Andrew Davis - ClearVector

Product

Introducing runtime container visibility, attribution, and isolation

Today, we’re excited to announce the extension of our cloud-native runtime introspection and isolation capabilities to containers. Our sensor now provides the context of the originating container if runtime activity occurs inside of container technologies such as Docker, containerd, Kubernetes (K8s); on cloud-native services such as ECS, EKS, GKE;

Research

Merge Order Hijacking in AWS Lambda

As serverless computing increasingly becomes popular, third-party vendors are incentivized to provide runtime enhancements to serverless workloads. These enhancements often include telemetry collection, log enrichment, or runtime security enhancements. In this blog, we examine how AWS and third-party vendors deploy these enhancements within AWS Lambda, and how attackers can leverage

Product

Introducing runtime detection and isolation for Lambda and EC2

Today, we’re excited to publicly announce a first of its kind, unified, identity-driven detection and isolation capability for your cloud-native and cloud-enabled apps and infrastructure. More specifically, our approach unifies data provided by AWS with purpose-built identity-driven context and introspection for Lambda and EC2. We launched ClearVector with the

Research

LambdaSpy - Implanting the Lambda execution environment (Part two)

In part one [https://www.clearvector.com/blog/lambda-internals/] of this series, we discussed the AWS Lambda execution environment. In this post, we focus on the challenge of persisting in a serverless environment, gaining access to the data that Lambda functions process, and one possible method in the form of

Research

Lambda internals (Part one)

The past several years have seen a significant rise [https://www.cncf.io/wp-content/uploads/2020/12/CNCF_Survey_Report_2020.pdf] in the use of serverless cloud computing solutions, and with good reason. Serverless [https://aws.amazon.com/serverless/] applications can be cheaper, more scalable, more rapidly developed and

Security

Auditing identity activity for NOBELIUM and MagicWeb in AWS

Earlier this week Microsoft researchers [https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/] discovered NOBELIUM abusing identities and credentialed access to maintain persistence and facilitate covert access. In AWS environments, the IAM Identity Center [https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html] (formerly AWS SSO), enables

Engineering

How to set up an AWS environment

Setting up a well-designed, scalable, secure AWS environment is difficult. Making it more challenging, most people have inherited large AWS environments...