CloudSec Wine

🔷 Canarytokens welcomes Azure Login Certificate Token

Canarytokens.org introduced the Azure Login Certificate Token (aka the Azure Token). You can sprinkle Azure tokens throughout your environment and receive high fidelity notifications whenever they're used.

https://blog.thinkst.com/2023/02/canarytokens-org-welcomes-azure-login-certificate-token.html

#azure

🔶 6 Keys to Securing User Uploads to Amazon S3

How to architect AWS applications to securely enable user uploaded content, using pre-signed post URLs.

https://scalesec.com/blog/6-keys-to-securing-user-uploads-to-amazon-s3

#aws

🔷 Azure AD Kerberos Tickets: Pivoting to the Cloud

If you've ever been doing an Internal Penetration test where you've reached Domain Admin status and you have a cloud presence, your entire Azure cloud can still be compromised.

https://www.trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud

#azure

🔶 How Using Deprecated Policies Creates Overprivileged Permissions

AmazonEC2RoleforSSM, a deprecated version of the now recommended AmazonSSMManagedInstaceCore. This post breaks down why AWS likely deprecated the original policy and how organizations leave themselves vulnerable by continuing to use these deprecated policies.

https://permiso.io/blog/s/deprecated-aws-policy-amazonec2roleforSSM

#aws

🔷 Azure B2C: Crypto Misuse and Account Compromise

Microsoft's Azure Active Directory B2C service contained a cryptographic flaw which allowed an attacker to craft an OAuth refresh token with the contents for any user account. An attacker could redeem this refresh token for a session token, thereby gaining access to a victim account as if the attacker had logged in through a legitimate login flow.

https://www.praetorian.com/blog/azure-b2c-crypto-misuse-and-account-compromise

#azure

🔶 Updated ebook: Protecting your AWS environment from ransomware

By AWS’s Megan O’Neil and Merritt Baer: The new ebook includes the top 10 best practices for ransomware protection and covers new services and features that have been released since the original published date in April 2020.

https://aws.amazon.com/ru/blogs/security/updated-ebook-protecting-your-aws-environment-from-ransomware

#aws

🔷 threatmodel-for-azure-storage

A library of all the attack scenarios on Azure Storage, and how to mitigate them following a risk-based approach.

https://github.com/trustoncloud/threatmodel-for-azure-storage

#azure

🔷 Know Your App Services Before Your Enemy Does

A look at Azure App Services, security advice, and how to use Azure Resource Graph Explorer and other tools to implement these recommendations.

https://miraisecurity.com/blog/know-your-app-services-before-your-enemy-does

#azure

🔶 Discovering a weakness leading to a partial bypass of the login rate limiting in the AWS Console

Post discussing a weakness in the AWS Console authentication flow that allowed an attacker to partially bypass the login rate limit.

https://securitylabs.datadoghq.com/articles/aws-console-rate-limit-bypass

#aws

🔷 Privilege Escalation via storage accounts

Post explaining the risk of storage accounts and how to abuse them for lateral movement.

https://rogierdijkman.medium.com/privilege-escalation-via-storage-accounts-bca24373cc2e

#azure

🔴 Sigstore’s cosign and policy-controller with GKE, Artifact Registry and KMS

Use Sigstore to sign container images and then enforce that only signed containers can run in GKE.

https://medium.com/google-cloud/sigstores-cosign-and-policy-controller-with-gke-and-kms-7bd5b12672ea

#gcp

🔶 How Adversaries Can Persist with AWS User Federation

CrowdStrike has identified a novel technique that can use the sts:GetFederationToken API to escape typical containment practices and persist in AWS environments.

https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation (open with VPN from Russia)

#aws

🔶 Data exfiltration with native AWS S3 features

A deep dive on different options for abuse of legitimate S3 features with the end goal of data exfiltration, so to better understand the shortcomings of native AWS logging and monitoring tooling, and to offer some suggestions for how to go about detecting their use and abuse.

https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436

#aws

🔷 2023 identity security trends and solutions from Microsoft

Microsoft has published a very good summary about AzureAD security trends in 2023 which considered post authentication attacks.

https://www.microsoft.com/en-us/security/blog/2023/01/26/2023-identity-security-trends-and-solutions-from-microsoft

#azure

🔴 Incident Response in Google Cloud: Forensic Artifacts

This article examines forensic artifacts available in GCP and provides recommendations for triage and prioritization.

https://blog.sygnia.co/incident-response-in-google-cloud-forensic-artifacts

#gcp

🔶 AWS Could Do More About SSO Device Auth Phishing

Great overview by Rami McCarthy about SSO device auth phishing, what AWS should and could do, and what you can do to protect your org.

https://ramimac.me/aws-device-auth

#aws

🔴 GoogleCloudPlatform/security-response-automation

Take automated actions on your GCP Security Command Center findings, like:

- Automatically create disk snapshots to enable forensic investigations.
- Revoke IAM grants that violate your desired policy.
- Notify other systems such as PagerDuty, Slack or email.

https://github.com/GoogleCloudPlatform/security-response-automation

#gcp

🔶 awslabs/iam-roles-anywhere-session

This package provides an easy way to create a refreshable boto3 Session with AWS Roles Anywhere.

https://github.com/awslabs/iam-roles-anywhere-session

#aws

🔶🔴 Provisioning Kubernetes clusters on AWS/GCP with Terraform

Learn how you can leverage Terraform and GKE or EKS to provision identical clusters for development, staging and production environments with a single click.

https://learnk8s.io/terraform-gke

#aws #gcp

🔶 Tampering User Attributes In AWS Cognito User Pools

Post explaining AWS Cognito User Attributes tampering and introducing a free lab to experiment with.

https://blog.doyensec.com/2023/01/24/tampering-unrestricted-user-attributes-aws-cognito.html

#aws