The Log Rings Don't Lie: Historical Enumeration in Plain Sight
Bleon Proko
BSides NYC 2025 (0x05) · Day 1 · Tech - Blue
In a revealing talk at BSides NYC, security researcher Bleon Proko from Exa Force illuminated a critical, yet often overlooked, attack vector in cloud environments: the weaponization of **logs** for historical enumeration. While logs are universally understood as vital tools for defense, monitoring, and forensics, Proko demonstrated how these very data sources can be repurposed by attackers to gather extensive intelligence about identities, resources, and permissions across major cloud providers like AWS, Azure, and Google Cloud Platform (GCP). This research is a subset of a larger ongoing effort to weaponize various cloud features, embodying a "living off the land" approach where an attacker leverages existing cloud functionalities for malicious purposes.
AI review
Competent, well-structured cloud security research on a real and underappreciated attack surface — log-based enumeration is legitimately stealthy and the cross-provider analysis is useful. But it stops short of being genuinely novel: the core insight (logs contain sensitive metadata, read access is over-permissioned) is known, and without tooling, a live demo, or a systematic enumeration framework, this is more awareness talk than research contribution.