Cloud Computing · Topic 2 of 2
Cloud Threats, Hacking and Security
Learn the main cloud threats, how attackers abuse misconfiguration, IAM and metadata services, and the cloud security controls and tools that stop them.
- 5 min
- Misconfiguration and weak IAM are among the most common cloud problems.
- Wrapping, malware injection, VM escape and side channel are named cloud attacks.
- Use least privilege and multi-factor authentication for every identity.
What it is
Cloud threats are the risks specific to rented, shared and internet facing infrastructure. Cloud hacking is the set of techniques attackers use to get in, move around and take data. Cloud security is the set of controls and tools that prevent, detect and fix those problems.
The exam asks you to recognize a threat from a description, identify the attack path, and choose the right control or tool.
How it works
Cloud computing threats
| Threat | Description |
|---|---|
| Misconfiguration | Public storage buckets, open security groups, default settings. A leading cause of cloud breaches. |
| Weak identity and access management | Over broad permissions, no multi-factor authentication, shared or long lived access keys |
| Insecure interfaces and APIs | Weak authentication or missing input checks on the cloud management and application APIs |
| Account hijacking | Stolen credentials, phishing or leaked keys give control of the account |
| Data breach and loss | Unencrypted or exposed data, or no backup |
| Insider threat | A user abuses valid access |
| Denial of service | Exhausts resources, or raises cost |
| Cryptojacking | Attackers run mining software on victim compute |
| Shadow IT | Unapproved cloud services used without security review |
| Vendor lock in and supply chain | Dependence on provider and third party components |
| Multi-tenancy risks | Side channel attacks between tenants on shared hardware |
Specific attacks to know by name:
- Cloud malware injection: a malicious service or virtual machine is added to the cloud and presented as a legitimate instance.
- Wrapping attack (XML signature wrapping): an attacker moves or duplicates parts of a signed message so a modified request passes the signature check.
- Hypervisor attack (VM escape): a guest virtual machine breaks out to attack the hypervisor and neighboring tenants.
- Side channel attack: a virtual machine on the same host infers secrets from shared hardware behavior.
- Metadata service abuse: a server side request forgery (SSRF) flaw lets an attacker reach the instance metadata endpoint at 169.254.169.254, where temporary credentials can be read.
Cloud hacking
Attackers usually follow a chain, and testers use the same chain with permission.
- Reconnaissance: find the organization's cloud footprint with public records, DNS names, and storage names that follow a pattern. Open storage can be discovered by guessing names.
- Initial access: use leaked keys in public code repositories, phished credentials, an exposed service, or an SSRF flaw.
- Enumeration: list what the identity can see and do.
- Privilege escalation: abuse over broad roles or policies that allow a user to create or change their own permissions.
- Persistence and impact: create new access keys or users, then exfiltrate data, or deploy mining software.
Tools used by testers and auditors:
| Tool | Purpose |
|---|---|
| Pacu | An AWS exploitation framework for testing what a set of credentials can do |
| ScoutSuite | Multi cloud security auditing tool |
| Prowler | AWS and multi cloud security best practice checks |
| CloudGoat | An intentionally vulnerable AWS environment for practice |
| CloudSploit | Detects misconfiguration in cloud accounts |
| Trivy and kube-hunter | Scan container images and Kubernetes clusters |
Cloud security
| Control | What it does |
|---|---|
| Identity and access management | Least privilege roles, multi-factor authentication, short lived credentials, no shared accounts |
| Encryption | Encrypt data at rest and in transit, and manage keys in a key management service |
| Network controls | Security groups and firewalls closed by default, private subnets, private endpoints |
| Logging and monitoring | Audit trail of API calls (such as AWS CloudTrail) and alerts on unusual activity |
| Configuration management | Cloud security posture management (CSPM) to detect drift and misconfiguration |
| CASB | A cloud access security broker enforces policy between users and cloud services, and finds shadow IT |
| Secrets management | Keep keys out of code and repositories |
| Patch and image hygiene | Update guest systems, scan images |
| Backup and recovery | Tested, separated backups |
| Zero Trust | Verify every request, with no trust from network location |
Frameworks and standards that guide cloud security include the Cloud Security Alliance Cloud Controls Matrix, ISO/IEC 27017 and FedRAMP for US government cloud services.
A worked example
A security audit finds a storage bucket holding customer exports that is readable by anyone. A search of a public code repository also shows an access key committed by a developer.
The bucket is a misconfiguration, and the key is a leaked credential. Both give an outsider direct access. The response is to make the bucket private, revoke and rotate the key, review the audit log for use, and add a secrets scanner and a posture management tool so it does not recur.
How the exam asks about this
- "Which address is used by cloud instances to reach the metadata service?" → 169.254.169.254.
- "Which tool is an AWS exploitation framework used to test credentials?" → Pacu.
- "Which control enforces policy between users and cloud services and finds shadow IT?" → A CASB.
What to remember for the exam
- Misconfiguration and weak IAM are among the most common cloud problems.
- Wrapping, malware injection, VM escape and side channel are named cloud attacks.
- Use least privilege and multi-factor authentication for every identity.
- Cloud audit logs record API activity, and should be enabled and protected.
- CSPM finds misconfiguration, and a CASB governs use of cloud services.
A leaked access key is as bad as a leaked password. Deleting it from the repository is not enough, because it must be revoked and rotated.
Common mistakes
Blaming the provider for customer errors. Under shared responsibility, open buckets and weak roles belong to the customer.
Using long lived keys for everything. Short lived, role based credentials limit the damage.
Forgetting logging. Without an audit trail you cannot tell what an intruder did.
Check yourself
What is the first thing to do after a cloud access key leaks?
Revoke and rotate it, then review the audit logs for misuse.
What does a wrapping attack target?
The XML signature check in a signed cloud request, by moving parts of the message.
What does CSPM do?
It continuously checks cloud configuration for misconfiguration and drift from policy.
Topic 2 of 2 in Cloud Computing
Test yourself on Cloud Computing
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.