Research

Keeping the cloud secure

The mission of the Wiz Research team is to uncover and analyze threats to the cloud, build mechanisms that prevent and detect them, and fortify cloud security strategies. Our world-class researchers share insights with Wiz customers, cloud service providers, cloud builders, cloud defenders, and the security community.

Threat research & detection

We collect and analyze data to identify the sources, techniques, and targets of potential cloud attacks before they happen.

Vulnerability research

We investigate systems to identify new attack vectors and cloud vulnerabilities.

Security guidance

Our experience with top cloud users informs the actions and best practices we share with our customers and the broader security community.

Research publications

Wiz Research discovers "ExtraReplica"— a cross-account database vulnerability in Azure PostgreSQL

Tenant isolation is a fundamental premise of the cloud. Organizations trust that the cloud services they use, especially high value assets such as databases, are isolated from other customers.

Securing AWS Lambda function URLs

The cloud gray zone—secret agents installed by cloud service providers

Addressing the Spring4Shell and CVE-2022-22963 RCE vulnerabilities in cloud environments

Hardening your cloud environment against LAPSUS$-like threat actors

Detect and prioritize CISA Known Exploited Vulnerabilities in the cloud with Wiz

5 reasons endpoint security agents are not enough

The top cloud security threats to be aware of in 2022

Towards a better cloud vulnerability response model

NotLegit: Azure App Service vulnerability exposed hundreds of source code repositories

Log4Shell 10 days later: Enterprises halfway through patching

Log4Shell Meltdown: How to protect your cloud from this critical RCE threat

See all publications

Cloud community
database

We contribute to The Open Cloud Vulnerability & Security Issue Database, an open project to list all known cloud vulnerabilities and cloud service provider security issues.

Learn more

The Open Cloud Vulnerability and Security Issue database interface screenshot

Research in the news

Beware the 'Secret Agent' Cloud Middleware

Microsoft notifies customers of Azure bug that exposed their source code

Security researchers at Wiz discover another major Azure vulnerability

See all press

Follow updates from our team

Alon Schindel

@41thexplorer

July 6, 2022

IAM Roles Anywhere official announcement is out 📣 A new feature enabling the use of AWS IAM roles in workloads outside of AWS with temporary credentials ➡️ https://aws.amazon.com/blogs/security...

Scott Piper

@0xdabbad00

I am very curious to learn more about the new Roles Anywhere service that hit the SDK today. "Roles Anywhere provides a secure way for your workloads such as servers, containers, and applications running outside of AWS to obtain Temporary AWS credentials." twitter.com/publiccloudbot… 

Show this thread

Nir Ohfeld

@nirohfeld

June 9, 2022

After we were introduced to cloud middleware through the #OMIGOD research, we (+@shirtamari) are launching a community-driven project to map agents silently installed by CSPs on customers' VMs to help cloud customers and researchers alike. Check it out!

github.com
Github - wiz-sec/ cloud-middleware-dataset

Amitai Cohen

@AmitaiCo

May 24, 2022

Vulnerability assessment often involves cross-referencing between CVE databases (like NVD), CPE dictionaries, and a rule repository of some sort. Here is a simplified diagram showing how this process works (e.g. identifying CVE-2022-0847 AKA "Dirty Pipe" on a Linux machine).

Wiz

@wiz_io

June 8, 2022

Researchers @nirohfeld and @shirtamari detail how they discovered the OMIGOD vuln in Azure OMI cloud middleware, and the implications of their findings for agents installed by other CSPs #RSAC22

Shirr Tamaru and Nir Ohfeld on RSA Conference 2022

Alon Schindel

@41thexplorer

June 17, 2022

Over 55% of companies have at least one cloud DB that is publicly exposed to the internet according to our research at @wiz_io.Accidental cloud data disclosure is shockingly common and this is why I chose to cover this topic for @cloudsa ’s new top cloud threats paper 🌩

CloudSecurityAlliance

@cloudsa

Have you checked out the new Top Threats report that we released last week? The sixth edition of the Top Threats series illuminates 11 #criticalthreats, risks, and vulnerabilities in cloud environments. Read more here #cloudsecurity → https://e.cloudsecurityalliance.org/l/908632/ 2022-06-15/hg8xn

Alon Schindel

@41thexplorer

June 15, 2022

OMI is back! @msftsecresponse published CVE-2022-29149, a new LPE vulnerability in OMI, the Azure agent that was vulnerable to #OMIGOD. Seems like manual update of the silently installed agent is required again in most cases

https://msrc.microsoft.com/en-US/security...

Kevin Beaumont

@GossiTheDog

Microsoft Azure silently install management agents on your Linux VMs, which now have RCE and LPE vulns.

Microsoft don’t have an auto update mechanism, so now you need to manually upgrade the agents you didn’t know existed as you didn’t install them. https://wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution 

Show this thread

Nir Ohfeld

@nirohfeld

April 21, 2022

Proud to be featured in the MSRC Azure Security Researchers leaderboard once again! This time with #5, always a pleasure to work with the @msftsecresponse team! 🙏 #BugBounty #msrc

Security Response

@msftsecresponse

Congratulations to all the researchers recognized in this quarter’s MSRC 2022 Q1 Security Researcher Leaderboard! For more information, check out our blog post: https://msrc-blog.microsoft.com/2022/04/21 /congratulations-and-new-swag-awards-for-the-top-msrc-2022-q1-security-researchers/ #cybersecurity #bluehat #msrc

Amitai Cohen

@AmitaiCo

April 19, 2022

Sketched the attack flow of this incident as I currently understand it, based on latest security bulletins released so far by @GitHubSecurity, @Heroku and @travisci. Note the smart pivoting on credentials acquired at each stage. Opportunistic or planned?

Github Security

@GithubSecurity

GitHub has uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Read more about the impact to GitHub, npm, and our users. https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/ 

Show this thread

Amitai Cohen

@AmitaiCo

April 8, 2022

I think many early publications about #Spring4Shell / CVE-2022-22965 slightly glossed over the relationship between the underlying bug in Spring Beans and the exploitation path of this vulnerability through WebMVC / WebFlux (1/5)