CloudCredential TheftOver-Privileged Service Accounts Create Escalation of Privileges and Lateral Movement in Google CloudDecember 2, 2021·13 min read
AuthCredential TheftWho Do You Trust? Challenges with OAuth Application IdentitySeptember 14, 2021·12 min read
Phishing AuthNew Phishing Attacks Exploiting OAuth Authorization Flows (Part 3)August 12, 2021·8 min read
Phishing AuthNew Phishing Attacks Exploiting OAuth Authorization Flows (Part 2)August 10, 2021·7 min read
Phishing AuthNew Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)August 10, 2021·5 min read
CloudCredential TheftA Real-World Look at AWS Best Practices: Password PoliciesJune 3, 2021·5 min read
CloudCredential TheftA Real-World Look at AWS Best Practices: IAM User AccountsMay 6, 2021·9 min read
CloudRemote AccessIt's All About Access: Remote Access Statistics for Public Cloud WorkloadsOctober 6, 2020·6 min read
RSACRSAC: The Dark Underbelly of 3rd-Party Application Access to Corporate DataJenko HwongApril 25, 2023
DEF CONDEF CON Cloud Village: OAuth-some Security Tricks: Yet more OAuth abuseJenko HwongAugust 13, 2022
OWASP Global AppSecOWASP Global Appsec: Defending against new phishing attacks that abuse OAuth authorization flowsJenko HwongJune 6, 2022