hi everybody
thanks for having me here in clouds
called village
and let's begin so
about me bill everybody my name is
felipe esposito and also known as
proteus i'm secured researcher from
tenchi security
it's any startup focused on cloud
security
there is my handle in twitter and my
email address from described below and
i'm from the beautiful and dangerous
city of the rio de janeiro
brazil so
my motivation for this talk
every other day we have some data leak
mostly because of some s3 buckets were
misconfigured or
anything related like that but there's
nothing wrong with s3 buckets getting
that much of attention they are probably
the most prevalent and easy to find
misconfigured aws resource
on the internet and it stores a lot of
data
so
yeah in
greyhead warfare is my weakness there
are at least two three nine four
thousand public s3 buckets holding more
than six billions of documents and
that's a huge amount of documents right
yep
but
aws has uh other services too
and some of those sources services can
also be misconfigured and exposed to the
internet as well
and today we are going to talk about six
of them
but uh
first
uh in 2020 scott piper published a list
of aws exposable resources on github
and this list has a
20 or more exposable resources
and that can be exposed to the public or
to another aws account
the list is on github it's pretty easy
to find it's pretty easy to anyone to
understand which aws api you have to
reach to
or request to expose that resource and
based on that list we choose some
services to understand a little bit
better try to hurt them
a little bit better about that service
and try to hunt them on the internet
so another pretty interesting project
was end game from kenai mcqueen
he released a new two earlier this year
that was capable of backdooring aws
resources by making it public or
exposed for another
aws account or an attacker account
and this kind of dues it's helpful to
show us the impact of a backyard aws
resource that can be
can that you can have on different
environments and it helps blue teams to
create detections for that
so
uh cheers for mcquaid for doing that for
us
and in 2019 ben maurice did a great job
by analyzing exposed ebs volumes ebs
volumes are like
are hot black hard drivers
when you're attached to a ec2 instance
and
you start things there right and for
those ebs volumes they can be shared
with another aws accounts and make it
public on the aws
so
he did a great job by analyzing those
public ebs and he was able to review
some secret test source codes and pii
stuff
but in order to to carry to to find
those ebs he just had to carry the aws
api for to to get a list of those
resources so it's what kind of kind of
easy to find those resources
so he did a great job he did great talk
had some challenge to solve and he did
it pretty well
uh so congrats for him
but
uh all those exposed resources and data
they came from uh
somewhere
i'd like to say sorry
first because as some gymnastics at the
olympics have some obligatory movements
uh we do have an obligatory slide to
cover before diving to aws manage
resources and that is the shared
responsibility model yeah unfortunately
okay so the shared responsibility model
uh dictates that aws is responsible for
patching updating and maintaining the
management and resources
and the customer is responsible for
configuring the resource policy security
groups and for their secures their data
so all those data that i found on this
research was
only possible because customers failed
and protect their own stuff
and
just some stats so
pretty quickly i was able to find at
least 20 public read
sqs qs
19 public right sqs
are also able to reach more than 690 000
cloud research cloud search documents
more than
at least 30 unclosed active meq and more
than five terabytes of exposed data on
the logic searches itself
and just a little bit quick disclaimer
and it's important to note that i didn't
x any of those data i just counted the
data that i was possible to count
without touching it so i don't want to
go to jail
and
that's it
so
for the data source which data sources i
choose to try to find to hunting for aws
services
well
i choose two data sources for pacific
dns risk aq the community one and
security trails security is 50 bucks
it's not as expensive
so
yeah it's a good source
i have some other things techniques like
way back machines domain enumeration and
code repository
so for a cold repository one thing that
i did and was pretty interesting is to
get the shh git project
it's a project that
is on github
and their objective is to
it keeps carrying the github api for
trying to find some secrets uh
credentials passwords that were leaked
when a developer commit the code to the
github
so i just modified to find
aws endpoint services
also i had the idea to use the google
cloud big carry to search for aws
resources in a public data source so gcp
has a public data source from
github and
it backs 2019
and have more than two terabytes of data
so uh it seems to work to checking out
right and finally i wrote uh some python
scripts to carry the github search api
into point
and the problem is that uh the
the api endpoint is only comes back with
the first
first thousand resources results
so i had to play a little bit around to
implement some tweaks and darks to get
enough relevant data
but the good side the advantage of
carrying the github is that some
resources can be protected by username
and password and sometimes developers
make the mistake of committing them with
the codes they are they are writing so
it's worth looking into
sorry
and
for subdomain enumerations uh i read a
really good blog post from hika durama
he wrote an article uh doing a
comparison of nine sub domain numeration
and based on those findings i picked the
following for this research i choose to
use find domain and ms a mass from
velocity it's capable of getting uh
information from several sources like
way back machine gns dumpsters and
wrapped in the dns for instance
so and we also try to use scheduling
senses for a few specific cases and we
show in the results to the resistance
likes to come but now that was not that
successfully
and by discovering the data sources uh i
tried to use set string
to try to identify some
unique
urls but as we are going to
to see that aws is using wildcard
certificates for most of the services
which makes that string of no use in
identifying uh individual host names
but
as we are going to perceive during the
talk that most of aws resources has a
hidden component in the dns
and that must prevent from brute forcing
but the set is string we can see the
handle the handle part on certificateds
so we only needed to find the name
provided information
when you create that resource
but that would be like a brute force and
a shot in the dark and brute forcing
wasn't in scope for this research
and i didn't try that i didn't went for
that way
right
so uh i do have some metrics here
uh
i call it valid dns when the host name
his and when that i got a first name any
hit opens for uh ipad address that means
that resource on aws is too active
and i call it public ip when that ip
resolved from the previously url or not
in the rfc 1918 on the private ranges so
uh
yeah i chose these two metrics to decide
uh which data source would be a good
one so the first many services that i i
explored was the commit db
and i know that we can't access directly
access the community b from the internet
because it's always deployed in a vpc
and that means that we need at least an
ac2 instance
to inside of that vpc to connect it
first and make a tunnel through it to
connect to the document db database
but i was able to find
some instance on the senses that have at
http proxy tunneling the document db
to the internet well people get creative
ways to expose their data right
yeah and from documentdb and those data
sources for example uh what i call
starco github it's the github from the
big carry
search and then i got seven unique
results youtube search by carrying the
api i got 117 a security trails came
back with 33 results and passive total
with just one from risk iq
but the the true results are that only
37 percent of the dna the the domains
that i found was valid
so 62 of that was old enough for us this
was not valid at all
and the most percentage of valid dns
came from security trails followed by
github carry so passive total it's just
a little bit
another service that i tried to
explore
was the amazon eq
and when you create an amazon enemy cube
by default you have to two kinds of them
eqs to choose to two kinds of cues to
choose you can choose between rapture
mcq and activity queue
when you create an active maq
but by default it's created inside a vpc
and it has a security group to protect
it
so it's not directly exposed to the
internet
unless
the administrator changed the security
group to allow zero zero zero inbound
but when you create a rabbitmiq
in the other hand it's all exposed
directly to the internet so it's only
protect by logging in password that you
create when you create the webgmq
right so i was able to find more than
four thousand
uh rabbiting queues in showdom
and
that's pretty straightforward
and
for the rest i was able to find around
1500 uh a mass find domain two and stock
github five on github search and 145 in
security trails and none on passive
total
but well this is the print screen from
from schroder
so just uh we have a 116
600 only for our usc 21
and it's pretty straightforward just
click it on
if you know the username and the the
password you can just log in and and see
the queue
right
but well
but what about unique urls
uh we found around
to 200
300 around something unique urls but the
most valid unique roles came from ms and
phi domain
if you check
whose lights before
msfi domain has 563
unique urls and security trails has 145
but when we get when you check for valid
urls security trails is almost close to
ms and phi domain
so
yeah and and you remember that when i
say the hfmcu that you have to change
execute group to allow zero zero zero
inbounds yeah we found at least 30 cases
where the admins did just that so i was
able to access the console of the
activemeq
by just
doing a http get on the url and the
party par2h1 me 62.
yeah well
another
uh managed service that i tried to
explore was amazon cloud search
and amazon implements
an elastic load balance in front of the
cloud search
so
and one interesting thing to note that
uh
the cloud search you have to choose a
name then came the random
stream the region cloud searching amazon
aws from the url so looking for that and
show them i could reach at least 38
000
uh
cloud search
servers on the internet but in
chardonnay jones you only have the ip
address so as amazon implements a last
load balance in front of it without
knowing the dns
we are not unable to to get the correct
v12 host
which leads us to only a mass github and
passive then yes as data sources
and
for those data sources
i tried to check if the nes was valid
and and try to do an unauthenticated
research for letters e or a
because i choose those letters because
they are really common in almost all
languages and if there is the resource
policy of the cloud search was set to
star
i would be able to
carry those
those letters
right
so yeah
just checking by valid dnas i found that
security trails was the most privileged
with more than 30
a mass fan domain around 10 and passive
the mes if only two
valid dns but on those 42 valid dns that
i found i was able to reach at least 609
000 documents so it's a
huge amount of data
right
well
and another service that i tried to
explore through explore was amazon sqs
and amazon sqs are exposed by uh
url so it's kind of tricky because if
you have an url uh all the
sksregion.amazonaws.com are valid they
resolve for our ap address
but the queue must exist might exist
here or not so
that completely er
makes passive url your subdomain
enumeration technique is completely
ineffective
so we only had historical github and
github search to try to hunting for
amazon sqs
and by doing this research i just found
that
more than 450
urls from github historical
was not public so i couldn't read or
write but i found that at least training
was public readable and at least 19 or
19 of that
sqs are readable and writable
this interesting part of the public
readable is that you can intercept the
messages from their pipeline and perhaps
get some important piece of information
and for those who are publicly writable
it can lead for more serious
vulnerabilities like ssrf
or any remote cause execution by just
depending which part of the code will
consume the messages from the queue
for instance if we have a lambda
with some kind of vulnerability and we
will be able to write anything that we
want
unexpected to that lambda would be
might exploitable
and the other services that i
i tried to reach was amazon red shift
and amazon redshift to uh it's like a
a post-grid database like a cluster of
data warehouse
and also uh amazon exposed red shift
through genius entries so
every time amazon exposes something as
the neic entries it's like uh one two
one
for
dnas in ib address when it's by
a last load balance you might have two
ip address or more for that entry so
it's kind of easiest to find uh amazon
red shift so
to public expose a redshift database to
the internet you must
one create an elastic ap address and
then configuring the red shift to use
the elastic ep address to train to use
that elastic address you created before
and then you have to change the security
group to a low zero zero zero zero
inbound
for red shift uh amazon fine domain was
able to find only 42 results
start co git hub only seven github
search around 192 and security trails
226 pacific total only two
but
checking by if they are valid or not on
the
nes
mostly the part of security trails were
valid
uh that is a ip address that resolve to
that
dns
and for github care it's
less than a massify domain so ms5 domain
was able to find that 19 percent of
valid dns by source instead of uh
github carry
right and
one interesting thing to note
is that
sorry
there's a thing to note is that
i couldn't find any
uh amazon red shift public exposed to
the internet so can i hear an hallelujah
yep
at least one good thing
so and the last service that i tried to
to find and trying to explore was aws
manager elasticsearch
and when you create an elastic search
you have to choose if you want to create
it public or inside a vpc when you
create it inside a vpc you get the
following host name you got the vpc
that dash name dash random stream
that dot region dot a yes amazon.com and
when you create a public one
which means that they're reachable from
the internet
you have the host name like search slash
name random region yes amazonws.com
and
elasticsearch is also exposed through
a last load balance so we needed to know
the name the exactly name from the host
to to get the
executive host
and for elasticsearch you can also
choose uh the type of authentication so
you can choose between cognitive based
galv from http yeah aim none
and
a little bit more
a little
open distro has another configuration
that's a bit more
specific
well but looking for our public classic
searchers scott piper published an uh
[Music]
on a
forward cloud sec
slack group
that he was able to find at one year ago
387 public aws managerial searches
and the last time he departed in
february he were able to find 359 he
advised to
to aws to close those
publicly reachable aws manager services
and i try to reproduce his his search
and are only able to find five so yeah
aws made a really good job closing those
publicly
managed searches but what i believe they
what they did is was to put a load
balance in front of them so we couldn't
be able to reach them directly by ap
address
well some stats from energy
elasticsearch
by
looking for a valid genius per source
security traders was able to find more
than a thousand
valedic violence dnas
followed by passive total amassed domain
which had carried historical was
way down
but the percent of veg valid dns that i
found was only 41 percent so 41 percent
of the all the the hosts that i found
was valid
right well and those in
those who are valid and i try to to get
to some information i
was able to determine that modern 800
was the
iim authentication type
a little bit more than 100 was open to
the internet
and
some a little bit less than 100 has
basic authentication
and for those who which were open i
counted uh
11 000
number of indexes and at least 5.1
terabytes of data that was exposable to
the internet as well
and when we try to understand which data
sources are public by source we found
that security trails
were has 58 percent
of the publicly open
elastic search managers
but when we try to to
compare that with the amount of
data that was exposed disposable mass
with fine domain has more than 40
percent of that
so
if you're trying to look for exposed
data amazon domains are a bit more uh
better than security traders in that
case
so
yeah
so some closing thoughts
well take the shared responsibility
model seriously and please
do it well make sure you're not exposing
any of your
data
find em resource policies data low
principle
star or equivalent and for this you can
use some security tools to automatically
detect and mitigate those kind of
misconceptions configurations for
instance cspm
security hub or security hub or aws
config rules
and during the dynamic nature of the
clouds historical github uh make data
was obsolete so
as the data stops in 2019 most of the
services who were created
and destroyed by them
were not on validity anymore so we spent
around 250 dollars in big carry searches
for almost no valid hits
so yeah sorry boss well
and passive ness has a partial
visibility of the cloud infrastructure
but is still a good source for hunting
for aws managing resources
so
yeah that's all that i have for today
guys
do i have time for questions