@TheIceRoot

GCP Consultant @googlecloud | Ex-Unit42 | Cloud Security | @noahmcdonald@infosec.exchange

Joined March 2022
  • Tweets71
  • Following145
  • Followers77
1Media
Noah McDonald retweeted
kat traxler@NightmareJS12 Feb 2024
I was recently pointed to some #fresh GCP documentation from @TheIceRoot For your reading pleasure is a complete list of P4SAs (per-project-per-product) Service Accounts and their default roles 📯 cloud.google.com/iam/docs/se…

Service agents  |  Identity and Access Management (IAM)  |  Google Cloud Documentation

docs.cloud.google.com
1
4
8
1,304
#Google #GCP attack matrix #TrustEverybodyButCutTheCards Courtesy of: Noah McDonald medium.com/google-cloud/goog…
2
7
16
2,460
Noah McDonald retweeted
Clint Gibler
@clintgibler22 Jan 2024
☁️ Google Cloud Incident Response Cheat Sheet * Overview of IR in GCP * Logs for threat hunting and incident response * Log analysis * Service accounts * GCP attack matrix By @TheIceRoot #cybersecurity #infosec medium.com/google-cloud/goog…
9
43
2,889
Noah McDonald retweeted
fwd:cloudsec@fwdcloudsec30 Oct 2023
We've lined up a venue for fwd:cloudsec 2024! Mark your calendars for June 17-18 in Arlington, VA. Ticket sales and CFP will open in early January. For those interested in sponsoring, we'll have a prospectus in the next few weeks. Email [email protected] if interested.
20
2
69
13,379
Ever wonder how attackers breach the cloud? Jay Chen and Noah McDonald will walk through common cloud attack vectors and a real breach incident in this #sectorca presentation, starting at 2:45 in 714AB. buff.ly/3tuDMxt
1
1
120
85% of organizations have hard-coded credentials in VMs, say Jay Chen and Noah MacDonald. Their talk on cloud oversight is ongoing at #sectorca in 714AB. buff.ly/3tuDMxt
1
1
112
We just heard all about how upset gamers compromised the cloud with SIM-Swap, thanks to Jay Chen and Noah McDonald at #sectorca. They're wrapping up now in 714AB. buff.ly/3tuDMxt
1
1
117
If you are at #SecTor today, come check out my talk on real world cloud attacks! #cloud #blackhat blackhat.com/sector/2023/bri…
2
75
Google’s Threat Horizon report, out now! services.google.com/fh/files…
1
6
18
2,593
I am excited to announce that my colleague Jay Chen and I got accepted to @BlackHatEvents SecTor!! blackhat.com/sector/2023/bri…
1
5
962
Noah McDonald retweeted
kat traxler@NightmareJS19 Jul 2023
Unfortunately @orcasec got their terminology wrong in their report by calling the cloud build SA , a ‘Default SA’, then I PERPETUATED it! - apologies. There are only 2 default SAs. The compute and app engine SA. The Cloud Build SA is not a default SA, it is a P4 SA. 1/3
kat traxler@NightmareJS18 Jul 2023
Replying to @NightmareJS
The "bad.build" in question is the Default Cloud Build Service Account (SA), so what is it? It runs build for you, pulls images, injects secrets and "actsas" the SA which any resulting resource (i.e. Cloud Run) ultimately runs as. They are unique per project. 2/8
2
2
12
2,763
Spotify released how they analyze volatile memory in Google Kubernetes Engine. Love the details! #secops #containers #forensics engineering.atspotify.com/20…
5
10
710
We've just released our AWS CloudTrail Cheat sheet, blog post: invictus-ir.medium.com/aws-c… Link to cheat sheet: github.com/invictus-ir/aws-c… In this thread our Top 5 Events from CloudTrail for Incident Response! 🧵

AWS CloudTrail cheat sheet

We have moved this blog to our own website. This allows free access for everyone.

invictus-ir.medium.com
1
29
2
65
6,754
One final @fwdcloudsec appreciation post: It was legitimately the best con I have ever attended. Hands down. Gathering some of the brightest minds in the cloud security community for two days of AMAZING talks. I had never been in person before and now I will never miss it.
5
14
2
73
8,696
Ever wanted to hire someone to hack you? This Google cloud blog walks through how red teams can benefit companies #gcp #mandiant #hacking cloud.google.com/blog/transf…

Get hacked by a pro: Use red teams to expose security shortcomings | Google Cloud Blog

What can you expect from a red team engagement? A Mandiant red team leader explains how the process can make organizations even more secure.

cloud.google.com
2
1
177
Great insight into an #aws ransomware event from @InvictusIR most recent blog invictus-ir.medium.com/ranso…

Ransomware in the cloud

We have moved this blog to our own website. This allows free access for everyone.

invictus-ir.medium.com
1
80
Noah McDonald retweeted
Cado@CadoSecurity13 Apr 2023
📣 Cado Labs researchers recently encountered an emerging Python-based credential harvester and hacktool, named Legion, aimed at exploiting various services for the purpose of email abuse. Full analysis here: cadosecurity.com/legion-an-a… #threatintelligence #threatresearch #cyber

Solve Cloud Forensics at Scale

Darktrace has acquired Cado security, a cyber investigation and response solution provider and leader in cloud data capture and forensics.

darktrace.com
4
7
961
Noah McDonald retweeted
Arkadiy Tetelman@arkadiyt3 Apr 2023
Zoom having an outage due to a misconfigured SCP. Classic👌
14
28
11
183
70,657
Attack path simulation coming to your nearest GCP! And now that SCC is more affordable, everyone should be testing this new feature #gcp #cloudsecurity cloud.google.com/blog/produc…

Why (and how) Google Cloud is adding attack path simulation to Security Command Center | Google...

Google Cloud is adding attack path simulation technology to Security Command Center. Here’s why, and how it can help security teams.

cloud.google.com
73
New cloud security research! We found a method to bypass CloudTrail logging for both read AND write API actions in AWS Service Catalog! In addition, we also reported an issue with a lack of CloudTrail logging in AWS Control Tower. securitylabs.datadoghq.com/a…
3
59
3
138
33,204
Load more