Contact Us

NetSPI   »   Presentations

We Know What You Did (in Azure) Last Summer

Conference: DEF CON > DEF CON 33
Category: Cloud Pentesting

NetSPI Speakers

Karl Fosaaen

Thomas Elling

Date: August 7, 2025
Location: Las Vegas, US
Related
DEF CON 33 We Know What You Did (in Azure) Last Summer What the Function: A Deep Dive into Azure Function App Security Modern Adventures in Azure Privilege Escalation

How much do you trust your cloud provider to hide the ownership information for your resources? Many organizations believe that their ownership information for cloud hosted resources is not available to anonymous users. Unless there’s an associated DNS record or other obvious identifiers (website content, SSL certificates, etc.), it might seem difficult to anonymously identify a cloud resource’s owner. What if we told you that some of your Azure resources can expose their ownership information?

This talk will explain how multiple Azure resource types (and Microsoft services) inadvertently expose their ownership information, allowing attackers to enumerate potential entry points into an Azure tenant. Thanks to the supporting structure of Azure resource subdomains, and public DNS data sources, we enumerated the ownership information of over 500,000 Azure resources.

We will wrap things up by sharing a new tool (ATEAM – Azure Tenant Enumeration and Attribution Module) that can be used to replicate our research, so you too can find out where all of your Azure resources have been hiding.