First public presentation of the Broker Injection concept.
What it’s about
I presented the Broker Injection concept for the first time and released Enteletaor, a security tool to inject, extract and modify information in brokers and message queues.
I cover the vulnerabilities in messaging systems (Redis, RabbitMQ, ZeroMQ), injection techniques in brokers and how sensitive data gets exfiltrated. I finish with a live demo of Enteletaor.
Why it’s relevant
Brokers and messaging systems sit at the heart of modern distributed systems, and nobody was talking about their security.
The talk introduced a new attack vector that many companies hadn’t even thought about.
Impact
- The security community adopted the concept
- Enteletaor became the reference tool for broker pentesting
- Several companies reviewed their messaging architecture after the talk