Not Your Typical Pentest – IAM Cloud Insecurity
Update: A co-worker brought up this story which shows exactly how bad things can get by abusing IAM roles. https://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761/ As a penetration tester, I often have to adapt and change according to the technologies that I am testing. However, sometimes the technology I am testing may be new to me and I have to perform research to truly understand the technology so that I can do a thorough job. Too often you will find that your penetration testers can get into a mode of scan and report. They will fire up the vulnerability scanner, identify some stuff for the client to fix, and move on. This often happens because testers can get complacent with what they are seeing in the industry. Then when they land a remote shell on a system, they are repeating what they did last time because, “Hey it worked last time”. What really makes a good penetration tester is one who not only looks at the technology being tested throu