Big Data Lake, Big Data Leak
summary
Finds internet-exposed EMR master interfaces (Zeppelin, Livy, ResourceManager) that accept job submissions and allow remote code execution; uses the ResourceManager REST API to request an app, set the container launch command to print temporary credentials to stderr and grab them from RM logs. Scans across EC2 ranges reveal 900 AWS accounts and accounts with up to 913 S3 buckets; several clusters run get-shell jobs performing DDoS. Reports yield 11 bounty payouts ($250–$17,000); fix by using SSH port forwarding and applying DevSecOps controls to data science clusters.
AI-written summary · about
chapters (4)
related talks
44mCloud Metadata Abuse
56mPivoting in Amazon Clouds
40mBreaking Managed Data Services in the Cloud
36mCloud Hacking Scenarios
33mCloud Hacking Scenarios
47mBringing a Machete to the Amazon
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
40mDevOoops (Increase awareness around DevOps infra security)