Backdooring an AWS account - Meanderings by Daniel Grzelak

So you’ve pwned an AWS account — congratulations — now what? You’re eager to get to the data theft, amirite? Not so fast whipper snapper, have you disrupted logging? Do you know what you have? Sweet! Time to get settled in. Maintaining persistence in AWS is only limited by your imagination but there are few obvious and oft used techniques everyone should know and watch for. No one wants to get loc

[tmatsuu]

AWSでアカウントを乗っ取った時のバックドアの作成方法。Lambda便利すぎる。乗っ取られた際にはアクセスキーやパスワードの変更のみならず、Lambdaなどに不審なものがないかチェックすべし。