Azure’s Terrible Security Posture Comes Home to Roost
lastweekinaws.com
lastweekinaws.com
It's a good thing these guys were late to the cloud. I shutter how lousy my life would be as a sysadmin if I was forced on-prem because of how untrustworthy the reputation of cloud computing would have been.
AWS has actually (at very large scale) seemed to avoid tenant to control plane escapes. That HAS to be a result of some type of in depth defense?
The other thought - I wonder how much access even their own engineers have? If their engineers don't have easy customer data access it may make it a bit harder to chain over to other accounts. A lot of control plane stuff you realize is there so internal staff can jump around easily.
I'd also look at the re:invent channel, lots of time there is info in there that isn't necessarily publicly documented: https://www.youtube.com/c/amazonwebservices/search?query=sec...
https://aws.amazon.com/security/security-bulletins/AWS-2021-...
This is that kind of example, even with a total possible failure here, even AWS support staff still couldn't actually do anything.
The transparency is very high on AWS. All S3 access is logged, the policies for the support role are public (does Azure provide this) and all changes to polices are logged.
Recent and worth a watch.
Worst I can recall was kind of this: "Hello from the Other Side: SSH over Robust Cache Covert Channels in the Cloud" https://gruss.cc/files/hello.pdf
"Black Hat Asia 2017: Hello From the Other Side" "Live-streaming a music video over the cache between two Amazon EC2 instances." https://youtu.be/yPZmiRi_c-o
https://news.ycombinator.com/item?id=13995374
Azure though ...is just a joke on the Cloud gods.