Security researchers have revealed new methods by which attackers could potentially exploit Google Cloud Platform (GCP) services, particularly leveraging vulnerabilities in Cloud Functions and Cloud Build, to carry out malicious activities and gain unauthorized access.
This comes after findings published by Tenable Research and expanded upon by Cisco Talos, demonstrating how cloud-native configurations and default permissions can be manipulated for privilege escalation and cloud environment enumeration not only within GCP, but also across competing platforms such as Amazon Web Services (AWS) and Microsoft Azure.
Excessive Permissions in GCP Services
GCP Cloud Functions, designed to execute serverless code in response to events, typically rely on Cloud Build for deployment.
Tenable’s research highlighted a specific risk: by creating or updating Cloud Functions, users triggered a backend process where the default Cloud Build service account (SA) was granted excessive permissions.
Malicious actors able to manipulate function deployments could escalate their privileges, assigning themselves higher-privilege roles or leveraging the default Cloud Build SA to gain broader access within the cloud environment.
Google has since responded to these disclosures by patching the vulnerability, restricting the default permissions of the Cloud Build service account, and issuing new organizational policies giving customers more granular control over service account usage.
Cisco Talos took Tenable’s findings further, demonstrating that the same sort of privilege escalation could be adapted to perform a range of other harmful activities if certain prerequisites are met.
By configuring a Debian Linux server with Node Package Manager (NPM) and Ngrok, and deploying a Python server for data output, Talos was able to illustrate how attackers could use a manipulated package.json file to inject malicious code into the cloud build process.
When this package is included in a Cloud Run Function’s deployment and executed, it could enumerate sensitive information about the hosting environment such as network topology, privilege structures, and the presence of Docker containers and relay it to remote endpoints directly under attacker control.
Attack Techniques Extend to AWS and Azure
The research also explored the extension of these techniques to AWS Lambda and Azure Functions, showing that a similar attack methodology could be performed by crafting Node.js runtimes to reference malicious NPM packages.
Even though Google’s patch has mitigated the specific vector for extracting privileged GCP service account tokens, Talos demonstrated that environment enumeration gathering information such as control groups, kernel versions, and user permissions remains feasible.
These details facilitate further attacks, such as lateral movement or privilege escalation within victim cloud environments.
The implications for cloud security are significant. Commands to perform ICMP discovery, check for .dockerenv files, query CPU scheduling, and enumerate mount points are easily embedded into deployment scripts and can yield a comprehensive blueprint of the cloud instance.
This reconnaissance step is critical for sophisticated threat actors planning targeted attacks, as it allows them to tailor exploits to known vulnerabilities in specific cloud setups.
In response, Google has implemented measures such as restricting the permissions of the default Cloud Build service account and enhancing organizational controls. However, the underlying risk is not entirely eliminated.
According to the Report, Security experts recommend organizations rigorously enforce the principle of least privilege for all service accounts, ensure all cloud services are updated with current security patches, and replace legacy service accounts with ones strictly scoped for necessary operations.
Continuous monitoring and auditing of IAM permissions, alerting on unusual creation or modification of Cloud Functions, and inspecting network traffic for suspicious external communications such as those utilizing tunneling services like Ngrok are crucial defense strategies.
Furthermore, teams should validate the integrity of all NPM packages and watch for signs of environment enumeration, as these can be early indicators of compromise.
While Google’s immediate response has closed off one high-risk vector, this research underscores the broader need for proactive cloud security posture management.
The evolution of attacker techniques across multiple cloud service providers highlights the importance of cross-cloud vigilance and continuous assessment of permissions and deployment workflows to counteract emerging threats.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
