{"guid":"1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","title":"Gone in 60 Milliseconds","subtitle":"Intrusion and Exfiltration in Server-less Architectures","slug":"33c3-7865-gone_in_60_milliseconds","link":"https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/7865.html","description":"\u003cp\u003eMore and more businesses are moving away from monolithic servers and turning to event-driven microservices powered by cloud function providers like AWS Lambda. So, how do we hack in to a server that only exists for \u003ci\u003e60 milliseconds\u003c/i\u003e?\u003c/p\u003e\n\n\u003cp\u003eThis talk will show novel attack vectors using cloud event sources,  exploitabilities in common server-less patterns and frameworks, abuse of undocumented features in AWS Lambda for persistent malware injection, identifying valuable targets for pilfering, and, of course, how to exfiltrate juicy data out of a secure Virtual Private Cloud. \u003c/p\u003e","original_language":"eng","persons":["Rich Jones"],"tags":["Security"],"view_count":11875,"promoted":false,"date":"2016-12-28T13:45:00.000+01:00","release_date":"2016-12-28T01:00:00.000+01:00","updated_at":"2026-04-13T16:15:03.983+02:00","length":1981,"duration":1981,"thumb_url":"https://static.media.ccc.de/media/congress/2016/7865-hd.jpg","poster_url":"https://static.media.ccc.de/media/congress/2016/7865-hd_preview.jpg","timeline_url":"https://static.media.ccc.de/media/congress/2016/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f-timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/congress/2016/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f-thumbnails.vtt","frontend_link":"https://media.ccc.de/v/33c3-7865-gone_in_60_milliseconds","url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_title":"33C3: works for me","conference_url":"https://api.media.ccc.de/public/conferences/33c3","related":[{"event_id":3601,"event_guid":"5a517be2-220b-4eb6-88c3-e7ef08c98ace","weight":52},{"event_id":3615,"event_guid":"74783236-46f4-493c-9574-1b27a44847b7","weight":99},{"event_id":3629,"event_guid":"686b1941-b211-4902-b4c4-1d642398e08b","weight":38},{"event_id":3632,"event_guid":"378cdf23-350b-4a05-afd0-6360139a7a06","weight":35},{"event_id":3633,"event_guid":"530f0400-e4e8-4d99-909d-4cfc8121c0b0","weight":60},{"event_id":3636,"event_guid":"a1a52c4c-8233-403b-8f04-db981df016c1","weight":40},{"event_id":3640,"event_guid":"700a07e7-a9c4-437b-a4c5-4491b23a9b4a","weight":90},{"event_id":3643,"event_guid":"2689ebfe-0d84-4c88-9ea6-5cadad9d4fa4","weight":46},{"event_id":3644,"event_guid":"d1681340-162c-48ce-8c0b-61c3e176696d","weight":36},{"event_id":3650,"event_guid":"ff044b6a-d567-4309-b9a8-ec9384b16a27","weight":55},{"event_id":3652,"event_guid":"60b52369-b0ee-455f-904a-4dfef49596eb","weight":81},{"event_id":3654,"event_guid":"ac80424a-f4dc-431d-95f3-3f85664ba2dc","weight":55},{"event_id":3657,"event_guid":"4bff9cb3-9e91-4305-9029-f4d9053c7b5c","weight":67},{"event_id":3658,"event_guid":"10b11771-c76f-44d5-9b65-9ebca428d8ff","weight":65},{"event_id":3660,"event_guid":"69ce21df-4bf5-43ce-a500-ac7707ee64b7","weight":36},{"event_id":3662,"event_guid":"8c32309e-7136-4899-8ee4-1558e63ad137","weight":56},{"event_id":3665,"event_guid":"e204268f-0cea-4a1f-bb38-e7d50496492e","weight":50},{"event_id":3667,"event_guid":"6347d122-daf0-4b30-851c-32cac06bf6bd","weight":56},{"event_id":3669,"event_guid":"7ef9172a-e2c7-4e78-9316-08449bd582c6","weight":42},{"event_id":3671,"event_guid":"4ef69e6a-026f-4b30-888d-af654b220a3d","weight":63},{"event_id":3674,"event_guid":"bfc2ab1f-8384-4d7d-801a-dde8c81e039c","weight":39},{"event_id":3676,"event_guid":"f6811c99-96af-44d5-b82d-5afe826b2caf","weight":42},{"event_id":3683,"event_guid":"1b27dbeb-cffc-48a1-b2e6-b2011c338a50","weight":38},{"event_id":3687,"event_guid":"5ae90a09-0b83-4357-bdb4-9afc04100c68","weight":36},{"event_id":3689,"event_guid":"1f7eb981-2819-4824-8f40-4ddde0be7bf3","weight":101},{"event_id":3692,"event_guid":"f21478d4-e8db-4f19-854c-2f74b5824706","weight":55},{"event_id":3695,"event_guid":"c300b194-2a85-4705-92aa-b4e789882303","weight":62},{"event_id":3698,"event_guid":"994082de-ef8e-4f8e-8c46-ec0eb110b845","weight":38},{"event_id":3701,"event_guid":"155a622a-196e-4e05-a262-88f3a7726bbe","weight":50},{"event_id":3731,"event_guid":"bc638f9f-0370-42f9-b83c-f85cca4ca38d","weight":38},{"event_id":3734,"event_guid":"34ea8f1f-9fad-41aa-8424-e833f10e5e8b","weight":71},{"event_id":3760,"event_guid":"1c75e6a1-e586-4b91-abce-92a4561d0181","weight":49},{"event_id":3761,"event_guid":"b598ebbf-0fc6-4127-bb9d-20ae18f1171d","weight":43},{"event_id":3762,"event_guid":"25e2df7d-5740-4c2f-bc34-986326d606fe","weight":73},{"event_id":3763,"event_guid":"8fbee7ff-b50c-4310-af9d-d44794669f25","weight":51}],"recordings":[{"size":null,"length":null,"mime_type":"application/x-subrip","language":"eng","filename":"33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds.en.srt","state":"complete","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2021-02-21T17:46:13.696+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds.en.srt","url":"https://api.media.ccc.de/public/recordings/44386","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":136,"length":1981,"mime_type":"video/mp4","language":"eng","filename":"33c3-7865-eng-Gone_in_60_Milliseconds.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-12-28T16:11:26.507+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/h264-hd/33c3-7865-eng-Gone_in_60_Milliseconds.mp4","url":"https://api.media.ccc.de/public/recordings/13857","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":158,"length":1981,"mime_type":"video/mp4","language":"deu","filename":"33c3-7865-deu-Gone_in_60_Milliseconds.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-12-28T16:11:34.455+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/h264-hd/33c3-7865-deu-Gone_in_60_Milliseconds.mp4","url":"https://api.media.ccc.de/public/recordings/13858","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":158,"length":1981,"mime_type":"video/mp4","language":"fra","filename":"33c3-7865-fra-Gone_in_60_Milliseconds.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-12-28T16:11:41.954+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/h264-hd/33c3-7865-fra-Gone_in_60_Milliseconds.mp4","url":"https://api.media.ccc.de/public/recordings/13859","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":273,"length":1981,"mime_type":"video/mp4","language":"eng-deu-fra","filename":"33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-12-28T16:11:52.193+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/h264-hd/33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds_hd.mp4","url":"https://api.media.ccc.de/public/recordings/13860","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":25,"length":1968,"mime_type":"audio/opus","language":"eng","filename":"33c3-7865-eng-Gone_in_60_Milliseconds.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2016-12-28T17:24:21.716+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/opus/33c3-7865-eng-Gone_in_60_Milliseconds.opus","url":"https://api.media.ccc.de/public/recordings/13924","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":30,"length":1968,"mime_type":"audio/mpeg","language":"eng","filename":"33c3-7865-eng-Gone_in_60_Milliseconds.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2016-12-28T17:25:05.652+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/mp3/33c3-7865-eng-Gone_in_60_Milliseconds.mp3","url":"https://api.media.ccc.de/public/recordings/13925","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":118,"length":1981,"mime_type":"video/mp4","language":"eng-deu-fra","filename":"33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-12-28T17:26:34.359+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/h264-sd/33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds_sd.mp4","url":"https://api.media.ccc.de/public/recordings/13926","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":107,"length":1981,"mime_type":"video/webm","language":"eng-deu-fra","filename":"33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-12-28T17:27:02.652+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/webm-sd/33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/13927","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":199,"length":1981,"mime_type":"video/webm","language":"eng-deu-fra","filename":"33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-12-28T22:21:11.900+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/webm-hd/33c3-7865-eng-deu-fra-Gone_in_60_Milliseconds_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/14069","event_url":"https://api.media.ccc.de/public/events/1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","conference_url":"https://api.media.ccc.de/public/conferences/33c3"}]}