filmov
tv
Attack Vectors for APIs Using AWS API Gateway Lambda Authorizers - Alexandre & Leonardo
Показать описание
Abstract: Serverless applications are a really interesting new trend that promises benefits such as increased scalability and reduced cost. Frameworks like Serverless Application Model (SAM) and Serverless Framework are increasingly used to build them. APIs are a natural part of serverless applications, and in AWS that typically is implemented using the AWS API Gateway backed by Lambdas that implement the actual API endpoint logic. Our research focused on API Gateway Lambda Authorizers. This is a feature that allows developers to use a custom authentication and authorization scheme that uses a bearer token authentication strategy (like JWTs, OAuth or SAML), or that uses request parameters to determine the caller's identity and enforce which API endpoints they are allowed to access. We will present (AFAIK novel) techniques to attack the authentication and authorization of APIs that use Lambda Authorizers. We show how IAM policy injection is possible in theory but highly unlikely in practice due to some good decisions by AWS. We also show a class of problems based on incorrect security assumptions baked into AWS' own documentation and Lambda Authorizer open source code templates. Sample source code will be provided to demonstrate all techniques.
--
Cloud village is an open space to meet folks interested in offensive and defensive aspects of cloud security. The village is home to various activities like talks, workshops, CTFs and discussions targeted around cloud services.
If you are a professional who is looking to gain knowledge on securely maintaining the cloud stack and loves to be around like-minded security folks who share the similar zeal towards the community, Cloud Village is the perfect place for you.
0:38:42
Attack Vectors for APIs Using AWS API Gateway Lambda Authorizers - Alexandre & Leonardo
0:07:00
The top 4 API attack vectors, from FireTail
0:38:42
DEF CON 29 Cloud Village - Alexandre Sieira - Attack Vectors for APIs w AWS API Gateway Lambda Auth
0:24:49
How Do They Get In?! Understanding the API Attack Vector - Michael Isbitski
0:06:21
APIs are quickly becoming the most popular attack vector
0:58:02
How Do They Get In?! Understanding the API Attack Vector
0:05:59
APIs becoming fast-growing threat vectors
0:59:35
The Newest Attack Vectors — Infrastructure as Code & API Security Virtual Briefing
0:08:20
Command Injection - Hacking the OWASP Top 10
0:40:08
API Security - Top Practices to Shield Your APIs from Attack! - OWASP’s Attack Vectors
0:34:46
DEF CON 29 Cloud Village - Mazin Ahmed - Attack Vectors on Terraform Environments
0:31:29
API Security: Analysis of Breaches, Attack Vectors, Strategies - APIDays.HK Digest
0:48:03
Serverless Attack Vectors
0:02:38
Mapping the MITRE ATT&CK Framework to API Security
0:59:35
The Newest Attack Vectors - Infrastructure as Code & API Security
0:34:46
Attacking Modern Environments Series: Attack Vectors on Terraform Environments - Mazin Ahmed
0:39:38
DEF CON 29 Cloud Village - Kavisha Sheth - AWS Cloud Attack Vectors and Security Controls
0:29:16
Damn GraphQL - Defending and Attacking APIs - Dolev Farhi
0:10:34
Attack Vectors - SY0-601 CompTIA Security+ : 1.5
0:31:24
OWASP Standard Classification: API Security Top 10 - A Beginner's Guide to Mitigation - I. Maun...
0:33:28
Introduction to the API Security Landscape
0:32:00
Dirty Stream Attack, Turning Android Share Targets Into Attack Vectors
0:50:07
Reflected File Download - A New Web Attack Vector
0:58:13
API Attack Protection Don’t Overlook Your #1 Attack Vector
Комментарии