No-Slop Research & Human Thoughts on Security

Kat Traxler

http://kattraxler.cloud

GCP IAM 201 - Service Agents | What Can Go Wrong

This post aims to answer the question, 'What can go wrong when using Google Cloud services that leverage Service Agents/P4SAs?' For an introduction to Service Agents, see GCP IAM 201 - Service Agents. Below, you'll find an overview of possible threats to Google Cloud customers due

GCP IAM 201 - Service Agents

Service Agents are nothing more than a type of a Service Account. Also known as a P4SA (Per-Project, Per-Product; Service Account), a Service Agent is typically created automatically whenever its associated Google API is enabled in a Project. Service Agent and Service Account Comparison Customer-managed SAs Google-

How I Prep for Talks – and You Can Too!

Recently, a friend admitted to me they were resorting to a 'Hail Mary' approach for their upcoming talk, scribbling notes on notecards like a nervous high school student. "But no! That's actually a pro move," I assured them, not just a desperate scramble to

GCP IAM 101 Series

The GCP IAM 101 series is intended to give a brief, succinct overview of essential Google Cloud authorization concepts, answering questions like 'How does Alice gain access to the Bucket?' These pages are the TLDR; for Google Cloud IAM, supplemented with links to official, more verbose Google documentation

Attacks as a Service with The DeRF

Leverage The DeRF for attacker simulations, validating security controls or enhancing cloud detection capabilities. DeRF (Detection Replay Framework) is an "Attacks As A Service" framework, allowing the emulation of offensive techniques and generation of repeatable detection samples in the cloud. Built on Google Workflows The DeRF is open-

Rethinking Your Threat Models for the Cloud

The cloud has scrambled the context defenders are accustomed to leaning on for understanding the attack surface. No longer do attackers move along a linear network-plane, from one asset to another where visibility can be traced at a predictable layer in the network stack. In the cloud, every move

LastPass Breach: The Pyramid of Pain Perspective

Cybersecurity experts have been quick to respond to the details of the LastPass breach in recent months. Opinion pieces have been published both addressing the critical remediation steps for customers and doling out deserved criticism of incident communication. Absent from the public discourse has been a discussion of the indicators

Abusing the Replicator: Silently Exfiltrating Data with the AWS S3 Replication Service

But how would you distinguish between legitimate backup activity and malicious data exfiltration on AWS S3? In this blog post, I walkthrough a malicious use of the S3 Replication service and how selective data event logging on the S3 service will result in a gap in S3 exfiltration visibility since

Log4J’s Unique Impact In The Cloud

How to exploit the Log4J software vulnerability in cloud-hosted VMs for maximum impact Want to understand how the Log4J vulnerability uniquely impacts cloud environments? Read my blog hosted in the Vectra AI Research site for details on how the Log4J vulnerability is exploited and why responders need to take

GCP AI Notebooks Vulnerability - Remediation

This is an update to my previous blog post which documented a mechanism for GCP Org Policy Bypass using custom metadata on compute instances. The Original Issue Google makes use of the custom metadata in compute instances to authorize access to AI Notebooks and their web UIs. Individuals granted access