4 ms·
What's fundamentally different if you host this in the cloud but still have a public port? What was the exact attack vector in the case of nyevgeny?
by hbogert 4y ago
What's fundamentally different if you host this in the cloud but still have a public port?
What was the exact attack vector in the case of nyevgeny?
- ryanisnan 4y agoThe difference is it would be likely inconsequential if a the cloud resource running this was compromised. There’s no direct link (at least there shouldn’t be) to a work machine, which might have credentials or itself VPN information for an employer. Yevgeny did exactly this. He compromised a web server running Apache or something, used that to brute force his way into a networked work machine, which took weeks, but went undetected. That machine turned out to be the physical host the VM running the web server was on. Then he used the work machine to break into LinkedIn using credentials and VPN profiles found on the iMac. This vector would have been impossible had that open server not been running so close to the work machine.