Breaking Managed Data Services in the Cloud
summary
Research finds two concrete cross-tenant takeovers: a full AWS Glue compromise (Super Glue) and an Azure Synapse takeover, plus an Azure Automation bug that leaks tokens via port 40008 to thousands of tenants (including ~50 S&P 500 companies). Method: get RCE on a provider-managed runtime, privilege escalate (sudo env / Python path, service binaries), enumerate internal JARs/APIs, create jobs pointing at attacker S3 payloads to get shells, dump memory for plaintext creds, and automate token harvesting — all of which work end-to-end.
AI-written summary · about
chapters (7)
- 0:00Introduction and context
- 1:28Cloud security principles
- 9:47AWS Glue vulnerability
- 22:32Azure Synapse exploitation
- 31:20Azure automation flaw
- 35:39Research takeaways
- 37:28Q&A session
related talks
48mTackling the Recent Rise of Cross-Tenant Vulnerabilities
36mCloud Hacking Scenarios
50mInsights into New Supply Chain and Cloud-Identity Attacks
33mCloud Hacking Scenarios
43mHacking the Cloud: Play-by-Play Attack on GitHub, Okta, and Salesforce
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
41mCloud-Wide Contamination: Chaining SSRFs for Tenant Compromise in Azure (CVE-2025-29972)
16mLessons from the SOC: Analyzing and remediating cloud attack paths