Atrás 
When you look at the details surrounding attacks in the cloud, how easy is it for you to quickly determine what happened and how to prevent a similar attack in your own environment? Applying the MITRE Att&ck Cloud Matrix is a great resource to classify and understand cloud-based attacks.
In this post, we will revisit a previous blog post to demonstrate how MITRE’s new Cloud Matrix can be applied to help us analyze the threat and prevent it from happening in your environment. We’ll recount the scenario, which exposes data in a storage bucket hosted by the Google Cloud Platform (GCP). Then we will examine some mitigations provided by MITRE, and look at how we could implement these in GCP.
Summary of the Scenario
The original scenario was an attack in which I escalated my privileges to remove a security perimeter established around a storage bucket that was storing sensitive data. The security perimeter only allowed people to access the bucket if they were coming from the correct IP address range. Below is a diagram, along with the steps taken to complete the attack.
The attack followed these basic steps:
- A service account credential was accidentally exposed, which had OSLogin permissions (allows someone to SSH to virtual machines).
- Using the exposed credential, I SSHd into a publicly exposed virtual machine.
The virtual machine was running with the default service account for Google Compute Engine (which has too many permissions), and the scope associated was, “Allow full access to all Cloud APIs.”
- Using the default service account, I listed the other service accounts in that project.
- I located a service account that had admin permissions and activated that service account from the virtual machine. At that point, I had administrative privileges at the Organization level.
- Using the admin service account, I removed a VPC Security Perimeter.
- After removing the VPC Security Control Perimeter, I accessed the data in the storage bucket that was previously protected.
The attack’s im