Think like a HACKER
summary
Live demo shows a chain: get code execution on an EC2, query 169.254.169.254 metadata to read the instance role, use replace-iam-instance-profile-association (EC2 API) to swap the role to one with S3 access, then run aws s3 sync to copy an entire bucket off‑account — all via AWS CLI and curl, with data moving S3→S3 on the provider backplane so network IDS often sees nothing. Automation finds misconfigs in minutes (≈7 min), mirroring the DOJ Capital One description.
AI-written summary · about
chapters (19)
- 0:00Cloud misconfiguration risks
- 1:55What is cloud misconfiguration
- 4:22Hackers automate cloud exploits
- 7:31Why traditional security fails
- 10:06Hackers target cloud assets
- 12:33Pre-cloud vs cloud security
- 15:21Cloud security as engineering
- 15:43Live hack demo setup
- 17:50Exploiting vulnerable EC2
- 20:20Metadata service discovery
- 22:33IAM roles and permissions
- 26:56Changing IAM roles
- 30:49Capital One breach replay
- 34:05Stealing S3 data
- 36:31Why S3 breaches go undetected
- 38:16Recap of misconfiguration attack
- 39:20Steps to secure cloud
- 40:49Automated remediation
- 41:53Closing and resources
related talks
46mAttacking AWS: The Full Cyber Kill Chain
47mBringing a Machete to the Amazon
56mPivoting in Amazon Clouds
26mAWS (mis)configuration from an attacker’s-eye view
40mBringing a Machete to the Amazon
44mCloud Metadata Abuse
46mHardening AWS Environments and Automating Incident Response for AWS Compromises
36mCloud Hacking Scenarios