I know it seems like it's been around forever, but the cloud is still very new technology.
And I wanted to just share with you a couple of interesting cloud hacking techniques that you should
be aware of.
First of all, they're the organizations that study this stuff for us, including the big public cloud
vendors, as you might guess, AWB, Microsoft, Google, they provide tons of information for us here
free of charge in the latest cloud hacking techniques.
And one of the things we see is what are called session writing attacks.
This is just like the cross-site request forgery attack that we had spoken of elsewhere.
But the the thing here is, is that it's utilizing the cloud data center redirect.
So instead of just some private data center, these are the cloud based data centers where we are having
the cross-site request forgery taking place.
Contrast this to a side channel style of attack.
A side channel style of attack.
A great example would be where we have a guest VM accessing another guest VM.
We call these cross guest VM breaches and this is obviously bad.
A cloud born attack has nothing to do with Matt Damon.
Bourne Identity reference there.
It's a and I'm recording this right now, by the way, as I sit here in Massachusetts.
So that was very much a joke that was influenced by my surroundings at the moment.
But a cloud born attack is one that references an attack against the bare metal itself.
So they'll inject code where they can start communicating with things as if they are part of the bare
metal which has communications channels, of course, to the resources.
Something else to be aware of is a man in the cloud attack.
Yes, this is much like the man in the middle attack that we know so much about, the man in the cloud
attack.
Oftentimes there is someone that is eavesdropping on maybe a data transformation that we're doing from
an on prem data center to a public cloud.
And they've somehow injected themselves in that communication path.
And now they're a man in the cloud eavesdropping on that data transfer.
Something else to be aware of is cloud hopper attacks.
This is typically implemented with spear phishing and custom malware, and sure enough, our users are
socially engineered in order to giving up access to our cloud resources, a utility that you really
should be aware of in this disregard and that is hacking of clouds is PACU.
In fact, PACU is often considered the metis net metasploit for the cloud.
So just understand that while we did a tremendous emphasis on Metasploit throughout this course at times
pack, you would be getting more and more popularity these days as more and more attacks are cloud based.
So some definite things for us to keep in mind under the area of cloud hacking techniques.
Thanks so much for watching.