No-Slop Research & Human Thoughts on Security

Kat Traxler

http://kattraxler.cloud

Rethinking Your Threat Models for the Cloud

The cloud has scrambled the context defenders are accustomed to leaning on for understanding the attack surface. No longer do attackers move along a linear network-plane, from one asset to another where visibility can be traced at a predictable layer in the network stack. In the cloud, every move an

LastPass Breach: The Pyramid of Pain Perspective

Cybersecurity experts have been quick to respond to the details of the LastPass breach in recent months. Opinion pieces have been published both addressing the critical remediation steps for customers and doling out deserved criticism of incident communication. Absent from the public discourse has been a discussion of the indicators

Abusing the Replicator: Silently Exfiltrating Data with the AWS S3 Replication Service

But how would you distinguish between legitimate backup activity and malicious data exfiltration on AWS S3? In this blog post, I walkthrough a malicious use of the S3 Replication service and how selective data event logging on the S3 service will result in a gap in S3 exfiltration visibility since

Log4J’s Unique Impact In The Cloud

How to exploit the Log4J software vulnerability in cloud-hosted VMs for maximum impact Want to understand how the Log4J vulnerability uniquely impacts cloud environments? Read my blog hosted in the Vectra AI Research site for details on how the Log4J vulnerability is exploited and why responders need to take addition

GCP AI Notebooks Vulnerability - Remediation

This is an update to my previous blog post which documented a mechanism for GCP Org Policy Bypass using custom metadata on compute instances. The Original Issue Google makes use of the custom metadata in compute instances to authorize access to AI Notebooks and their web UIs. Individuals granted access

Bypassing GCP Org Policy with Custom Metadata

TLDR; Google makes use of custom metadata to authorize access to AI Notebooks and their web UIs. Individuals granted access via custom metadata need not have any IAM permissions on the compute instance, on the service account running the Notebook or even be a member of the Organization. Authorization via

GCP .actAs d-day > How not to remediate

On January 27, 2021 a major, potentially breaking change is coming to GCP. If you're using the default service account as the backing identity for several of GCP's data science PaaS services, the end user will be required to have the .actAs permission on the default

GCP Roles and Permissions 101

In GCP, access to resources is ultimately governed by Cloud IAM Permissions however, individual permissions are not directly assigned to principals. Instead, permissions are grouped together to create roles. These roles, rather than individual permissions, are then granted to principals in an IAM Policy. Roles can range from containing just

GCP Users and Group 101

Users and Groups are two types of principals that can be granted access in GCP. When users and groups are members in IAM Policies, they are referenced by their Google email addresses. You won't find a directory in Google Cloud listing users or groups. Instead, users and groups

GCP Service Account 101

Service Accounts are identities used for authenticating infrastructure and resources, typically for non-human entities. Service Accounts do not utilize passwords. While you have the option to generate and export a private key for a service account, it's generally unnecessary and can pose a security risk in most cases.