Restless Guests: From Subscription to Backdoor Intruder

In this eye-opening case study from the DEF CON 33 Cloud Village, a cloud security researcher uncovers an unexpected privilege escalation vector involving external guest accounts in Microsoft Azure. Opening at 00:02, the speaker shares the real-world investigation that inspired the research: discovering how an unprivileged external partner guest user successfully created a new Azure subscription within a client tenant.

At 04:03, the talk dissects Azure Entra ID (formerly Azure AD) identity structures, subscription hierarchies, and default permission scopes. At 14:00, the speaker demonstrates how external guest accounts can exploit loose default tenant settings to enumerate organizational directories, inspect existing service principals, and provision rogue cloud subscriptions that serve as covert persistence backdoors.

At 22:00, the presenter explores the lateral movement and data exfiltration implications of unauthorized subscription creation. The session wraps up at 28:00 with concrete hardening recommendations: reconfiguring Entra ID external collaboration settings to restrict guest permissions, implementing strict subscription creation governance, and deploying Azure Monitor alert rules to flag anomalous tenant registrations. (AI summary — Gemini Flash)