uh def conclude village for having me
here uh we are going to talk about cs
pam to cloud trail uh my name is is
rodrigo montoro
my handle is poker and my twitter is
poker labs i live in south of brazil
florianopolis and i work at tempest
security as research and detection
engineer
the motivation behind this research
is something that
we
that we need to improve our
cloud detection in ours in our secret
operation center
and since you have a lot of different
customers we start figure out like how
you could do something that will fit in
mostly out the customer without needing
a lot of context
and and so when you start to think and
brainstorm about that
uh we we get
what uh we get splitted in two different
parts like so you have the
threat detection that's something more
complex i could not
and something
related about misconfiguration
and that's something more more straight
to the point
and our agenda like we were just do a
before review about the
cloud attack uh cloud attacks uh
cloudtrail and cspm a very
short overview and talked about the
research and some future work we are
figure out
to do
and so cloud attacks like
i think like when you are on premise
we have like a kind of perimeter and
this parameter is something that make
things inside the perimeter safe
like you could do a lot of
bad configuration not follow hardening
stuff
but inside your perimeter that's a let's
let's call like you have a fire and you
have the internal and external parts
you you have your data your apps your
servers your containers or whatever
and
i could not access
from the external part unless i have
some access and other other things but
i'm comparing like something by default
like if i open a server i i
i i i pick some share in my server and
operation to anonymous for example i
could not access from outside by default
and companies are doing
and migrate into the cloud so what they
are mostly doing they are doing what we
call lifting shift
like they
they do they they they worked on the
same way they worked on premise and they
put everything on instance and other
things and they mostly though
doesn't work with the the cloud native
stuff in the first instance but the
problem with that and that they are
doing the lifting shift of the security
of the protections of the data source
that they need to monitor and when you
are moving to the cloud
you'll have a new attack surface and
your track surface is born and what is
this new attack surface that is really
really important to monitor that if
you're on the cloud if you're in the
cloud like it's the most important part
to monitor
is the aws api
or the control plane
and
and it doesn't matter like if you are
a devops guy uh
some automation or the malicious guy you
could from there do a lot of things you
could access the the the information you
could change the
the infrastructure you could open stuff
you could like
start something some crypto mining and
all that things like you have control
especially because we're not going to
talk about that like the
over permissive uh
policy and that's that's another subject
to talk another day but that's one of
the main problem in the cloud and so
that's been being said like we have
something as i mentioned before i like
and so you have the threat detections
should this specific and you have the
misconfiguration detector
and the threat detection is something as
i said before is something a bit more
complex and we're trying something about
like uh a kind of chain attack chain
like the user will log from somewhere
different maybe try some enumeration
from the numeration you have approval
escalation and so you do this filtration
and so you probably need to have some
kind of combination of acts to figure
out like its attack or not and something
like simulate a pacu framework and see
what what's happened and we have the
misconfiguration detection and the this
misconfiguration that act if you pick
the the right fields and information
it's something more
one one two one like one one one event
you could probably have a detection and
that's uh where we are
are fitting our our research
and there is three type of activity you
could say and those activities will be
like could be the good the regular guy
using doing good things following the
baselines
using the best spreads and so on
and so you have the bad intentional
something like you lick the a key and
from the key you start to to do some
while while you have access to do like
you could like
access some information
try to realize collision and other
things
and you have the
the bad non-intentional and the bad new
intentional
is where the the dangerous lives because
it's something like the guys that's
that's supposed to have access have
access and are working on the daily job
doing something that's not following the
best spreads and the the
the the
our
our our main goal here it's exactly on
that because like if you
uh try to find some misconfiguration
here you'll probably find for for bad
intention too because sometimes they're
going to open something or do some
things that is the same but we don't
want you stuff to
begin wrong and so like this kind of
detection is cool and it's that's
why it's something most almost in real
time
and so when you do that you're opening
your account
for
for other other other people other other
access or something else doesn't matter
and there is
two kinds of
misconfigurations some misconfiguration
that who you provide direct taxes you
need nothing to access
that and
and and and could be something like an
s3 bucket
oh uh
a snapshot ebs snapshot could be a
security group that you open a part to a
server that's running in some instance
that has no authorization and
and
on authentication and they will have
access until this kind of of stuff
open your account to the root direct
taxes i don't need nothing nothing more
and you have like the
the second stage attack and you need
another vector
and and and and this vector could could
be like uh
oh access to ac ec2 instance a server
start request forgery oh an access key
or a user and password
like yesterday
uh
phillips poses pro tills uh talk
uh talked about a lot of different ways
to find like so many
entry points that are put are public
based on on research that aws that could
be disposable and this kind of thing
uh uh most of the things that he he told
like fits on the second stage like that
he'll have the entry point open but
probably first red shifter for
for rds or
you need like some some
some extra thing like a user and pass
but he he mentioned that your
elasticsearch open so you have direct
taxes
and and this kind of things and so that
those three type of
activities that the bad new intentional
is where we are looking for and so to to
give context to that like let's let's
do a quick view about the cloud tray and
so the how quality work mostly like
whatever you do in your control plane
uh you have aws management uh you have
the sdk that you could develop something
you have the cli that's very common tool
to to use
any of them will connect to the api and
and is executed the actions and you have
like nine
nine more almost ten thousand actions
currently and so like everything will be
logged most of everything right with
some exceptions
and and so it will be logged at
cloudtrail and how it works it's re it
will record everything it it has a a
simple json format and that's why it's
near real time because it's have a delay
to put to s3 if you're using a s3 and
you have a lot of different field but
mostly you have a json like that that
will tell you like who did that
when he did that
what he did and this started to be
interesting for detection
and from
and the what parameters and so the
combination of what and what parameters
it's where going to look and figure out
like let's see if something is
is
is being created
with the full misconfiguration
right
and so
how we figure out like what we should do
what you should be using so
we start to look on the cloud security
password management tools and we look at
cloud splits and cosplay to us created
by method fuller that
the project the company was acquired by
aqua security and one very interesting
point it's a multi-cloud cs pin
and what that's mean that
we are talking now about cs pm2 cloud
trail but you could just change your csp
to cloud detection stuff
because
we are focused on aws right now but
since it's smooth cloud it could work
without the clouds or the provider that
he has you understand why you want to
use it because you have a lot of
data ready ready to go and so if you
look on the cloud supply checks we have
the alibaba we have aws and we have
azure github google earth
aws more than 300 that's a great number
a lot of work to do and not a hundred
percent could be converted in some
detection
but this brings us like a total of
735 possible
detections that's a lot like if half of
this works that's great
we don't need more than that and the
check was like uh a week ago
and
what what what is those how those checks
bring to us a lot of metadata
and those metadata has a lot of
information you have a title you have
where the services fits like some
description some have some more
information we have linked to
documentation you have the
the recommendation access action so you
could figure out oh if that's this
happened like do that and so like if you
create some detections you already have
the answer and you have the code that
you could just look and figure out
better what what what they are doing
to to validate that
and this brings us to cs pam to cloud
trade research and this research it's
something where
we're putting a lot of times uh we're
we are working on on on to release that
and so like i read i read saying that
we are going to release like in the
middle of september probably now we get
reverb so follow us we have a bunch of
cool information and we are figuring out
like the better way to do that
and that's being said like what what you
did like the first stuff like we create
a cvs about the cloud support
information pick out the metadata what
you need to do here is to add the
severity so you could have like some
some better like since you have like 306
checks on that time
uh we we would like to have something
much better i like like for
prioritization so it creates this
severed like
and based on our concepts there is there
is no magical rule here
and
what he did we started to do some some
cards
and so
and so we have the the rule we have the
severity we have the the the impact
that's something we had like because
make the the because one important part
where i talked about detection like
having
more metadata more information make the
the the
security analyst life easier and that's
very important
and so like from this we want to create
this and this is the first version like
using splunk but
our main goal is to have like some sigma
rules so
you could convert to any scene you're
using but since our customer most use
splunk and our
biggest engine inside the security
operation is splunk so that's something
that
what i'm going to do something different
than that
and
how we could like uh start to create the
payloads
to make sure that we could create
detection and so simulates all things
let's create
let's create our aws miss configuration
server could do
and for sure you're using a a lab
account and we are creating and
destroying but that's kind of thing that
could be have nice to have a tool
uh to simulate all this misconfiguration
and so could have something like cspm to
writing automation or
something like that that could be very
nice because you could simulate like if
your enforcement is working you could
simulate like if your stock operate a
secret operation change is working if
your detection is working and this kind
of thing and just to show some proof of
concept about the research
that i said still going and start with
aws
uh we we create a a public history book
detection um true
we create uh we showed here a vpc and
the point exposed
the public ebs snapshot and the thruster
account relationship
and the very first is talking about the
public s3 buckets
and and so there is two rules there and
so we create one like the the detect
that put bacterial and the puck debugged
police just to show like if they are
changing through something that's uh
to anyone who you are you're sure that
you're detecting
sure that when you're going to release
you'll probably have some extra rules
that's not exactly relates with this
rule but something like you could create
across accounts
and then and so you could could add a
principle here like another aws account
and so like for example that and game
tools that's a nice tool for kind of
mcquade works
and it will not make it public it will
make available to your account and so
this kind of less noise stuff and so
that's something you need to pay
attention but here i just want to show
the sample and so like gray hat warfare
it's here to show you that
that uh you have a lot of information
available already and and that's insane
because they follow it like for a long
time and you say like aws
uh releases a lot of tools through the
text this and it keeps growing that's
insane
now the vpc and the points exposed and
so
here in this we you create like
uh when you create a vpc to detect if
the state principle and state research
is it's going to start
and
and sure there is another vector like
because like if we talk here about
when it's been created but
you could go there in and use another
another action as the
modified vbc
endpoint and we'll have the same result
and so as i said we are going to focus
on the
the most possible case that how you can
expose something
and scott piper has a nice paper about
that i forgot forgot to mention that
and there is a very great talk here
uh talking about that and scott piper
has a paper about this too not about on
the expo exposable service but about
this too
so i really recommend you that's open
your mind see like how dangerous could
be because sometimes we don't have
this
we could not figure out like how
dangerous that could be but this is kind
of second stage you cannot abuse this
like
if you are not inside the the perimeter
uh public snapshot ebs snapshot
that's something like here is another
simple like you could just modify the
snapshot
attribute as far as you could not create
it public you need to modify so that
will be probably the only way
and you add it things group to all but
and but there is another modifier that
you permit an account and so that's kind
of thing that prevalent game abuse and
something that you you need to have two
rules you have two rules and i'm just
showing you one
and there is a great talk from fight
secrets and pub public explosive ebs
like from defcon two years ago
and the trust cross account rule the
trust browser control it's it's it's
very very danger
because
when you cross account with some account
you are you need to make sure that that
that that that account is is safer too
because like if you put excessive
permission and cross account like your
account as safe as the permission you
give to the to the non-safe account and
so that's something
that you really need to understand and
fix i didn't write here but now last
year's uh legendary talk here at claude
village
that the suspo calipsie that he
explained like for 40 for the minutes
something like that the how the the
cross account works and some
some ways to mitigate that and so i
really suggest you to watch that too
and that's being said like some future
work
uh
uh we're going to create more aws
detection we'll start to gcp and azure
mapping too we and more focus on aws
maybe some affinity
queries and provide sigma rules that's
something we have in mind
but that could change like when it
starts to work
that could change
and special thanks to celso from tempest
tempest kaduke and archie and matthew
fuller for reviewing the the coffer
papers that helps a lot
and that's it guys thank you very much
for having me uh those my my contacts my
twitter handle the company handle i
really suggest you if you're interesting
about the content
to follow us
and so you will probably provide some
good content in the near future thank
you very much