Attack Paths Into VMs in the Cloud
Unit 42 maps attack paths into AWS, Azure, and GCP VMs through intended features like startup scripts and SSH key pushes.
Palo Alto Unit 42 reviewed attack vectors against virtual machine services on AWS, Azure, and GCP, finding that 11% of internet-exposed cloud hosts carry Critical or High severity vulnerabilities. The attack paths rely on legitimate features such as EC2 User Data, VM custom data, EC2 Instance Connect, SSM Run Command, and serial consoles rather than vulnerabilities, and exploiting them requires attackers to first obtain control plane permissions. A compromised VM exposes not only its data but the workload identity and cloud permissions assigned to it, making identity compromise potentially more damaging than data theft. The firm places mitigation responsibility on cloud users and administrators.
- 11% of internet-exposed cloud VMs contain Critical or High severity vulnerabilities
- Attack paths use legitimate features: startup scripts, SSH key push, run commands, serial consoles
- Compromised VMs expose assigned cloud permissions and workload identities, not just data
- Mitigation responsibility falls on cloud users and administrators
From the original article
13 min read at unit42.paloaltonetworks.com
This post reviews strategies for identifying and mitigating potential attack vectors against virtual machine (VM) services in the cloud. Organizations can use this information to understand the potential risks associated with their VM services and strengthen their defense mechanisms.
By Jay Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.