Learning Serverless Security. Hacking and Securing Serverless Cloud Applications on AWS, Azure, and Google Cloud Joshua Arvin Lat

Dostępność produktu

Produkt nie został jeszcze oceniony pod kątem ułatwień dostępu lub nie podano żadnych informacji o ułatwieniach dostępu lub są one niewystarczające. Prawdopodobnie Wydawca/Dostawca jeszcze nie umożliwił dokonania walidacji produktu lub nie przekazał odpowiednich informacji na temat jego dostępności.

Spis treści książki

• Preface
  • Who Should Read This Book
  • Why I Wrote This Book
  • Navigating This Book
  • Conventions Used in This Book
  • Using Code Examples
  • OReilly Online Learning
  • How to Contact Us
  • Acknowledgments
• 1. Introduction to Serverless Computing
  • Demystifying Serverless Computing
    • Embracing Serverless
    • Exploring Definitions and Serverless Use Cases
  • Debunking Common Myths and Misconceptions
    • Myth 1: Serverless Means That No Servers Are Involved
    • Myth 2: Serverless Is Equivalent to FaaS
    • Myth 3: Serverless Is Offered Only by Cloud Providers
    • Myth 4: Serverless Is Suitable for Only Simple, Small-Scale Applications
    • Myth 5: Serverless Computing and Containerization Dont Work Well Together
    • Myth 6: Serverless Applications Support Only a Limited Number of Languages
    • Myth 7: Serverless Eliminates All Management and Operational Tasks
    • Myth 8: Serverless Platforms and Services Are Interchangeable, with No Differences
    • Myth 9: Serverless Applications Are Immune to Security Attacks
  • Summary
• 2. Understanding Serverless Architectures and Implementation Patterns
  • Cloud Services and Capabilities That Enable the Serverless Operational Model
    • Serverless Services, Features, and Capabilities on AWS
    • Serverless Services, Features, and Capabilities on Azure
    • Serverless Services, Features, and Capabilities on Google Cloud
  • Common Building Blocks, Patterns, and Solutions for Serverless Architectures
    • Serverless Web Applications and APIs
    • Queue-Based Load Leveling Pattern
    • Gatekeeper Pattern
    • Fan-Out Pattern
    • Valet Key Pattern
    • Event-Driven Serverless Containers
    • Event-Driven File Processing
    • Functionless Integration Pattern
    • Federated Identity Pattern
    • Centralized Logging and Monitoring
  • Summary
• 3. Diving Deeper into Serverless Security Threats and Risks
  • Publicly Accessible Functions
  • Misconfigured Cloud Storage Resources
  • Leaked Credentials
  • Insecure Storage of Credentials and Secret Keys
  • Injection Attacks
  • Over-Privileged Permissions and Roles
  • Business Logic Vulnerabilities
  • Insecure Network Configuration
  • Insufficient Tracing, Logging, Monitoring, and Alerting
  • Serverless Security Mechanism Limitations
  • Compromised CI/CD Pipelines
  • Broken Authentication
  • Vulnerable Application Dependencies
  • Denial of Service and Denial of Wallet
  • Cross-Site Scripting
  • API Gateway Security Misconfigurations
  • Supply Chain Attacks
  • Summary
• 4. Exploiting and Securing Exposed AWS IAM Credentials
  • Reviewing Technical Prerequisites
  • Understanding How AWS IAM Works
  • Setting Up the Vulnerable-by-Design Serverless Lab Environment
    • Creating an IAM User with the AdministratorAccess Policy Attached
    • Creating Trails in CloudTrail to Capture API Calls Made in the Account
    • Configuring Bedrock Model Invocation Logging
    • Completing the Vulnerable Serverless AI-Powered Application
  • Gaining Access via Exposed Credentials from Client-Side Code
  • Disabling CloudTrail Logging to Evade Detection
  • Creating a Backdoor IAM User with Administrator Privileges
  • Simulating Unauthorized Bedrock Model Invocation from the Attacker Account
  • Auditing the CloudTrail Logs and the Bedrock Model Invocation Logs
  • Summary
• 5. Exploiting and Securing Misconfigured AWS IAM Roles
  • Reviewing Technical Prerequisites
  • Abusing AssumeRole for Privilege Escalation
    • Setting Up an Overly Permissive IAM Role
    • Setting Up IAM Groups and Users
    • Deploying a Lambda Function with an Overly Permissive IAM Role
    • Leveraging AssumeRole to Escalate Privileges
    • Establishing Persistence with New IAM User Credentials
  • Escalating Privileges and Establishing Persistence Through an AWS Lambda Function with a Misconfigured IAM Role
    • Mitigating the AssumeRole Privilege Escalation Vulnerability
    • Reconfiguring the AWS CLI and Verifying That AssumeRole Can No Longer Be Used to Escalate Privileges
    • Abusing a Functions Overly Permissive Execution Role to Escalate Privileges
    • Establishing Persistence with New IAM User Credentials
    • Establishing Persistence via a Backdoored Lambda Version
  • Summary
• 6. Hacking Publicly Accessible AWS Lambda Functions
  • Reviewing Technical Prerequisites
  • Preparing and Deploying a Vulnerable Serverless Web Application
    • Setting Up a Vulnerable AWS Lambda Function
    • Configuring an S3 Bucket for Static Website Hosting
  • Testing for Common S3 Bucket Misconfigurations
  • Using Code Injection Attacks to Execute Arbitrary Code in Lambda Functions
  • Exfiltrating Sensitive Data via Code Injection and Outbound Network Access
    • Updating the Lambda Function with Limited Code Injection Safeguards
    • Setting Up the Server That Receives Exfiltrated Data
    • Attacking the Vulnerable Serverless Web Application
  • Stealing Secrets Manager Secrets Through a Vulnerable Lambda Function
    • Storing Secrets in AWS Secrets Manager
    • Updating the Lambda Function Role Permissions for Accessing Secrets Manager
    • Updating the Lambda Function Code to Retrieve Secrets from Secrets Manager
    • Stealing Secrets Manager Secrets Through a Code Injection Attack
  • Summary
• 7. Running and Securing Serverless Functions in a VPC
  • Reviewing Technical Prerequisites
  • Updating the Lambda Function Execution Role with the Required VPC Permissions
  • Setting Up and Configuring a VPC with Restricted Outbound Access
  • Attaching the Lambda Function to the VPC with Restricted Outbound Access
  • Setting Up an API Gateway REST API That Routes Requests to the Lambda Function
  • Updating the S3-Hosted Website to Use the API Gateway Endpoint URL
  • Verifying That Code Injection Attacks Attempting Outbound Access No Longer Work
  • Writing Secure Lambda Function Code to Defend Against Code Injection Attacks
  • Summary
• 8. Hacking and Securing Google Cloud Storage Buckets
  • Reviewing Technical Prerequisites
  • Exploring Cloud Storage Bucket Security Misconfigurations
    • Setting Up a Vulnerable-by-Design Cloud Storage Bucket
    • Exploiting the Misconfigured Cloud Storage Bucket
    • Securing the Misconfigured Bucket
  • Simulating a Dangling Bucket Takeover
    • Setting Up the Dangling Bucket
    • Executing the Bucket Takeover
  • Enforcing Secure Bucket Configuration with Infrastructure as Code
    • Provisioning a Cloud Storage Bucket with IaC
    • Detecting and Remediating Configuration Drift
  • Auditing IaC Configurations with Checkov
  • Summary
• 9. Abusing Google Cloud Storage Event Triggers with Malicious File Uploads
  • Reviewing Technical Prerequisites
  • Preparing the Vulnerable-by-Design Google Cloud Lab Environment
    • Setting Up the Google Cloud Project
    • Creating a Parameter Manager Parameter
    • Setting Up the Cloud Storage Buckets
    • Deploying a Vulnerable Cloud Run Service
    • Completing the Vulnerable Event-Driven File Upload Service
    • Validating End-to-End Event-Driven Processing
  • Exploiting a Cloud Run Service Through a Malicious File Upload
    • Setting Up a Reverse Shell Listener
    • Triggering a Reverse Shell with a Malicious File Upload
    • Exploring and Inspecting the Project Resources
  • Summary
• 10. Setting Up Backdoors and Escalating Privileges in Google Cloud
  • Reviewing Technical Prerequisites
  • Setting a Lower Cloud Run Service Timeout
  • Generating a Service Account Key Associated with the Compromised Cloud Run Service
  • Configuring a Backdoor Service Account
  • Further Reducing the Cloud Run Timeout and Restricting the Service Account Permissions
  • Exploiting a Cloud Run Service Without a Reverse Shell
    • Setting Up a Local Server and a Tunnel That Receives Exfiltrated Data
    • Exfiltrating Environment Variables from a Cloud Run Service
    • Exfiltrating the Source Code from a Cloud Run Service
    • Exfiltrating Service Account Credentials from a Cloud Run Service
  • Escalating Privileges Through a Cloud Run Function
  • Escalating Privileges Through a Compute Engine VM Instance
  • Summary
• 11. Hacking and Securing Azure Functions
  • Reviewing Technical Prerequisites
  • Setting Up and Deploying a Vulnerable-by-Design Serverless Function
  • Exploiting the Vulnerable Serverless Function
  • Storing Secrets in Azure Key Vault
  • Abusing an Overly Permissive Managed Identity to Exfiltrate Key Vault Secrets
  • Summary
• 12. Escalating Privileges in Microsoft Azure
  • Reviewing Technical Prerequisites
  • Updating the Function App Permissions
  • Escalating Privileges Through an Overly Permissive Managed Identity
  • Applying Least Privilege to the Function App Managed Identity
  • Summary
• 13. Analyzing, Auditing, and Securing Serverless Application Code
  • Reviewing Technical Prerequisites
  • Using Semgrep to Detect Security Issues in Serverless Application Code
  • Securing Serverless Application Code from Code Injection
  • Developing a Custom Script That Detects Malicious Dependencies
  • Using OSV-Scanner to Detect Vulnerable Packages
  • Summary
• Index

pokaż cały spis treści

ukryj recenzje