Hacker Fully Compromises Cloud Server in Under Four Hours

SAN FRANCISCO, CA--(Marketwired - Dec 19, 2013) - CloudPassage®, the leading cloud infrastructure security company, today released a report detailing the outcome of The Gauntlet, a recent capture-the-flag-style live server exploitation exercise aimed at understanding how vulnerable cloud environments are to motivated hackers. According to the report, the winning hacker was able to fully compromise an unpatched, minimally configured cloud server instance in under four hours.

"Despite the best efforts of the security community and the cloud providers themselves, there is a common misperception that cloud infrastructure does not need additional security. The Gauntlet project shows just how easily a motivated attacker can compromise cloud infrastructure that's not configured for survivability," said Carson Sweet, CEO of CloudPassage. "Cloud computing requires renewed security diligence, preferably achieved through built-in security automation. Application development teams and security administrators should not need to worry about minuta that create major security exposures, but are easily eliminated through automation."

Facilitated by Bugcrowd, an independent third-party bug bounty provider, The Gauntlet drew 367 ethical hacking participants from 41 different countries over the course of 23 days beginning September 11, 2013. The participants were asked to target a pool of six servers provisioned with various Microsoft and Linux-based operating systems running a variety of databases, FTP servers and application frameworks. The servers were launched in their default configurations and no additional security controls were applied, a common practice in cloud infrastructure environments.

Over 100 security issues were reported, 90 of which were successfully validated as true remote exposures. The winning hacker, who works for an IT company and is currently studying computer science at a California university, considers information security and bug bounties a side hobby. The winner established a foothold using a weakly protected administrative web interface, which contained application vulnerabilities and excessive rights that were further exploited to gain complete access to and control over the system.

"What I did could be boiled down to a single batch script," said The Gauntlet winner. "Once access is gained to an administrator account on an application interface, it would take only a minute or two to gain full access to a similarly configured system. I hope this has shown the potential damage an attacker can cause."

For more information on The Gauntlet visit the CloudPassage Cloud Security Blog or download a copy of the report.

Related Content

• Follow @CloudPassage on Twitter to stay up-to-date on all of the company's latest news and product information 
• News: CloudPassage Halo App for Splunk Enterprise Provides Critical Insights for Cloud Environments

About CloudPassage
CloudPassage is the leading cloud infrastructure security company and creator of Halo, the industry's first and only security and compliance platform purpose-built for elastic cloud environments. Halo's patented architecture operates seamlessly across any mix of software-defined data center, public cloud, and even hardware infrastructure. Industry-leading enterprises including multiple trust Halo to protect their cloud and software-defined datacenter environments. Headquartered in San Francisco, CA, CloudPassage is backed by Benchmark Capital, Tenaya Capital, Shasta Ventures, and other leading investors. For more information, please visit http://www.cloudpassage.com.

CloudPassage® and Halo® are registered trademarks of CloudPassage, Inc. All other brand names, product names, or trademarks belong to their respective owners.