hi everyone so today we're going to
discuss about aws cloud regulators and
the security guidelines that can be
applied
so
uh before we get started uh that's a
little bit
about me i'm a security analyst at app
cycle
i just love to break my application api
and cloud security
i'm a member of different communities
such as
infrastructure
[Music]
agenda of the today talk is what are the
possible article vectors for the ews
cloud
recognition that help to identify those
articulators
some of uh misconceptions like i am
misconfiguration s3 misconception easy
to means configuration we're going to
discuss today
the detection that can help to identify
those misconfiguration
and the security controls
so what are the possible adapters right
first is lift credentials
second instance misconfiguration like
you found the
snapshot is publicly accessible
ami is publicly accessible of the
instance right
then
pc2 instance having the
cv against it or the particular ec2
instance is publicly available right
those are the instance misconfiguration
in using default settings for example
uh you didn't enable that
for the s3 bucket right there you having
the sensitive information and you know
and enable s3 with kms encryption then
it's again issue because what if someone
get your sd bucket data and that is even
in the playing text right like for
example not encrypted
for example it's having the
credit card details or the
credentials right so
like you should use but one of the
reason it's default setting and
another is like you have
you haven't used the imdf vs2 version
and that leads to the
[Music]
extreme ssrs
like allowing public access or allowing
any user of the ews to perform any
action on s3 right so s3ms configuration
then access control mix configuration
like you didn't mention hey
uh this particular user should has only
this much access and you are ending up
giving more privilege that that
particular user supposed to do and
that can leads to the external attack
vector and as well as internal threat
right
exposure of the resources via firewall
right so
if you didn't configure the firewall
properly you ended up
giving your
resource
access to any user over the internet
that's most dangerous
time network security misconfiguration
if the rppc
uh is not properly configured or your
inbound output rules is not properly
configured right then it's an issue
anyone on the internet can access
right
insecure custom application
so
if the
web application hosted on ec2 is not
properly
configured or it's vulnerable to
like ssrf or lfi then
that's again issue because attacker can
get access to your aws relationships
so you know that hey these are the
possible attack vectors now how can i
find those for that you have to perform
reconnaissance
and i have covered different ways to
perform
recognitions for finding credentials for
finding the easy to instance or to
finding s3 bucket
finding credentials
look for the hard-coded
stored in javascript
and ews cognito credentials in the
response you can find it
if
like
how do you find it i i have attached
this in screenshot i'm going to discuss
how can you find it right
then if the web application hosted easy
to instance it's vulnerable to ssr lfi
then also article can find those
predictions
food repositories such as big bucket and
github
on that also you can find that in public
for example nowadays many companies uh
publicly expose that code on github
that's all right but if you are
storing the credential on the repository
then it's done it's an issue you can
just uh order any ethical thing find the
credential on github and you are ending
up
like
getting expose your credential on the
publicly
repository such as gita benefit bucket
and aws error messages
such as x is denied and in the re
sometimes if the properly not configured
right uh it just uh disclosing that hey
this is denied but your credentials are
this right
so that's issue
publicly bs snapshot
then emi that emi related credential
been lit
in the public images
that s3 bucket is also sometimes
organization stored that employed
credentials all the admin credentials
being stored in this bucket right then
it's again issue
we're gonna discuss an upcoming slide
that how can you find those
then rds public snapshot
in those you can find the rds
related
credential database credential
information
then people looking for help online
ending up copy pasting that complete
information like they say hey i want
that i'm facing this issue this is some
micro credential or user id can you
please help me out and that ending up or
getting addicted that day is
what radiation belongs to this
particular user so these are the
standard recon
techniques that can help you to
get started
with the finding credentials right
so one of the i have mentioned right
that uh in the response
the company top credential
so this is how it looked like
now for the simple
um misconfiguration right so how can you
find the
public ec2 instance right for that you
need to have the access right
so
compute one ew amazon aws.com you
mentioned in the census and you will
have the list of ec2 instance and see if
this is those other ec2 instances
publicly accessible right
and you can use google doc
you can use
showdown as well same search
you can apply
and you can customize the result based
on the
what you want right so very based on
that
accessible to
uh this ip address right then
and therefore there is no prevention
against it for the ssh right then you
can just do a ssh on that particular
series
same way you can access the mysql
database also
now you must be thinking hey
how can i found the rbs endpoint
basically you can mention scientists and
rds amazon aws.com so use the google doc
for finding s3 bucket you can use google
search google doc showdown
senses
use osm tools such as sublister and amaz
of meaning like very standard phase of
for test bucket right naming convection
is that
s3
like site s3 amazon.com
right r
s3 amazon
s3 site amazon ews right so these are
the standards so you can just uh propose
it
or in the dns record
right you can also find the sd bucket
related information
and
certification and transparency law
time you can use
numerous bucket or finder scripts such
as there are so many uh scripts
available on the internet such as
laziest pocket file
right so you can use those as well and
greyhead what bucket sauce
you can use to finding the extra bucket
uh i have mentioned that how can you
find the s3 bucket using google docs so
this is the way you can find it
after knowing that what are the other
factors and how can you perform the
recurrences
uh you should look for the
misconfiguration related issue right
so one of the
i have covered is misconfigured s3
bucket now
why it's a misconfigured because
of the policy okay so one is this you
are allowing public access to any so far
explicitly you saying that object can be
public so anyone on internet can access
this
bucket
most strangers one is defining full
access to authenticate aws in source
group
so i think anyone
with having the valid ews credential or
the authenticated user
can access my bucket and even perform
copy read
and delete operations so you are
basically affecting whole cia triangle
right so it's most stranger one
policy to be then bucket policy with the
rate access policies so some
organizations say hey we have allowed
access policy but you are having in the
bucket uh the sensitive information such
as pia or the purchases to information
are
credentials itself right so you should
our bucket with the read access policy
then you almost forget about encrypting
your aws duplicates so for example
the bucket having the sensitive
information
and someone got access right
and download the data like purchase
history of the credential and your
bucket is not encrypted then they can
have the whole bunch of the credential
that has been stored or bi information
or credit card details
which is stored in the
bucket but what if you have applied the
encryption technique then even though
they got the bucket
but they are not able to
get the data that hey what are the data
available because the article is not
having the master cape so you should use
like
so
what attack vectors we have covered for
the like why i still miss configuration
happened right so far
so allowing public access to bucket
defining full access control to
authenticate it in a place in your group
defining bucket with the raid access
policy
enabling the right access to everyone
group
forgetting to encrypt your aws resources
now you've got to know hey this happened
now how do you
investigate or what
can be done to investigate or what
configuration or what services can be
used right so guard duty help to finding
s3 will list an s3 bucket and bucket
arn and even the bucket owner
in the finding details so you might have
the fair understanding okay uh
what's the arn of that particular bucket
and who is the owner of this bucket
right then you can use aws cloud trail
log like at what time the request being
made from which ip the request being
made right
uh you can use trusted advisor
if you configure
your s3 bucket right and you have allow
the public access that if
this is not how you configure right
then cloud watch metric is again the
best you can use to get the alert right
for example uh
that is get request happen put requests
happen all the delete requests happen
uh for your s3 bucket cloud if you
configure the cloud watch metric then
you will get the alert that hey this is
a request being made from this
particular resources right so it's good
to have enable contact
the aws manage rule there are two rules
you can choose s3 bucket read prohibited
and s3
bucket public right probability based on
what
applicable to your
organization right so based on that you
should configure
all this
now you configure all this but how do
you investigate that hey
this s3 misconfiguration happen how can
i investigate so you should have proper
logging mechanism in the place
now after investigate or all the
alerting in the place what security
controls can help to prevent
from the estimates consideration
implement list privilege access right
don't allow any authenticated user or
any public user to have access to your
sd bucket
use im rules for application and the aws
service that require amazon s3 access
then enable multi-factor authentication
at least for the delete operation so
even though attacker
got the credential and able to delete
your bucket but he might not able to
uh delete your bucket right he can just
only get the data so availability part
will be not being compromised
consider encryption at data rest because
even though attacker will get the
bucket right but the data itself
it's
encrypted right so and the article is
not having the master
so this is how it can uh prevent your
confidentiality
and closing ssl no standard practice
consider vpc endpoint for amazon has to
be accessed for if you are having large
organization or any organization and you
are saying that hey this s3 bucket only
accessible
this organization employee so you should
uh consider mentioning vpc and right so
as i mentioned that is the bucket having
sensitive information it can be having
cloud reload as well right so
yeah one of the things
consider sq object log
so
it prevent
being the
like object data being deleted which is
present in a script right so s3 object
log
pre-signed url you can
assign to the authenticated user so only
the
user having pre-signed up can only
access this estimate
most
preferable
then enable versioning if any change
happen that new version will create so
this is how can you track the s related
operation
second is you found the credit show okay
you might be thinking hey i found the
credentials
am i just supposed to pilot or say hey i
found the direction that's it no you
should enumerate the permission
so this is the standard flow
i follow
got the credit check i try to integrate
the permission and see what
kind of access i'm having right although
what kind of access i'm having using
victim credentials
if i'm having any extra bucket related
or they see two instances and try to get
sensitive information
after that is that having anything that
i can perform the privilege escalation
yes so this is you should also taking
care of it
if not sensitive information is that
policies uh not assigned properly to
that particular user
and if i can perform the privilege
escalation and get the sensitive
information so this is what your
attack flow looked like when you got the
potential
so yeah uh
as an article i got the victim
credential
now try to enumerate the permission and
found that
the user having the i am related and the
user can list anything
but what interesting to me that
is having sts permission okay
but still it's not having like i can
have the access to s3 or just download
the data or do what i want to do
so
what can be done
so
we are aware that uh
we can use the sds so try to get who is
the user and is there any policy
attached to that user right
so yeah this is the way i found the user
and the policy being attached to that
particular user
then try to get the policy and see what
kind of policy it has and
what is the default policy so default
policies version one
then list out to all the policy
available for that particular user so
that might having older
or the misconfigured policy or the
overly permissive policy that might help
us so you should look for all the
possible policy
so we found that hey there are five
policy available
then integrate different policies so
that you can have the identity what kind
of access you have so previously we had
the get and list permission but we found
that hey if i having the admin level
access why admin level because action
start resource start that
explicitly saying that you can perform
anything on any resources so admin level
access
now at again send me hey
what can be done
make this policy as a default policy
right
so
[Music]
i just made this policy as a default
policy and
no error message came so
we sure the idea we are able to make
this policies a default policy and the
privilege escalation happen how from get
to the
uh read write
and update operation
we have right like you can do anything
on any recent source
uh this is the poc for that like how
what kind of
privilege i got after making that policy
as a default policy
so
yeah
so what was the approach so far you
found a hardcoded credential like one of
that effective was you found the hard
coded credential you try to integrate
the permission when you got to i am
related access you try to enumerate the
policy
and
one of the policy was having only
permissive permission
uh like admin level access and
and we tried to make it as a different
policy and it was success so
when you find the credential and that
was not having the too much access don't
give up see what else you can do so this
is how we can go beyond
uh one of the testings
so after
so i have included the poc that how can
you do
the same
actions from the management console
basically i am doing the same
thing from the manager management
console
see this is the week four here having
the admin level access and i will try to
make it as a default policy and see the
permission now i'm having
is a admin label right
so
now all things you found that hey
my credentials been compromised
uh this policy was only permissive right
so
to avoid this right so what can be uh
investigation
or the detection services
for the investigation or detection
purpose you can use the services or the
tools to identify
or to get alert right so for that you
can use trusted advisor or the check i
am threading should report to check
or like
when the last credential being used at
what date at what time to use right
then
use im tools such as i am policy
simulator so that you can just see
like you can simulate the policy and see
what kind of access this user have right
use config rule to uh see what are the
policy in the use that so you can i use
this rule i am policy news that conflict
rule that checks whether i am policy arn
is attached to i am user right i
basically specific this
poly uh rule because this is uh relate
to our attack
scenario right you can apply many rules
i just mentioned one of that
then you can use access advisor
to
get the information about a last access
information right and what kind of
access happens
use crowd rail for the logging like api
request obviously being made right then
at what time
from which ip has
been requested right so you will have
the login information for investigate
and analysis and to take step further
you can use uh monitor cloud watch
alarms to prevent or
to get alerted in the future
right
so for example you can enable for group
logins if any i am policy changes happen
that is also you can record
right so you
get alarm that hey this policy change so
you can directly perform action in this
case policy change
and i made it uh admit so you should
just uh hide the uh
cloud watch alarm active that you've
been notified for saying
then seeing unauthorized api calls
happen then
i mean you can
bring alerted cloud configuration
changes happen
authentication fellow all these you
should be taking care of it
now you are being alerted and detected
hey my credential being clicked or
compromised
you will be like what should be done
right so for that
you can just basically create the new
credentials
and disable the previous compromise
credential and remove it but making sure
that you are
first creating the new credential
and then uh
make uh
deactive
the older credentials so that if
if you directly remove write the
credential
then you
you might be your website maybe break
down or not uh
like web application will not work
properly right so making sure that you
follow this standard
approach
so so far what we have done that uh
we create the new credentials disable
the older credentials so that no longer
used to your access account
apply list privilege to that particular
user and our creating user with
accessibility
now security controls that can be
applied to prevent
from this kind of issue use secret
manager to store your credentials
securely grant list privilege access
use access levels to you i am permission
right
configure a multi-factor authentication
for your most sensitive information like
delete or
removing the cloud rate
of cloud tray configuration changes
right
and you will multi-factor authentication
rotate your credential accurately
and ensure log metric filter alarm
exists for im policy so you just get
alert and you take the action
right so these are the controls you can
apply
now another scenario i have covered that
what if you found the public id
now how why i'm finding this right so
a possible is
a
misconfigured firewall happen
right no properly inbound outbound rule
has been mentioned so that's why c2
instance is publicly accessible to you
now you got the
public ip of these for instance what
should be your next
step look like right is there any
default configuration being used
is there any ports are open
is web application running on this
particular ip
this is uh you should must look for
right
uh i will uh give you overview why
because i have covered one of the
scenario
so
okay so i found that uh um i got the ip
and this particular ip having the web
application running on port number 80
but it's saying that url must be string
not defined okay so i thought that hey
something
url parameter being used
so here i say url ifconfig.com
and i got the
ip address
okay
so i said okay this is vulnerable to
ssri
okay so
but you should not limit selfie hey i
found the ssr if your application is
vulnerable to yourself you should start
digging into it uh this particular
vulnerability that hey web application
vulnerability
is it's posted on ec2 instance
okay rule is attached to it and try to
get the ibm role credential on on see
what kind of level
access you might ending up finding admin
level or s3 bucket data so this is how
you escalate uh
security severity right
so here we did same and we found that
hey uh
this is what the role attached to it and
this are the security credential
after getting credentials enumerate
permission and we found that hey
ex3 related permission and that also
having the credit card details and the
admin
credential in it right so you just using
command to
copy all the cat data in your system and
i was able to get the admin data right
so now you can think of like what kind
of
access i am having as i mean so
just moving to ip to the admin level
access right
so just let's do a text surface analysis
why this happen
one of the factor default configuration
setting usage like you are just allowing
to
easy to instance
publicly available misconfigure firewall
web application hosted on ec2 was
vulnerable to ssrf right like no input
validation uh
was there on the web application
rule was having uh
two access to work with the s3 bucket
and the data storage in ews s3 was not
encrypted so for example even though
article
able to get the s3 bucket but if it's
encrypted
how do he get the
like credit card details or
admin credentials right so that you can
you could have
like prevented
sensitive information being stored on
extra bucket you should not exactly
store the admin credential or any source
credential and save
okay so you may feel like hey this is
most similar uh sound to like capital
one
yes so in the capital one bridge the
similar scenario was that misconfigured
firework attacker was able to gaining
access to an ec2 instance and uh
that is vulnerable to the ssrf and
gaining the
im rule that is x
that is allowed to access sd bucket and
in the s3 bucket he found the credit
card details of the users like millions
of users
so for this particular scenario what was
the factors web application hosted on
instagram
is vulnerable to ssrf
uh imdb imdbs version one being used in
proper market policy storing sensitive
information in
the bucket forgetting to encrypt s3
bucket data right
so i can summarize that misconfigure
firewall
right one of the attack vector
s3 miss configuration right why is
configuration those are the explanation
for that default setting uses see
and the
vulnerable web application
this is available to us so this is how
the you can correlate the articles
like
in future how can you detect right so
you can use the duty
uh if there is any see to
misconfiguration or compromise happen
guard duty will it
like help you to identify
conflict rules that uh specific foreign
base version to check
it basically checked that
if ec2 instance metadata version is
configured with the instance metadata
service version 2
right so that is the most
important thing to prevent from the
getting
i am role credential
then security hub it will just give you
whole analysis
help you to identify that uh related to
config rule i am access analyzer
all the findings you can get in the
security hub so you should use security
about flow locks like to see like ppc
logs from where the traffic is coming
from by
system manager to further properly
configure ec2 instance right
now you are aware that your easy to
install is compromised but what step you
should take right
for that invalidate your temporary
security credential immediately stop
compromise easy to install take this
snapshot of the eps volume so that uh
and deploy that particular instance in
isolated environment that is
being compromised
isolated basically
new internet access and ideally private
subnet
and then read through the logs to figure
out why
right
to prevent this kind of attacks in
future or misconfiguration in future you
can use the input validation to prevent
from ssrf
update your aws ec2 instance metadata
services so even though it's vulnerable
to ssr if you are
still the user will not get the improved
credential right then implementalist
privilege permission
so that
the
attribute will have the least privilege
access
consider encryption of data address
i'll mention that why i mentioned
then constantly monitor only permissive
security use
groups use your control driver for the
separate logging activity and normal
account activity
security groups buy its matter because
you can just uh mention that only
the user which are present in the
security group that only allowed to
access this ec2 instance so you can
avoid the publicly
available easy to instance
and
why do you separate logging so even the
article got access to your
credential but
he
or she cannot remove the
cloud trail or any logging mechanism
and then use security hub
i
like to have the whole analysis on it
so
things to not that
to get to know about the attack vectors
right you reconnections and the os end
are the key to finding those added
vectors
post exploitation has no limit with the
cloud so you should like uh keep looking
for the attack
additional services like destroy
blogging and make code changes to
attacking source right like uh
like internet security teams can check
what can be done so that in future what
if we are traditionally being
compromised and another outsider
attacker do
anything with your services right
so
yeah
making sure that you always apply that
least privilege access to
any user role group
so that you at least avoid the attack
surface area
and the most common things we have found
the misconfiguration of services in
secure programming practice and
insecure permission
like what permissive
policy has been there and that leads to
the whole
account takeover
fall and
mustang the follow ewa security best
practices
to avoid or to being prevent from
being
compromised
or any
we went from being getting rich in
future right
i just mentioned some guidelines and
tools that can help
so
these are the guidelines uh aws white
papers having the good documentation
around it
aws security audit guidelines
then scout suit for the
automated
cis
auditing right benchmark auditing for
the multicult multi-cloud
roller is basically
automated auditing specific for aws s3
inspector to analysis what kind of
permission
having
right like you got the credential and
you want to see okay what kind of you
don't want to go manually you can just
use this tool and see what kind of
permission
you have like it's publicly accessible
or it's having the authenticated any
authentication user can perform any
action right so it will give you
information around it enumerate i am you
can just illuminate the
what kind of
user like what kind of access the
particular user having and paco for the
penetration testing purpose it's a
penetration distance
if any question i ask
question and answer
i'll move on for the question and answer
and you can connect
in another