Cloud Metadata Abuse
summary
Shows that a common misconfiguration—IMDSv1 token optional—allows SSRF (Adminer POC) to retrieve EC2 role keys, log into AWS CLI and steal S3 data within hours; Datadog-style sampling finds 93% of EC2 instances or 95% of organizations with the risky setting, and an attack campaign scans ~2100 IPs scanned across AWS ranges. Demonstrations run an operational relay box hosting the exploit (works against IMDSv1), and then enable IMDSv2 token/PUT and X‑Forwarded‑For checks which block the same flow; detection uses CloudWatch, GuardDuty/Detective and tools like Prowler, metaBadger, ScoutSuite.
AI-written summary · about
chapters (10)
- 0:00Cloud metadata abuse intro
- 5:11Instance metadata service
- 11:53Metadata abuse threats
- 21:56Attack timeline findings
- 26:10Live exploit demo
- 30:47IMDSv2 protections
- 35:29AWS detection methods
- 37:16Remediation strategies
- 40:48IMDSv2 blocks attack
- 41:10Action items
related talks
47mBringing a Machete to the Amazon
38mChanging Perspectives: A Deep Dive into the Security Posture of 600+ Real-World AWS Environments
46mAttacking AWS: The Full Cyber Kill Chain
56mPivoting in Amazon Clouds
40mWeak Links in Cloud IAM - Never Trust. Always Verify!
51mWho Gave the Agent Admin Rights?! Securing Cloud & AI Machine Identities
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
40mBringing a Machete to the Amazon