Cloud Security Research and Advocacy @Datadoghq. Previous: Cloud Penetration Testing lead @BishopFox. Also on Mastodon infosec.exchange/@sethsec
Joined June 2010
- Tweets 1,053
- Following 370
- Followers 1,405
- Likes 3,007
30 Photos and videos
Seth Art retweeted
19 Feb 2025
š£ Issue 84 is out. Highlights:
- Amazon Inspector enhances the security engine for container images scanning.
- AWS CloudTrail network activity events for VPC endpoints now generally available.
- whoAMI: A cloud image name confusion attack by Seth Art.
- Uncovering a Hidden CloudTrail Bug by Tracing AWS AssumeRole Chains in a Graph Database by Or Aspir.
- Tool: Cloud Trail Discover cheat sheet.
aws-cloudsec.com/p/issue-84
2
8
436
Seth Art retweeted
13 Feb 2025
whoAMI attacks give hackers code execution on Amazon EC2 instances - @billtoulas
bleepingcomputer.com/news/seā¦
bleepingcomputer.com/news/seā¦
3
67
157
14,366
Seth Art retweeted
12 Feb 2025
whoAMI research by DataDog. I immediately thought about all the user-data scripts that me be attached to those launched EC2 instance images š„¶
Kudos to @sethsec for the discovery, research, and tool!
#aws #cloudsecurity
securitylabs.datadoghq.com/aā¦
1
1
8
397
Seth Art retweeted
12 Feb 2025
The prior name confusion issue: ramimac.me/poisoning-ssm-comā¦
1
5
244
Seth Art retweeted
12 Feb 2025
Excellent research here from @sethsec and crew - including responsible disclosure, AWS hardening enhancement, detection guidance, etc.
š¤ I did report a name confusion in SSM Documents impacting Datadog right before this was found... š
12 Feb 2025
Need to hack thousands of AWS customers? What about on internal AWS systems? Datadog Security Research found that a number of tools, including one published by AWS, are susceptible to name confusion attacks, leading to RCE in vulnerable environments!
securitylabs.datadoghq.com/aā¦
2
1
13
844
My Datadog Security Labs research is finally live! The whoAMI research highlights how a malicious actor could gain remote code execution in thousands of AWS accounts that are vulnerable to this attack.
securitylabs.datadoghq.com/aā¦
1
4
18
802
Seth Art retweeted
29 Oct 2024
Fun with Google Cloud's default service accounts (and how to leverage them for offensive purposes)
securitylabs.datadoghq.com/aā¦
1
21
49
3,483
šIn this article we talk about how I exploited a Fortune 500 Through Hidden Supply Chain Links
Link š
landh.tech/blog/20241028-hidā¦
Thanks to the entire @HashiCorp team ! š¤
Enjoy š„
9
77
301
23,818
Seth Art retweeted
22 Oct 2024
āļø State of Cloud Security
2024 update of @Datadogās report analyzing security posture data from a sample of thousands of orgs across AWS, Azure, and Google Cloud
ā¢ Long-lived credentials continue to be a major risk.
ā¢ Adoption of public access blocks in cloud storage services is rapidly increasing,
ā¢ <1/2 of EC2 instances enforce IMDSv2, but adoption is growing
ā¢ Securing managed Kubernetes clusters requires non-default, cloud-specific tuning
ā¢ Insecure IAM roles for third-party integrations leave AWS accounts at risk of exposure
ā¢ Most cloud incidents are caused by compromised cloud credentials
datadoghq.com/state-of-cloudā¦
1
15
38
3,711
Seth Art retweeted
22 Oct 2024
Mine & @sabi_elezi's #MaLDAPtive presentation from @defcon is now posted on YouTube! LDAP obfuscation, deobfuscation & detection - all built on our 100% custom LDAP parser.
Recording: youtube.com/watch?v=mKRS5Iyyā¦
Tool: github.com/MaLDAPtive/Invokeā¦
@permisosecurity #LDAP #ClippyGotJokes
1
35
94
6,345
Seth Art retweeted
21 Oct 2024
Excited to share some research I've been working on for the past few months, based on real-world data from thousands of environments using AWS, Azure and Google Cloud!
datadoghq.com/state-of-cloudā¦
1
32
78
4,414
Seth Art retweeted
21 Oct 2024
Registration for the 2024 CNY Hackathon is now open!
cnyhackathon-2024-registratiā¦
1
5
5
570
I had such a great time speaking about Cloud Security at @BsidesORL! I saw some great talks, made some new friends, and got to hang with old ones. A huge thank you to all of the volunteers that made this epic event possible!
10
337
This is a killer talk! If you have not seen it yet, make some time to watch Nick explain some really cool initial access techniques he found in a super approachable way!
16 Oct 2024
My talk at DEF CON 32 is now on YouTube! "Kicking in the Door to the Cloud: Exploiting Cloud Provider Vulnerabilities for Initial Access" is a look at vulnerabilities I've found in AWS services that provided initial access to victim environments!
youtube.com/watch?v=oAriLYN-ā¦
1
3
383
Seth Art retweeted
3 Oct 2024
1
7
7
1,036
Seth Art retweeted
4 Oct 2024
Great blog post from @permisosecurity on LLMHijacking attacks against AWS Bedrock. I remember when we first started seeing this behavior from threat actors and I couldn't figure out why they would target Bedrock. Well, I guess we have on answer. š§µ
permiso.io/blog/exploiting-hā¦
2
12
45
6,847
Really looking forward to speaking at BSides Orlando in two weeks!
2
12
1,187