Nitesh 'ideaengine007' Surana

Nitesh Surana is a Senior Threat Researcher with Trend Micro specializing in cloud vulnerability & security research. Recently, he's been in the top 10 Microsoft Security Researchers for 2024, primarily for his submissions via the Zero Day Initiative. His research has been presented in conferences such as Black Hat [USA, Asia], FIRSTCON, HackInTheBox, HackInParis, Nullcon, c0c0n, Vulncon, Security BSides [Delhi, Bangalore, Ahmedabad], NDC Oslo and OWASP/Null Bangalore meetups. Apart from playing with packets and syscalls, Nitesh is found attending metal concerts and writing/playing music.

Links: Hacking Archives of India, LinkedIn, Twitter, YouTube, Profile Picture

Upcoming Talks

FROM CODE TO CRIME: EXPLORING THREATS IN GITHUB CODESPACES @ VirusBulletin 2024, Dublin, Ireland

Cloud-based development environments enable developers to work from any device with internet access. Introduced during the GitHub Universe event in November 2022, Codespaces offers a customizable cloud-based IDE, simplifying project development. However, the openness of this service has been exploited by attackers, leading to in-the-wild campaigns leveraging GitHub Codespaces for developing, hosting, and exfiltrating stolen information.The presentation will showcase GitHub Codespaces' features and explore typical methods of abuse by threat actors, focusing on observed malicious campaigns. Highlighted is DeltaStealer, a credential-stealing malware family with diverse variants, some featuring unique capabilities like persistent Discord authentication compromise and cloud-based data exfiltration. Developed using GitHub Codespaces, these infostealers reveal interesting artifacts, including debug symbols, exposing insights into the developers' identities. The presentation will showcase social media evidence and conclude with practical recommendations on configuring cloud-based IDEs securely, identifying suspicious instances, and proactively addressing similar cyber threats.

TOKENS & TAKEOVERS: CLOUD POWERED SUPPLY CHAIN ATTACKS @ BSides Ahmedabad 2024, Gujarat, India

It takes one single misconfigured token to jeopardize cloud resources and their downstream dependent systems; a recent example being an overly permissive SAS token leading to the 2023 leak of 38 TB of Microsoft AI research data. After Microsoft's account of the incident, we did our own part in hunting for overly permissive SAS tokens. We found two different ways of controlling a widely used official Microsoft tool called PC Manager. One could eventually execute a classic supply chain attack across multiple releases of MS PC Manager that were sprinkled across the web in the form of blogs, support forums, an official website and WinGet packages. Using the SAS tokens, we could takeover every release of MS PC Manager. Furthermore, we will share our findings wherein one could inject malicious stored procedures on database backups for tutorials mentioned in official Azure docs, modify JavaScript resources being used on multiple websites using one single SAS token. To conclude, we will share what practitioners can do to proactively hunt for sensitive information in URL parameters in their environments.