Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

ChaosDB - How We Hacked Databases of Thousands of Azure Customers

Black Hat via YouTube

Overview

Dive into a critical cybersecurity presentation from Black Hat that exposes ChaosDB, a severe cross-tenant vulnerability in Azure Cosmos DB. Discover how the Wiz Research Team uncovered this unprecedented cloud vulnerability that allowed unauthorized access to thousands of Azure customers' databases. Learn about the exploitation process, including Jupyter Notebook LPE, unrestricted network access, and account service takeover. Explore the research mindset, network reconnaissance techniques, and the full exploit chain. Gain insights into the disclosure timeline and the far-reaching implications of this security flaw for organizations worldwide.

Syllabus

Intro
Wiz Research Team
Motivation
Research Mindset
Bug #1 - Jupyter Notebook LPE
Bug #2 - Unrestricted Network Access
Network Recon - IMDS
Network Recon - WireServer
WireServer 101 - Extension Configuration
Wire Server 101 - Certificate Endpoint
Decoding CertificatesBondPackage
Listing Running Applications in Cluster
Recap - The Full Exploit
Disclosure Timeline
Account Service Takeover

Taught by

Black Hat

Reviews

Start your review of ChaosDB - How We Hacked Databases of Thousands of Azure Customers

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.