Rootconf Mini 2024

What can a bored hacker do with $5? They can do one of the below - buy a coffee, subscribe to some video streaming service or make your company bleed 10s to 100s of dollars in cloud bills.

While the majority of companies are already on cloud or have a hybrid cloud setup, one must understand that cloud environments are different organisms compared to data centers. It can massively scale your infrastructure. It can massively scale your cloud bills as well - pushing your company anywhere between huge expenses to the brink of bankruptcy.

This research based talk shines light on an underrated bug class specific to cloud environments, often referred to as “denial of wallet” (DoW) or “exhaustion of wallet”, among different cloud providers and cloud services.

The talk tries to answer the reasons why this bug class exists, public examples of these attacks in the past and the different cloud and VPS providers that are vulnerable to this bug class. The talk will also highlight possible solutions that can be implemented on both sides of the shared responsibility model to detect and mitigate bug class - showing ways to mitigate damage from an attacker willing to spend $500 against your infrastructure.

Key Takeaways: The root cause of DoW, different services from different cloud providers that are affected by this issue, possible solutions to detect and mitigate this bug class.

Audience Segment this talk is going to benefit: Cloud Architects, Cloud Engineers & Cloud Security Professionals.