Post

#OIDC identity providers in #AWS have been getting more attention lately and rightfully so: It’s unfortunately surprisingly easy (and common) to create misconfiguration within the necessary conditions on OIDC-based #IAM roles trust policy.

offensai.comRogueOIDC: AWS Persistence and Evasion through attacker-controlled OIDC Identity ProviderThis research shows what an attacker can achieve after creating a malicious OIDC identity provider in AWS and how they can do it. The article presents novel techniques and tools for persistence and ev...

Tal Skverer

@taltechtreks.com

This researcher found a clever persistence trick: create a rogue #OIDC provider mimicking an existing one, then silently tweak the conditions. Easy to miss, but it lets an attacker retain access to a compromised account. How many orgs actually audit their OIDC roles? Feels like a blind spot.

20/2/25, 8:16 pm0 reposts0 likes

No replies yet.