Webcast: Open Source Exploits in the Cloud’s Big Data Services – Cloud TradeCraft

This Black Hills Infosec webcast and linked blog describe research and coordinated disclosure to AWS of an exposure in open-source big-data clusters (Hue/Hadoop/Spark) running in cloud environments; the presenters demonstrate how misconfigured or default-open services can be discovered via Shodan, can yield remote shells, and potentially expose virtual private clouds globally, and they provide slides, a write-up, remediation advice, and tooling references for defenders and researchers.