Open Source Tool Release: Gaining Novel AWS Access With EBS Direct APIs
Summary: Unit 42 describes how AWS's EBS direct APIs, announced in December 2019, give block-level access to snapshot data that previously required launching an EC2 instance and converting a snapshot to a volume. In Crypsis testing, comparing two snapshots of a modified Ubuntu 20.04 image surfaced hard-coded secrets within nine seconds, with the scan reaching 34MB at most.
Why it matters: An IAM user holding ebs:GetSnapshotBlock can pull snapshot data straight to a local system without launching an instance in the targeted account, so a single compromised credential reaches backup data that was previously gated behind instance-level access.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026