Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Highlights from the Unit 42 Cloud Threat Report, 2H 2020

Summary: In the 2H 2020 Unit 42 Cloud Threat Report, Palo Alto Networks researchers used Red Team exercises to exploit a misconfigured IAM role trust policy called AssumeRole, gaining temporary access to sensitive resources from an anonymous AWS account and ultimately obtaining admin access to a customer's entire AWS cloud environment. The same exercise moved laterally through a misconfigured flow-log IAM role, escalated from a restricted developer account to persistence by hijacking an administrator account, and the report also found 75% of JAPAC and 74% of EMEA organizations run Google Cloud workloads with admin privileges versus 54% in the Americas, with cryptojacking affecting at least 23% of organizations globally.

Why it matters: An overly permissive AssumeRole trust policy let an anonymous AWS account walk into a customer's entire cloud environment - a potentially multi-million dollar breach - and the only trace was a CloudTrail event most organizations may never review.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Data Breaches
Related