Cloud Network Exposure
A database port open to the whole internet has no application in the path, so nothing the application would enforce applies. Watch a direct connection read personal records, then scope the rule, prove the probe times out, and rotate the credential.
What Is Cloud Network Exposure?
A security group is the firewall, and an administrative or database port opened to the whole internet is exactly what it sounds like. This exercise covers the direct path: watch an attacker scan, find an open database port, and connect with no application in the way, then scope the rule properly and confirm the same external connection now fails.
What You'll Learn in Cloud Network Exposure
- An open database port bypasses every control the application would have applied, because the application is not in the path.
- Scope security group rules to known ranges so an internet-wide scan never sees the resource at all.
- A credential used over an untrusted path is disclosed. Closing the port does not undo that, so rotate it.
- Prove it with the same external probe: a timeout means the packet is no longer reaching a listener.
Cloud Network Exposure — Training Steps
-
Scanning for open ports
Bob does not target companies, he targets open ports. He runs a scanner across a cloud provider's public address ranges looking for one thing: a database or admin port answering from the internet. Today a host in Halbrint's range answers.
-
Only the firewall was in the way
An open port is an invitation, not a break-in. The database still wants a login. But teams that assume a database is unreachable from outside often leave it with a weak or default application password, because 'nothing on the internet can even see it.' That assumption is the whole vulnerability. The security group was the only control, and it is wide open.
-
Connecting straight to the database
Bob points a database client at the open port and tries the kind of credential these setups are left with. There is no application, no API, no audit log in the path - just Postgres and a password.
-
Every student on every route
Bob is in. He reads the table that logistics runs on: the children Halbrint transports, where they live, and who to call.
-
Which control failed?
Before the response, one question about what actually went wrong here.
-
An external monitor flags the port
Halbrint runs an external attack-surface scan. Overnight it flagged a production database answering from the internet, and it landed in Alice's inbox.
-
Open the security groups
Alice opens the cloud console to the VPC security groups for the production account. The database's firewall is one rule table, and one row on it decides who on earth can reach the port.
-
Find the wide-open rule
The database security group has one inbound rule that matters, and it is the one the scanner found.
-
0.0.0.0/0 is the whole internet
There it is, in the inbound rules: Postgres on 5432, allowed from 0.0.0.0/0.
-
Scope the rule to the app subnet
Alice rewrites the inbound rule so 5432 is reachable only from the app-tier subnet - the one set of hosts that actually needs the database. The public internet loses its route to the port entirely.