DEV-0537 targeting organizations for data exfiltration and destruction

Re:DEV-0537 targeting organizations for data exfiltration an... by cookiengineer on Wednesday March 23, 2022 @01:15AM (#30775207)

While I agree with the sentiment there, lapsus didn't get initial access via social engineering.

They used social engineering to stay ahead of detection.

My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC.

And that is the security responsibility nobody wants to be part of. Neither AWS and neither the organization that rents the machine.

[ Parent | on HN ]

Re:DEV-0537 targeting organizations for data exfiltration an... by bijoo on Wednesday March 23, 2022 @07:22AM (#30777299)

> My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC.

It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services."

Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...

[ Parent | on HN ]

Re:DEV-0537 targeting organizations for data exfiltration an... by sofixa on Wednesday March 23, 2022 @03:48AM (#30776060)

There are VPC flow logs for all things in a VPC.

[ Parent | on HN ]

Re:DEV-0537 targeting organizations for data exfiltration an... by milkshakes on Wednesday March 23, 2022 @07:24AM (#30777310)

this is dangerously incorrect

[ Parent | on HN ]