xBen Benmap Morris - Finding Secrets in Publicly Exposed EBS Volumes
Reveals thousands of publicly exposed AWS EBS snapshots containing plaintext credentials, encryption keys, and production database dumps.
Summary
AWS EBS Snapshot Data Exposure
Ben Morris (security researcher) presents research revealing thousands of publicly exposed Amazon Web Services EBS (Elastic Block Store) snapshots containing sensitive data from production environments.
EBS Snapshot Exposure Mechanism
AWS allows EBS snapshots to be shared publicly for legitimate use cases (distributing AMI base images). Misconfigured AWS accounts accidentally make production volume snapshots public, exposing complete disk images of running EC2 instances.
Automated Discovery at Scale
Morris builds automated tooling that enumerates publicly accessible EBS snapshots by region, mounts them read-only, and scans for sensitive data patterns: passwords, API keys, private keys, database credentials, and PII.
Findings
The research discovers: hundreds of plaintext database dumps with customer PII, thousands of SSH private keys and API credentials for major cloud services, complete source code repositories with embedded secrets, and several Fortune 500 company production configurations — all publicly accessible without any authentication.
Related talks
Main Stage·38 min
Aviad Hahami
Attack vectors exploiting OpenID Connect under-configurations and IdP misconfigurations in CI/CD pipelines to breach cloud environments.
Main Stage·37 min
Yakir Kadkoda · Michael Katchinskiy · Ofek Itach
Six critical attack vectors exploiting implicit and internal shadow resources created by AWS services to achieve cross-tenant and account takeover.
Main Stage·40 min
Eduard Agavriloae · Matei Josephs
Analysis of 3.1 million public Amazon Machine Images uncovering exposed credentials, API keys, and account takeover vectors.