiCorp team ! 🤟
Enjoy 🔥
Seth Art retweeted
☁️ State of Cloud Security
2024 update of @Datadog’s report analyzing security posture data from a sample of thousands of orgs across AWS, Azure, and Google Cloud
• Long-lived credentials continue to be a major risk.
• Adoption of public access blocks in cloud storage services is rapidly increasing,
• <1/2 of EC2 instances enforce IMDSv2, but adoption is growing
• Securing managed Kubernetes clusters requires non-default, cloud-specific tuning
• Insecure IAM roles for third-party integrations leave AWS accounts at risk of exposure
• Most cloud incidents are caused by compromised cloud credentials
datadoghq.com/state-of-cloud…
Seth Art retweeted
Mine & @sabi_elezi's #MaLDAPtive presentation from @defcon is now posted on YouTube! LDAP obfuscation, deobfuscation & detection - all built on our 100% custom LDAP parser.
Recording: youtube.com/watch?v=mKRS5Iyy…
Tool: github.com/MaLDAPtive/Invoke…
@permisosecurity #LDAP #ClippyGotJokes
Seth Art retweeted
Excited to share some research I've been working on for the past few months, based on real-world data from thousands of environments using AWS, Azure and Google Cloud!
datadoghq.com/state-of-cloud…
Seth Art retweeted
Registration for the 2024 CNY Hackathon is now open!
cnyhackathon-2024-registrati…
Seth Art retweeted
Great blog post from @permisosecurity on LLMHijacking attacks against AWS Bedrock. I remember when we first started seeing this behavior from threat actors and I couldn't figure out why they would target Bedrock. Well, I guess we have on answer. 🧵
permiso.io/blog/exploiting-h…
Seth Art retweeted
I’ve had this research from @_sigil bookmarked for a thorough read through.
Excellent technical dive into abusing AU’s in #EntraID, and appreciate the balance of the article in highlighting the benefits of AU’s and their power for good at the same time 1/x
#Entra #infosec
☁️ Thank you @fwdcloudsec for the chance to present "Hidden in Plain Sight: (Ab)using Entra's AUs"!! Slides are available here:
docs.google.com/presentation…
Seth Art retweeted
Come work with me!
bishopfox.com/jobs?gh_jid=62…
Seth Art retweeted
LinkedIn is now using everyone's content to train their AI tool -- they just auto opted everyone in.
I recommend opting out now (AND that orgs put an end to auto opt-in, it's not cool)
Opt out steps: Settings and Privacy > Data Privacy > Data for Generative AI Improvement (OFF)
Seth Art retweeted
AWS has announced their new Vulnerability Disclosure Program (VDP)!! Yaaaay!!! As a vocal critic of how AWS has traditionally been behind their competitors on this, I wanted to write a thread and talk about it. Firstly, it's important to know, this is NOT a bug bounty. 🧵
Seth Art retweeted
Just announced! 🚀 #AWS is extending its Vulnerability Disclosure Program to accept security reports on HackerOne. Thank you to all the security researchers that help keep our customers safe. #cloudsecurity @Hacker0x01
Learn how you can participate. 👉 hackerone.com/aws_vdp
