Uncovering Azure's Silent Threats: A Journey Into Cloud Vulnerabilities
summary
Researcher finds five vulnerabilities in Azure Machine Learning across three issue classes (CVE-2023-23312, CVE-2023-28312), demonstrates cleartext storage account keys and compute instance JWTs logged in nginx/access and agent logs, shows an unauthenticated DSi Mount agent API on port 46802 that returns systemd logs and can expose sudo commands, and extracts storage keys and managed-identity tokens from exfiltrated certs + env files (tcpdump, nmap, IDA, GDB, AML dumper used). Some fixes are deployed; identity/token persistence remains and rotating keys alone does not remove abuse.
AI-written summary · about
chapters (8)
- 0:00Speaker Introduction
- 2:35CH 0: Introduction of the Talk
- 8:58CH 1: Did you see my keys?
- 13:16CH 2: Wait, is this my token?
- 24:07CH 3: Spying the scientist
- 30:55CH 4: Can you really see me?
- 42:38Recap
- 44:52Observations and Takeaways
related talks
41mUncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities
57mCloud’s Dirty Little Secret: It Was Misconfigs All Along
55mAzure Attacks Unpacked: Real-World Threats & Lessons
45mKeeping Your AI/ML Data Secure
50mSecuring Native Cloud Application Perimeter
49mAzure DevOps security - Lessons learned
48mLateral Movement in the Age of Hybrid Cloud
43mThe Cloud Gray Zone: Vulnerabilities Found in Azure Built-in VM Agents