Karim El-Melhaoui

Karim El-Melhaoui

@karimscloud.bsky.social

Principal Security Architect & Partner at http://o3c.no, CloudSec Researcher, Microsoft Security MVP, CSA Norway Board Member

208 followers69 following38 posts

Karim El-Melhaoui
@karimscloud.bsky.social

You can now see users that have triggered the Elevated Access toggle in Azure. A simple bypass is to immediately assign the principal the same permissions at the top level management group, Tenant Root Group (tenant ID) rather than the Root scope ("/"). I still think this is an important feature.

Karim El-Melhaoui
@karimscloud.bsky.social

Finally read and implemented the AWS Delegated Management - @scottpiper.bsky.social’s article hits the nail on challebges - we built and maintained an internal API to access this information for automation purposes, which I would do again if it wasn’t for this feature www.wiz.io/blog/use-cas...

wiz.ioUse cases for Delegated Administrator for AWS Organizations | Wiz BlogLearn about how AWS's recently released Delegated Administrator for AWS Organization can be used to solve common problems at your company and the issues you might run into with it.

Karim El-Melhaoui reposted

fwd:cloudsec
@fwdcloudsec.org

Replying to @fwdcloudsec.org

We’re also happy to announce our Europe scholarship program. Through this initiative, we hope to give a limited number of students or those looking to make a career change a chance to attend the conference, through a complimentary ticket and a stipend to cover travel expenses..

fwdcloudsec.orgfwd:cloudsec | fwd:cloudsecfwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

Karim El-Melhaoui reposted

fwd:cloudsec
@fwdcloudsec.org

Ticket sales for fwd:cloudsec Europe 2025 goes live on April 22nd, first batch at 9 AM CET and a second batch at 7PM CET. Tickets are sold through Swoogo, link at fwdcloudsec.org/conference/e... ..

fwdcloudsec.orgfwd:cloudsec Europe 2025 | fwd:cloudsecfwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...
Karim El-Melhaoui
@karimscloud.bsky.social

Messed up an entire GCP org. trying to clean up inheritance using google_organization_iam_policy rather than binding. Will never know what random internal service account were assigned a hopefully not critical role.

Karim El-Melhaoui
@karimscloud.bsky.social

It's happening again! We're looking for sponsors that will help support this years European conference🤝

fwd:cloudsec@fwdcloudsec.org

We’re thrilled to announce that the second edition of fwd:cloudsec Europe will take place on September 15-16 in Berlin! fwdcloudsec.org/conference/e...

fwdcloudsec.orgfwd:cloudsec Europe 2024 | fwd:cloudsecfwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

Karim El-Melhaoui reposted

Audun Mo (he/him)
@audunmo.dev

Is there any way to generate an SBOM that describes github actions and their transitive dependencies? Ref tj-actions. I feel like this should be a thing

Karim El-Melhaoui
@karimscloud.bsky.social

I'll be in Singapore at that time, but for those lucky enough to make it - ENJOY and hope to see you next year or in Europe this Fall (TBA).

fwd:cloudsec@fwdcloudsec.org

Reminder, tickets go on sale for fwd:cloudsec North America at 10am MDT today (less than 2 hours)! Also remember to book your hotel using the group rate link. fwdcloudsec.org/conference/n...

fwdcloudsec.orgfwd:cloudsec North America 2025 | fwd:cloudsecfwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

Karim El-Melhaoui reposted

Nick Frichette
@frichetten.com

The CFP for the best cloud security conference on earth is now open! If you'd like your research to be presented alongside the cutting edge of the industry, this is your opportunity! fwdcloudsec.org/conference/n...

fwdcloudsec.orgCFP | NA 2025 | fwd:cloudsecfwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...
Karim El-Melhaoui
@karimscloud.bsky.social

Cariad, a subsidiary of Volkswagen Group recently had a data compromise in AWS. Unlike my initial instinct, this was not related to a Public or Unprotected bucket.. Looking further into the breach, published by the Chaos Computer Club (ccc.de) responsible for the disclosure it was discovered by..

View full thread
Karim El-Melhaoui
@karimscloud.bsky.social

.. They were able to access: - Specific Location data for any SEAT or Volkswagen car, as they forgot to sample it to a 10km radius. They sampled 10km for Audi, Skoda++ - Personal user information, such as home address, date of birth and email. - Any warnings the car may have had - A lot more..

Karim El-Melhaoui
@karimscloud.bsky.social

Cariad, a subsidiary of Volkswagen Group recently had a data compromise in AWS. Unlike my initial instinct, this was not related to a Public or Unprotected bucket.. Looking further into the breach, published by the Chaos Computer Club (ccc.de) responsible for the disclosure it was discovered by..

View full thread
Karim El-Melhaoui
@karimscloud.bsky.social

.. They continued to analyze the heapdump and used Strings to read data from the Headump, where they found a CLIENT_ID and CLIENT_SECRET. The CLIENT_ID and CLIENT_SECRET allows to authenticate as any user and to access user data directly to the application..

Karim El-Melhaoui
@karimscloud.bsky.social

Cariad, a subsidiary of Volkswagen Group recently had a data compromise in AWS. Unlike my initial instinct, this was not related to a Public or Unprotected bucket.. Looking further into the breach, published by the Chaos Computer Club (ccc.de) responsible for the disclosure it was discovered by..

Karim El-Melhaoui
@karimscloud.bsky.social

.. enumerating the sub-domains using subfinder. Following the sub-domain enumeration, the endpoints were further enumerated using GoBuster. GoBuster revealed a Java Spring application with the Actuator endpoint enabled. The Actuator endpoint revealed an AWS Access Key and Heapdumps..

You are up to date.