SAINTCON 2018 - Bryce Kunz - Blue cloud of Death: Red Teaming Azure

Title: Blue cloud of Death: Red Teaming Azure
Speaker: Bryce Kunz

Conference: SAINTCON 2018
Location: Track 2
Date: 2018-09-25
Time: 01:30pm -- 02:30pm

On-demand IT services are being publicized as the new normal, but often times these services are misunderstood and hence misconfigured by engineers which can frequently enable red teams to gain, expand, and persist access within Azure environments. In this talk we will dive into how Azure services are commonly breached (e.g. discovering insecure blob storage), and then show how attackers are pivoting between the data & control planes (e.g. mounting hard disks, swapping keys, etc...) to expand access. Finally we will demonstrate some unique techniques for persisting access within Azure environments for prolonged periods of time.