Skip to content

Details

Thanks to this month's sponsor: Github.

This time we are using a different platform for meeting. Gather Town! Don a virtual avatar and listen to talks as if at a live conference and network with fellow people in separate one to one talks that you can walk in and walk out as you would do in the real world!

As always we would like a diverse set of speakers presenting at our meetup. If you have a talk that you would like to present please submit it at https://forms.gle/eqFV9RQz5uefnmqY6

This months talk(s):

Talk 1 - 7:00 PM

Title: Hacking S3 Bucket of a Mobile Bank by Stephen Ogu

Abstract: All too often, when security researchers or hackers find personal information online, it's sitting in an unsecured Amazon S3 bucket. We see this time and time again, often with extremely troubling results.

Hundreds of millions of user records left sitting in plain sight. Nearly eight hundred thousand applications for birth certificate copies ripe for the taking. Tens of thousands of bank app users' private info just practically begging to be stolen. Incidents like these — and there are many, many more — are all tied together by one cloud computing platform: Amazon Web Services.
So what's going on here? Are customers simply misusing the product, or is there some sort of design flaw that makes the accidental exposure of data inevitable?
This is why I am willing to share my favorite hack and also trying to explain the sometimes confusing world of configured buckets, security experts are more than happy to share their expertise.

Speaker Bio: Stephen is a Cyber-Security professional, an EC Council Certified Security Analyst, Ethical hacker, an Application Vulnerability Analyst and Penetration Tester. Stephen has a broad experience in cloud solution architect, and also experience in a web apps and mobile apps security testing in a wild range of industries such as finance, social, transportation and utility apps.

Talk 2 - 7:45

Talk Title: Low-hanging Secrets in Docker Hub by Matias Sequeira

Abstract: After a security incident at work, I thought about analyzing DockerHub images looking for “forgotten” secrets. Many hours of development later, I confirmed my theory: I found hundreds of organizations/individuals with their keys to their infrastructure exposed: AWS keys, SSH keys, databases’ passwords, etc.- published and accessible to everyone, which can be easily hacked. In this talk, I will comment on the open-source tools I developed - valuable to those who perform OSINT/Pentest/BugBounty, along with a summary of the secrets found. Finally, I will provide recommendations for using secrets in docker images and container infrastructures.

Speaker Bio: Independent security researcher and developer focused in the R&D of cybersecurity tools presented in conferences such as BlackHat, Ekoparty, etc. Fulbrighter pursuing MSc in Cybersecurity at Northeastern University.

Gather town Link will be available to those who RSVP.

Agenda is as follows:
6 30 PM - Gather Town is open for guests to join
6 45 PM - Announcements
7:00 PM - Talk 1 - Hacking S3 Bucket of a Mobile Bank by Stephen Ogu
7:30 PM - Break and general chatter
7:45 PM - Talk 2 - Low-hanging Secrets in Docker Hub by Matias Sequeira
8:15 PM - Break and general chatter
8:30 PM - Meetup ends

Sponsors

Strike48

Strike48

Sponsors

You may also like