From ‘huh ’ to privilege escalation finding vulnerabilities from a bug in the AWS... - Ben Bridts

Abstract: Security research is not something that’s only done by dedicated teams and companies. Sometimes it will be a developer or platform engineer that makes the jump from “that’s not how I expect it to work” to “that’s not how it’s supposed to work”.

In this talk we’ll walk through the process we took when we found strange behaviour in the AWS console, tried to debug what’s going wrong and ended up finding an API that didn’t check iam:PassRole correctly. …

aws ben bug companies developer engineer escalation expect platform privilege privilege escalation research security security research teams vulnerabilities work