Conference:  Defcon 31

Authors: nyxgeek hacker at TrustedSec

2023-08-01

Microsoft Azure is ripe with user information disclosures. We are going to look at weaponizing these disclosures by performing data collection at a large scale against OneDrive, Teams, and Graph. OneDrive and Teams present silent enumeration methods, requiring no logon attempts and creating no logs. This enables enumeration at a massive scale against the biggest corporations, educational instututes, and government entities in the world. Over the last 1.5 years I have enumerated over 20m users. We will explore the techniques used and the data that was collected, including Azure adoption rates and analysis of username formats. Microsoft Teams suffers from information dislcosure due to default settings allowing users to see the online presence of others. An undocumented, unauthenticated Microsoft Teams Presence lookup trick will be shared, which enables easy unauthenticated enumeration of the online Teams Presence of users at many organizations. To demonstrate this we will monitor approximately 100,000 Microsoft employees' online presence and any out-of-office messages that are stored. Finally, Azure supports Guest users, allowing two companies to collaborate on a project. I will unveil a method of identifying Azure Guest users at other tenants. In this way, hidden corporate relationships can be revealed.

Conference:  KubeCon + CloudNativeCon North America 2022

Authors: Kapil Thangavelu, Sonny Shi, Jorge Castro, John Anderson

2022-10-28

Cloud Custodian (c7n) is an easy to use declarative policy engine for solving governance as code use cases for Kubernetes, Azure, GCP, AWS, and Terraform. Simplify rule sets around your entire stack from the cloud to Kubernetes and everything in between. In this talk the maintainers will cover use cases for using Custodian, cluster policy best practices, event driven enforcement of policies, and everything you need to get started running a well managed cloud and cluster.