HackGDL | Hiding Malware in Docker Images for AWS Hardcore Persistence and Defense Evasion

hackgdl.exe

― ☐ ✕

   __ __         __   ________  __ 
  / // /__ _____/ /__/ ___/ _ \/ / 
 / _  / _ `/ __/  '_/ (_ / // / /__
/_//_/\_,_/\__/_/\_\\___/____/____/

Torta Ahogada track

talk.exe

― ☐ ✕

Hiding Malware in Docker Images for AWS Hardcore Persistence and Defense Evasion

Santiago Abastante
CTO @ SolidarityLabs

Let's build an AWS Backdoor that can evade all detection mechanisms existing so far. Are you up to the challenge?

Our objective is to execute commands against an AWS tenant from a remote location without being detected by AWS mechanisms like GuardDuty and minimizing our fingerprint in CloudTrail API call logs.

To achieve this we are going to explore a technology stack that besides it's availability is not being widely used: Running Docker containers within lambda functions in a full serverless approach.

Santiago_Abastante.jpg

― ☐ ✕