Presented at
ToorCon San Diego TwentyOne (2019),
Nov. 9, 2019, 11:30 a.m.
(25 minutes).
Red Teaming inside Google Cloud Platform (GCP): Breach into Targets, Expand Access within Kubernetes (K8s) environments, & Persist!
Cloud services are frequently misconfigured due to their rapid adoption and engineers not fully understanding the security ramifications of different configurations, which can frequently enable red teams to gain, expand, and persist access within Google Cloud Platform (GCP) environments.
In this talk we will dive into how GCP services are commonly breached (e.g. SSRF vulnerabilities, discovering insecure cloud storage), and then show how attackers are expanding access within Docker & Kubernetes (K8s) environments (e.g. CVEs, insecure daemons). Finally we will demonstrate some unique tools & techniques for persisting access within GCP environments for prolonged periods of time!
Presenters:
-
Bryce Kunz
as Bryce Kunz (@TweekFawkes)
Bryce Kunz (@TweekFawkes) loves researching red team techniques for bleeding edge Cloud services. Currently, the President of Stage 2 Security ( Stage2Sec.com ), previously supported the NSA (network exploitation & vulnerability research), Adobe (built red teaming program for cloud services), and DHS (incident response). Bryce holds numerous certifications (e.g. OSCP, CISSP, ...), has spoken at various security conferences (i.e. BlackHat, DerbyCon, BSidesLV, etc...) and teaches classes at BlackHat (e.g. AWS & Azure Exploitation).
Links:
Similar Presentations: