Главная
Study mode:
on
1
Intro
2
Shoutouts
3
Heroku Engineering
4
What is CICD
5
CICD Components
6
Common Deployment Patterns
7
Fully Multitenant
8
Single Tenant
9
Networking
10
Virtual Network
11
Add Directive
12
Demo
13
Whats the impact
14
Remediation
15
Assumptions
16
Power of Command
17
Commands in Containers
18
Orchestrators Fail
19
Component Verification
20
Supply Chain Attacks
21
Potential Attack Scenario
22
Build Environments
23
How do we do this
24
Demo OCR Image
25
Demo OCR Image Containers
26
Evil Forks
27
Cheat Sheets
28
Conclusion
29
Supply chain security
30
Wrapup
31
Multitenancy
32
Research
33
Thank you
Description:
Explore the security vulnerabilities in multi-tenant cloud build environments and container-based CI/CD pipelines in this 47-minute Black Hat conference talk. Gain a concise introduction to Continuous Integration, Delivery, and Deployment (CI/CD) and containers from a hacker's perspective. Discover various security pitfalls through live demonstrations, including reverse engineering techniques and exploitation methods. Learn about potential attack scenarios, supply chain attacks, and the impact of compromised build environments. Understand remediation strategies, component verification, and best practices for securing CI/CD processes. Delve into topics such as evil forks, OCR image attacks, and the power of commands in containers. Equip yourself with knowledge to enhance the security of cloud-based software development and deployment workflows.

Reverse Engineering and Exploiting Builds in the Cloud

Black Hat
Add to list
0:00 / 0:00