One Port to Serve Them All - Google GCP Cloud Shell Abuse

Explore a critical security vulnerability in Google Cloud Platform's Cloud Shell feature in this 17-minute conference talk from BSidesLV. Delve into an abuse methodology that exploits an unexpected public-facing port, allowing attackers to bypass Google authentication and potentially leak data, deliver malicious content, or pivot attack traffic through the Google network. Learn how the manipulation of Linux Netfilter's NAT table can be used to serve various internally running services within the Cloud Shell container to the public, despite the instance's short lifespan. Gain insights into the security risks associated with granting excessive permissions in cloud environments and understand the implications for both administrators and developers using cloud service providers.