Cloud Village
Cloud Village
  • Видео 88
  • Просмотров 25 108
UnOAuthorized: Discovering the path to privilege elevation to Global Administrator
Abstract:
For customers of Microsoft 365 and Azure, obtaining the role of Global Administrator (GA) is every attacker's dream - it is the Domain Administrator of the cloud. This makes Global Administrator every organization's nightmare of being owned by a threat group or hacker. Luckily, well-defined role-based access control and a strict application consent model can severely limit who gets their fingers on Global Administrator - or does it?
This talk explores a novel discovery that resulted in privilege elevation to Global Administrator in Entra ID (Azure AD). Part conversation about the research background, part discussion of the foundational components involved, this talk will walk ste...
Просмотров: 86

Видео

Exploit K8S via Misconfiguration .YAML in CSP environments26:38Exploit K8S via Misconfiguration .YAML in CSP environments
Exploit K8S via Misconfiguration .YAML in CSP environments
Просмотров 102День назад
Slides - www.slideshare.net/slideshow/exploit-k8s-via-misconfiguration-yaml-in-csp-environments/273379601 Abstract: In this presentation, we researched vulnerable security configurations that enable attacks on Kubernetes (K8s) clusters and examined how these settings can be exploited in CNCF projects. Kubernetes (K8s) uses YAML files to manage various security settings, leading to potential att...
ExploitIfNotExists: Privilege Escalation & Persistence with Azure Policy12:52ExploitIfNotExists: Privilege Escalation & Persistence with Azure Policy
ExploitIfNotExists: Privilege Escalation & Persistence with Azure Policy
Просмотров 47День назад
Abstract: The Microsoft Azure threat matrix contains a mysterious and almost empty item: AZT508 - Azure Policy, which suggests this service can break bad but gives almost no details as to how. To quote Microsoft: “Azure Policy helps to enforce organizational standards and to assess compliance at-scale.“ How does this banal sounding service come to be used for attacking Azure users? This talk ai...
Cloud Offensive Breach and Risk Assessment (COBRA)15:40Cloud Offensive Breach and Risk Assessment (COBRA)
Cloud Offensive Breach and Risk Assessment (COBRA)
Просмотров 15614 дней назад
Slides - www.slideshare.net/slideshow/cloud-offensive-breach-and-risk-assessment-cobra/273208057 Abstract: Cloud Offensive Breach and Risk Assessment (COBRA) is an open-source tool designed to empower users to simulate attacks within multi-cloud environments, offering a comprehensive evaluation of security controls. By automating the testing of various threat vectors including external and insi...
One Port to Serve Them All - Google GCP Cloud Shell Abuse16:02One Port to Serve Them All - Google GCP Cloud Shell Abuse
One Port to Serve Them All - Google GCP Cloud Shell Abuse
Просмотров 4328 дней назад
Slides - www.slideshare.net/slideshow/one-port-to-serve-them-all-google-gcp-cloud-shell-abuse/272893190 Abstract: The Cloud Shell feature from cloud service providers offers a convenient way to access resources within the cloud, significantly improving the user experience for both administrators and developers. However, even though the spawned instance has a short lifespan, granting excessive p...
The Oracle Awakens: Demystifying Privilege Escalation in the cloud28:51The Oracle Awakens: Demystifying Privilege Escalation in the cloud
The Oracle Awakens: Demystifying Privilege Escalation in the cloud
Просмотров 119Месяц назад
Slides - www.slideshare.net/slideshow/the-oracle-awakens-demystifying-privilege-escalation-in-the-cloud/272820013 Abstract: In this talk, we explore privilege escalation mechanisms and paths within Oracle Cloud. Privilege escalation, the process by which an attacker gains elevated access and permissions beyond those intended by the cloud administrator, poses a significant threat in cloud enviro...
Catch them all! Detection Engineering and Purple Teaming in the Cloud26:00Catch them all! Detection Engineering and Purple Teaming in the Cloud
Catch them all! Detection Engineering and Purple Teaming in the Cloud
Просмотров 253Месяц назад
Slides - www.slideshare.net/slideshow/catch-them-all-detection-engineering-and-purple-teaming-in-the-cloud/272701035 Abstract: Where to start looking for attackers in a cloud environment? In a world where cloud providers have hundreds of services and thousands of API calls, getting started can feel overwhelming. In this talk, we lay out the foundations of a modern detection engineering program ...
Gone in 60 Seconds… How Azure AD/Entra ID Tenants are Compromised37:02Gone in 60 Seconds… How Azure AD/Entra ID Tenants are Compromised
Gone in 60 Seconds… How Azure AD/Entra ID Tenants are Compromised
Просмотров 2,4 тыс.Месяц назад
Gone in 60 Seconds… How Azure AD/Entra ID Tenants are Compromised
CNAPPGoat A multicloud vulnerable by design infrastructure deployment tool23:22CNAPPGoat A multicloud vulnerable by design infrastructure deployment tool
CNAPPGoat A multicloud vulnerable by design infrastructure deployment tool
Просмотров 211Год назад
CNAPPGoat A multicloud vulnerable by design infrastructure deployment tool
Tales from a detection engineering in AWSland32:09Tales from a detection engineering in AWSland
Tales from a detection engineering in AWSland
Просмотров 385Год назад
Tales from a detection engineering in AWSland
Security Logging in the cloud, trade offs to consider and patterns to maximise the effectiveness of37:10Security Logging in the cloud, trade offs to consider and patterns to maximise the effectiveness of
Security Logging in the cloud, trade offs to consider and patterns to maximise the effectiveness of
Просмотров 113Год назад
Security Logging in the cloud, trade offs to consider and patterns to maximise the effectiveness of
Tag, You're Exposed Exploring Azure Service Tags and their Impact on your Security Boundary32:13Tag, You're Exposed Exploring Azure Service Tags and their Impact on your Security Boundary
Tag, You're Exposed Exploring Azure Service Tags and their Impact on your Security Boundary
Просмотров 338Год назад
Tag, You're Exposed Exploring Azure Service Tags and their Impact on your Security Boundary
Call Me Phishmael Hunting Sensitive Docker Images in Google Container Registry Leaks40:41Call Me Phishmael Hunting Sensitive Docker Images in Google Container Registry Leaks
Call Me Phishmael Hunting Sensitive Docker Images in Google Container Registry Leaks
Просмотров 203Год назад
Call Me Phishmael Hunting Sensitive Docker Images in Google Container Registry Leaks
The Human Threat Factor Cloud Security Misconfigurations39:52The Human Threat Factor Cloud Security Misconfigurations
The Human Threat Factor Cloud Security Misconfigurations
Просмотров 89Год назад
The Human Threat Factor Cloud Security Misconfigurations
Bridging the Gap Cloud Threat Intelligence for Detection and Offensive Security Practitioners35:43Bridging the Gap Cloud Threat Intelligence for Detection and Offensive Security Practitioners
Bridging the Gap Cloud Threat Intelligence for Detection and Offensive Security Practitioners
Просмотров 114Год назад
Bridging the Gap Cloud Threat Intelligence for Detection and Offensive Security Practitioners
What the Function A Deep Dive into Azure Function App Security35:42What the Function A Deep Dive into Azure Function App Security
What the Function A Deep Dive into Azure Function App Security
Просмотров 174Год назад
What the Function A Deep Dive into Azure Function App Security
CloudRecon finding ephemeral assets in the cloud21:14CloudRecon finding ephemeral assets in the cloud
CloudRecon finding ephemeral assets in the cloud
Просмотров 546Год назад
CloudRecon finding ephemeral assets in the cloud
The Rocky Balboa Guide to Security Research Getting Back Up When You Get Knocked Down29:19The Rocky Balboa Guide to Security Research Getting Back Up When You Get Knocked Down
The Rocky Balboa Guide to Security Research Getting Back Up When You Get Knocked Down
Просмотров 187Год назад
The Rocky Balboa Guide to Security Research Getting Back Up When You Get Knocked Down
Google Workspace Red Team Automation with SWAT23:31Google Workspace Red Team Automation with SWAT
Google Workspace Red Team Automation with SWAT
Просмотров 156Год назад
Google Workspace Red Team Automation with SWAT
SSO Sloppy, SSO Suspect, SSO Vulnerable33:42SSO Sloppy, SSO Suspect, SSO Vulnerable
SSO Sloppy, SSO Suspect, SSO Vulnerable
Просмотров 154Год назад
SSO Sloppy, SSO Suspect, SSO Vulnerable
Between a Log and a Hard Place misAdventures in Azure Logs31:41Between a Log and a Hard Place misAdventures in Azure Logs
Between a Log and a Hard Place misAdventures in Azure Logs
Просмотров 118Год назад
Between a Log and a Hard Place misAdventures in Azure Logs
IAM APE30:14IAM APE
IAM APE
Просмотров 200Год назад
IAM APE
Infrastructure as Remote Code Execution42:58Infrastructure as Remote Code Execution
Infrastructure as Remote Code Execution
Просмотров 110Год назад
Infrastructure as Remote Code Execution
Azure DevOps Security35:30Azure DevOps Security
Azure DevOps Security
Просмотров 211Год назад
Azure DevOps Security
MetaHub Demo Automating Ownership, Context, and Impact Assessment in Security Findings26:21MetaHub Demo Automating Ownership, Context, and Impact Assessment in Security Findings
MetaHub Demo Automating Ownership, Context, and Impact Assessment in Security Findings
Просмотров 130Год назад
MetaHub Demo Automating Ownership, Context, and Impact Assessment in Security Findings
Identifying and securing Firebase vulnerabilities at scale17:58Identifying and securing Firebase vulnerabilities at scale
Identifying and securing Firebase vulnerabilities at scale
Просмотров 68Год назад
Identifying and securing Firebase vulnerabilities at scale
Attacks as a Service with The DeRF30:25Attacks as a Service with The DeRF
Attacks as a Service with The DeRF
Просмотров 227Год назад
Attacks as a Service with The DeRF
From Service Catalog Admin to Account takeover Privilege Escalation with Service Catalog Launch Con14:48From Service Catalog Admin to Account takeover Privilege Escalation with Service Catalog Launch Con
From Service Catalog Admin to Account takeover Privilege Escalation with Service Catalog Launch Con
Просмотров 65Год назад
From Service Catalog Admin to Account takeover Privilege Escalation with Service Catalog Launch Con
The Dark Playground of CI:CD Attack Delivery by GitHub Actions22:56The Dark Playground of CI:CD Attack Delivery by GitHub Actions
The Dark Playground of CI:CD Attack Delivery by GitHub Actions
Просмотров 102Год назад
The Dark Playground of CI:CD Attack Delivery by GitHub Actions
Evading Logging in the Cloud Bypassing AWS CloudTrail33:37Evading Logging in the Cloud Bypassing AWS CloudTrail
Evading Logging in the Cloud Bypassing AWS CloudTrail
Просмотров 356Год назад
Evading Logging in the Cloud Bypassing AWS CloudTrail

Комментарии

  • @jessicadunn8417
    @jessicadunn8417 2 года назад

    Mike, does this also apply to a lab environment with no access to production?

  • @julianwieg
    @julianwieg 2 года назад

    Thanks. Really helped me

  • @quynhnguyenthinhu8392
    @quynhnguyenthinhu8392 3 года назад

    You try to give the video more brightness it will be great if you do

  • @teachingcyber
    @teachingcyber 3 года назад

    i really want to watch this but the audio is really bad :(

  • @AlexandreSieira
    @AlexandreSieira 3 года назад

    This was a blast! Our thanks to the Cloud Village organizers for the amazing event and for putting up with us!

    • @gerardketuma
      @gerardketuma 3 года назад

      Wow, thanks for this. I really learned a lot from your presentation.

  • @rupalidash3638
    @rupalidash3638 4 года назад

    this is a really great session

  • @paulineeaton3024
    @paulineeaton3024 4 года назад

    Great vids, looking forward to more uploads. I think you should check smzeus”.”com to help grow your channel!

  • @AlexandreSieira
    @AlexandreSieira 4 года назад

    This was a lot of fun! Thank you very much to the Cloud Village team for all the great work they put into this year's edition a great success.

  • @AshishRajan
    @AshishRajan 4 года назад

    This is a great talk. Great job! We should talk about this on my podcast Alexandre!

    • @AlexandreSieira
      @AlexandreSieira 4 года назад

      It would be a pleasure, Ashish! I'll reach out to you on Twitter...