GCP Consultant @googlecloud | Ex-Unit42 | Cloud Security | @noahmcdonald@infosec.exchange
Joined March 2022
- Tweets71
- Following145
- Followers77
- Likes133
Noah McDonald retweeted
I was recently pointed to some #fresh GCP documentation from @TheIceRoot
For your reading pleasure is a complete list of P4SAs (per-project-per-product) Service Accounts and their default roles 📯
cloud.google.com/iam/docs/se…
Noah McDonald retweeted
#Google #GCP attack matrix
#TrustEverybodyButCutTheCards
Courtesy of: Noah McDonald medium.com/google-cloud/goog…
Noah McDonald retweeted
☁️ Google Cloud Incident Response Cheat Sheet
* Overview of IR in GCP
* Logs for threat hunting and incident response
* Log analysis
* Service accounts
* GCP attack matrix
By @TheIceRoot
#cybersecurity #infosec
medium.com/google-cloud/goog…
Noah McDonald retweeted
We've lined up a venue for fwd:cloudsec 2024! Mark your calendars for June 17-18 in Arlington, VA. Ticket sales and CFP will open in early January. For those interested in sponsoring, we'll have a prospectus in the next few weeks. Email [email protected] if interested.
Noah McDonald retweeted
Ever wonder how attackers breach the cloud? Jay Chen and Noah McDonald will walk through common cloud attack vectors and a real breach incident in this #sectorca presentation, starting at 2:45 in 714AB. buff.ly/3tuDMxt
Noah McDonald retweeted
85% of organizations have hard-coded credentials in VMs, say Jay Chen and Noah MacDonald. Their talk on cloud oversight is ongoing at #sectorca in 714AB. buff.ly/3tuDMxt
Noah McDonald retweeted
We just heard all about how upset gamers compromised the cloud with SIM-Swap, thanks to Jay Chen and Noah McDonald at #sectorca. They're wrapping up now in 714AB. buff.ly/3tuDMxt
Noah McDonald retweeted
Unfortunately @orcasec got their terminology wrong in their report by calling the cloud build SA , a ‘Default SA’, then I PERPETUATED it! - apologies. There are only 2 default SAs. The compute and app engine SA. The Cloud Build SA is not a default SA, it is a P4 SA. 1/3
The "bad.build" in question is the Default Cloud Build Service Account (SA), so what is it? It runs build for you, pulls images, injects secrets and "actsas" the SA which any resulting resource (i.e. Cloud Run) ultimately runs as. They are unique per project. 2/8
Noah McDonald retweeted
We've just released our AWS CloudTrail Cheat sheet, blog post: invictus-ir.medium.com/aws-c…
Link to cheat sheet: github.com/invictus-ir/aws-c…
In this thread our Top 5 Events from CloudTrail for Incident Response! 🧵
Noah McDonald retweeted
One final @fwdcloudsec appreciation post: It was legitimately the best con I have ever attended. Hands down. Gathering some of the brightest minds in the cloud security community for two days of AMAZING talks. I had never been in person before and now I will never miss it.
Noah McDonald retweeted
📣 Cado Labs researchers recently encountered an emerging Python-based credential harvester and hacktool, named Legion, aimed at exploiting various services for the purpose of email abuse. Full analysis here: cadosecurity.com/legion-an-a…
#threatintelligence #threatresearch #cyber
Noah McDonald retweeted
New cloud security research! We found a method to bypass CloudTrail logging for both read AND write API actions in AWS Service Catalog! In addition, we also reported an issue with a lack of CloudTrail logging in AWS Control Tower. securitylabs.datadoghq.com/a…
Noah McDonald retweeted
☁️ Service Account Key Expiry is now GA
You can now configure an expiration time at the org/folder/project level and all new service account keys created will have that expiration time.
cloud.google.com/resource-ma…
Noah McDonald retweeted
Exfiltrating AWS Credentials via PDF Rendering of Unsanitized Input | by Cristi Vlad | Mar, 2023 | Medium cristivlad.medium.com/exfilt…
Noah McDonald retweeted
We built an automated reverse engineering #CTF around #Ghidra Scripting called "Ghidra Golf" check it out: github.com/ghidragolf
Noah McDonald retweeted
Here @permisosecurity the focus is on detection of #identity and #cloud threat activity. #Detection can be an art form with various methodologies. In this article we describe our approach to detection using AndroxGh0st and GreenBot as an example!
permiso.io/blog/s/approach-t…
Noah McDonald retweeted
🔖 Incident Response in Google Cloud: Forensic Artifacts
This article examines forensic artifacts available in GCP and provides recommendations for triage and prioritization.
blog.sygnia.co/incident-resp…
Noah McDonald retweeted
Compromised Access Keys aren't the only vector for #cloud Attacks. Checkout our (@permisosecurity ) latest article where we detail an ongoing wateringhole attack targeting #AWS management console users via #google ads.
permiso.io/blog/s/watering-h…
