Lateral Movement & Privilege Escalation in GCP (Q&A)

In this live Q&A session from the DEF CON Safe Mode Main Stage, cloud security researchers Dylan Ayrey and Allison Donovan answer questions following their presentation on Google Cloud Platform (GCP) exploitation techniques. Opening at 00:40, the speakers explore the complexities of GCP IAM inheritance, service account delegation, and resource hierarchy boundaries.

At 06:00 and 12:01, they break down real-world lateral movement and privilege escalation scenarios, explaining how deleted service account zombie permissions and over-permissive IAM bindings can be exploited to pivot across cloud projects.

Concluding at 18:01 and 24:00, the presenters discuss offensive automation tooling—including their open-source GCP exploitation utility G-Scout/G-Split—and provide actionable defensive hardening recommendations for cloud engineers to enforce least-privilege policies across production environments. (AI summary — Gemini Flash)