CloudSec Wine

🔴 Automatically disabling leaked service account keys: What you need to know

Starting June 16, exposed service account keys that have been detected in services including public repos will be automatically disabled by default for new and existing customers.

https://cloud.google.com/blog/products/identity-security/automatically-disabling-leaked-service-account-keys-what-you-need-to-know

#gcp

🔶 Investigating lateral movements with Amazon Detective investigation and Security Lake integration

How you can use the Amazon Detective Investigation feature to investigate IAM user and role activity and use the Security Lake integration to determine the specific EC2 instances a threat actor appeared to be targeting.

https://aws.amazon.com/ru/blogs/security/investigating-lateral-movements-with-amazon-detective-investigation-and-security-lake-integration/

#aws

🔶 Governing and securing AWS PrivateLink service access at scale in multi-account environments

A way to create preventative controls through the use of service control policies (SCPs) and detective controls through event-driven automation.

https://aws.amazon.com/ru/blogs/security/governing-and-securing-aws-privatelink-service-access-at-scale-in-multi-account-environments/

#aws

🔶 Monitoring your EKS clusters audit logs

A plugin has replaced the way Falco consumes the Audit Logs generated by a K8s API server. With these plugins, Falco covers more in depth the aspects of your infrastructure and allows you to use a single syntax for rules.

https://falco.org/blog/k8saudit-eks-plugin/

#aws

👩‍💻 Hunting in Azure subscriptions

This blog post covers various strategies and methodologies to help understand the scope and complexity of how threat actors' manoeuvre within Azure subscriptions.

https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/hunting-in-azure-subscriptions/ba-p/4125875

#azure

🔴 Introducing Google Security Operations: Intel-driven, AI-powered SecOps

At RSA, Google announced AI innovations across the Google Cloud Security portfolio, including Google Threat Intelligence, and the latest release of Google Security Operations

https://cloud.google.com/blog/products/identity-security/introducing-google-security-operations-intel-driven-ai-powered-secops-at-rsa/

#gcp

🔶 AWS Application Load Balancer mTLS with open-source cloud CA

A step-by-step guide on implementing mTLS for AWS Application Load Balancer using an open-source cloud CA.

https://medium.com/@paulschwarzenberger/aws-application-load-balancer-mtls-with-open-source-cloud-ca-277cb40d60c7

(Use VPN to open from Russia)

#aws

🔶 Detecting Manual Actions in EKS Clusters with Terraform and SNS

How to set up audit alerts and monitoring for manual actions in EKS resources, such as ClusterRoleBinding or Secret creation or deletion.

https://medium.com/@seifeddinerajhi/detecting-manual-actions-in-eks-clusters-with-terraform-and-sns-65397416c1f9

(Use VPN to open from Russia)

#aws

🔶 AWS CloudQuarry: Digging for Secrets in Public AMIs

Money, secrets and mass exploitation: This research unveils a quarry of sensitive data stored in public AMIs. Digging through each AMI they managed to collect 500 GB of credentials, private repositories, access keys and more.

https://securitycafe.ro/2024/05/08/aws-cloudquarry-digging-for-secrets-in-public-amis/

#aws

🔶 terraform-aws-slackbot

A simple, serverless back end for your Slack app.

https://github.com/amancevice/terraform-aws-slackbot

#aws

🔶 How an empty S3 bucket can make your AWS bill explode

Imagine you create an empty, private AWS S3 bucket in a region of your preference. What will your AWS bill be the next morning?

https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-can-make-your-aws-bill-explode-934a383cb8b1

(Use VPN to open from Russia)

#aws

👩‍💻 Arbitrary 1-click Azure tenant takeover via MS application

This blog explains how reply URLs in Azure Applications can be used as a vector for phishing. The impact of this can range from data leaks to complete tenant takeover; just by luring a victim into clicking on a link.

https://falconforce.nl/arbitrary-1-click-azure-tenant-takeover-via-ms-application/

#azure

👩‍💻 A Look at a Recently Patched Microsoft Graph Logging Bypass - GraphNinja

From June 2023 to March 2024, Microsoft Graph was vulnerable to a logging bypass that allowed attackers to perform password-spray attacks undetected. During this period, any organization in Azure could have been attacked and would have had no indication of the activity.

https://trustedsec.com/blog/full-disclosure-a-look-at-a-recently-patched-microsoft-graph-logging-bypass-graphninja

#azure

👩‍💻 You Can't See Me: Achieving Stealthy Persistence in Azure Machine Learning

When an AML workspace is created, by default, the Storage Account is publicly accessible using the access key.

https://www.trendmicro.com/vinfo/in/security/news/cybercrime-and-digital-threats/you-cant-see-me-achieving-stealthy-persistence-in-azure-machine-learning

#azure

👩‍💻 New Microsoft Incident Response guide helps simplify cyberthreat investigations

Microsoft Incident Response experts have created a guide on using Windows Internals for forensic investigations.

https://www.microsoft.com/en-us/security/blog/2024/04/23/new-microsoft-incident-response-guide-helps-simplify-cyberthreat-investigations/

#azure

🔶 npk

NPK is a distributed hash-cracking platform built entirely of serverless components in AWS including Cognito, DynamoDB, and S3. It was designed for easy deployment and the intuitive UI brings high-power hash-cracking to everyone.

https://github.com/c6fc/npk

#aws

👩‍💻 AHHHZURE

AHHHZURE is an automated deployment script that creates a vulnerable Azure cloud lab for offensive security practitioners and enthusiasts to brush up their cloud sec skills.

https://github.com/gladstomych/AHHHZURE

#azure

🔶 Using an Undocumented Amplify API to Leak AWS Account IDs

Writeup for a technique that allowed to leak an AWS account ID from an Amplify app.

https://frichetten.com/blog/undocumented-amplify-api-leak-account-id/

#aws

🔶 Our Journey Migrating to AWS IMDSv2

Slack moved their entire fleet and tools to IMDSv2. In this article, they discuss the pitfalls of using IMDSv1 and their journey towards fully migrating to IMDSv2.

https://slack.engineering/our-journey-migrating-to-aws-imdsv2/

#aws

🔶 Integrate Kubernetes policy-as-code solutions into Security Hub

A solution to send policy violations from PaC solutions using Kubernetes policy report format (for example, using Kyverno) or from Gatekeeper's constraints status directly to AWS Security Hub.

https://aws.amazon.com/ru/blogs/security/integrate-kubernetes-policy-as-code-solutions-into-security-hub/

(Use VPN to open from Russia)

#aws