whoAMI - Discovering and Exploiting a Large-Scale AMI Name Confusion Attack

Explore a groundbreaking cloud security vulnerability through this 39-minute conference talk that reveals the whoAMI attack, a technique enabling remote code execution across thousands of AWS accounts simultaneously. Learn how security researcher Seth Art from Datadog uncovered this large-scale AMI name confusion attack by examining a known misconfiguration through an innovative perspective. Discover the research methodology used to identify how thousands of AWS accounts unknowingly employ insecure patterns when retrieving AMI IDs, including vulnerable systems internal to AWS itself. Examine the diverse ways developers inadvertently create security vulnerabilities by omitting the owners attribute in their AMI configurations. Understand the challenges involved in building and refining detection mechanisms for this anti-pattern while minimizing both false positives and false negatives. Gain practical knowledge on identifying and remediation strategies for this misconfiguration in your own AWS environment, including comprehensive defense-in-depth approaches for both prevention and detection. Follow this detailed account of cloud security research that demonstrates the complexity and persistence required in modern cybersecurity investigations.