Hacking the Cloud: Play-by-Play Attack on GitHub, Okta, and Salesforce
summary
Scan finds an exposed GitHub token that authenticates to Okta and resolves to an Okta SUPER_ADMIN account, so an attacker creates a backdoor user, assigns apps under another user’s email to impersonate them, then leverages misconfigured Salesforce profiles and permission sets to enable account export and steal records including credit card CVVs. The attacker flips S3 bucket policies to make a public S3 bucket, exports an RDS snapshot into S3 and disables keys to download full databases. Detect via alerts for API-created users with elevated roles, unusual app impersonation and rapid excessive object access combined with exposure scans.
AI-written summary · about
chapters (8)
- 0:00Introduction and overview
- 2:11Reconnaissance and exposed tokens
- 8:30Establishing persistence in Okta
- 15:03Accessing and exfiltrating data
- 27:42Database and S3 bucket compromise
- 31:13Detecting and analyzing attacks
- 41:03Mitigation and next steps
- 42:28Q&A and closing
related talks
36mCloud Hacking Scenarios
33mCloud Hacking Scenarios
31mCloud Hacking Scenarios
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had
40mBreaking Managed Data Services in the Cloud
33mGaining initial access by exploiting leaked credentials
47mThe Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!