Gone in 60 milliseconds: Offensive security in the serverless age
summary
Demonstrates concrete exploits against AWS Lambda: filename injection via S3 uploads to trigger system calls, loading tools into tmp cache persists ~4m30s to survive ephemeral invocations, harvesting IAM tokens (PassRole) to enumerate privileges, using VPC metadata and VPC tag exfiltration or DNS records to shuttle stolen data out, and abusing Lambda alias backdoor persistence plus CloudFormation/S3 tampering for reinfection. Includes a working toolkit (McKenzie) and real-world proof (the FCC PDF incident) showing these techniques succeed.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:30AWS Lambda
- 2:03Lambda primer
- 4:00Scalability
- 4:57Common patterns
- 7:14Lambdas
- 9:06Learning Objectives
- 10:54Destructive Mechanics
- 13:22Part 2 Exploit
- 15:30AWS Identity Management
- 16:15Lambda Execution Policy
- 17:34Temp
- 20:02Spooky Skull Gifts
- 20:50Part 3 Exfiltration
- 23:08Proof of concept
- 24:14The good news
- 31:49Cleaning up
related talks
48mAlexa, Hack My Server(less) Please
26mExploring Malicious Lambda Layers
30mServerless Infections - Malware Just Found a New Home
46mAttacking AWS: The Full Cyber Kill Chain
30mServerless Security Top 10
33mServerless Security: New Risks Require New Approaches
47mBringing a Machete to the Amazon
26mAWS (mis)configuration from an attacker’s-eye view