Ghost Warden

Reviewing security of serverless architectures (OWASP Saitama MTG #26, talk #1)

Transcript

1. GHOST WARDEN OWASP SAITAMA MTG #26, TALK #1 Image by ivan dokov on flickr, CC-BY-NC 2.0
2. TEXT SESSION FLAGS ▸ ࿥ըɾ࿥Իɾެ։: OK Image by Nico Kaiser on flickr, CC-BY 2.0
3. TEXT BACKGROUND ▸ serverless؀ڥ αʔόΛ֬อͤͣʹlambdaΛ͸͡Ίͱ͢ΔΫϥ ΢υαʔϏεͷΈͰߏ੒͢ΔWebαʔϏε ▸ ۙ೥૿Ճ܏޲ ▸ ߏ੒͸େม͕ͩίετ্͕͕҆͘Δ ▸ ຊ࣭తʹεέʔϥϒϧ Image by flexbox on flickr, CC-BY 2.0
4. TEXT BACKGROUND ▸ Ұํۙ೥େ͖ͳ໰୊ʹͳ͍ͬͯΔ "Cloud service miscon fi guration" ▸ Serverless؀ڥͷ҆શੑͱ͸… Image by kyriazis on flickr, CC-BY-NC-ND 2.0
5. TEXT WHO I AM ▸ Takahiro Yoshimura (@alterakey) https://keybase.io/alterakey ▸ Monolith Works Inc. Co-founder, CTO Security researcher ▸ ໌࣏େֶαΠόʔηΩϡϦςΟݚڀॴ ٬һݚڀһ (ʙ3݄)
6. TEXT WHAT I DO ▸ Security research and development ▸ iOS/Android Apps →Financial, Games, IoT related, etc. (>200) →trueseeing: Non-decompiling Android Application Vulnerability Scanner [2017] ▸ Windows/Mac/Web/HTML5 Apps →POS, RAD tools etc. ▸ Network/Web penetration testing →PCI-DSS etc. ▸ Search engine reconnaissance (aka. Google Hacking) ▸ Whitebox testing ▸ Forensic analysis
7. TEXT WHAT I DO ▸ CTF ▸ Enemy10, Sutegoma2 ▸ METI CTFCJ 2012 Qual.: Won ▸ METI CTFCJ 2012: 3rd ▸ DEF CON 21 CTF: 6th ▸ DEF CON 22 OpenCTF: 4th ▸ ൃදɾߨԋͳͲ DEF CON 25 Demo Labs (2017) DEF CON 27 AI Village (2019) CODE BLUE (2017, 2019) CYDEF (2020) etc. Image by Wiyre Media on flickr, CC-BY 2.0
8. TEXT LOOK MA, NO SERVERS! ▸ Serverless؀ڥͷߏ੒ ▸ API Gateway HTTPϦΫΤετΛFunction΁࿈ܞ ▸ Function JSONΛड͚ͱΓJSONΛฦؔ͢਺ (λ) ▸ ͋ͱ͸KVS΍File StorageͳͲ… Image by milkfish on flickr, CC-BY-NC-ND 2.0
9. TEXT LOOK MA, SO ENTANGLED! ▸ શͯϚωʔδυαʔϏεΛ࢖༻ →Ͱͳ͍ͱαʔόΛىಈ͢Δඞཁ͕ग़ΔͨΊ ▸ ͭ·Γؔ࿈αʔϏε͕ଟ͍ →ݖݶܥͷઃఆ͕൥ࡶʹͳΓ΍͍͢ →least priviledgeݪଇ͸෼͔Δ͕ Image by psd on flickr, CC-BY 2.0
10. TEXT IAM ENTANGLEMENT ▸ ؔ࿈αʔϏεͷଟ͔͞Βݖݶઃఆ͕൥ࡶʹ ▸ ޿͘ઃఆ͕ͪ͠ →ೲظ͕… →unhappy path͕… →υΩϡϝϯτ͕൥ࡶ… →ϥΠϒϥϦͷڍಈ͕෼͔Βͳ͍… etc. Image by megapiksel on flickr, CC-BY-NC-ND 2.0
11. TEXT IAM ENTANGLEMENT ▸ ։ൃ؀ڥͰ෼͔Βͳ͍΋ͷ͔ʁ ▸ มಈ͢Δ؀ڥͰ௥੻͢Δͷ͸͍ͩͿେม →։ൃͷࢧোʹ ▸ ։ൃऀΞΧ΢ϯτʹڧେͳݖݶΛ༩͑Δέʔε ͕ଟ͍ ▸ ͭ·Γ… ෼͔Βͳ͍ʂ Image by spablab on flickr, CC-BY-ND 2.0
12. TEXT IAM ENTANGLEMENT ▸ ͔͠΋औΓѻ͍Λ؆୯ʹ͢ΔͨΊʹAKID/SAKͷ Α͏ͳAPIೝূ৘ใΛ௚ʹӡ༻͢Δέʔε΋ ·ͩ·ͩ͋Δ ▸ ϩʔΧϧͰ࢖͏෼ʹ͸ྑ͍͕ ͜ΕΒ͕ຒΊࠐ·ΕͨΒ…͍ͩͿ໰୊ Image by mscaprikell on flickr, CC-BY-SA 2.0
13. TEXT IAM ENTANGLEMENT ▸ ରࡦ ▸ IAM Function RoleΛར༻ ▸ ೝূ৘ใ͸ϩʔΧϧར༻ʹཹΊΔ →ຒΊࠐΈݕ஌΋༗ޮ ▸ IAM Policyͷ࠷খԽ →͜Ε͕େมͳ৔߹͸… Image by -Jérôme- on flickr, CC-BY 2.0
14. TEXT IAM ENTANGLEMENT ▸ ରࡦ ▸ ΞΧ΢ϯτΛdeployment͝ͱʹׂΔ e.g. X-dev, X-stg, X-prd, etc. (AWS: Organization) ▸ ͜Ε͑ͯ͞͠͠·͑͹࠷ѱશ։์Ͱ΋ ͞΄Ͳ໰୊͸ͳ͍ ▸ ຊདྷ͸ΪνΪνʹ͢΂͖͕ͩɺ ͳʹ΋͠ͳ͍ΑΓ͸Ϛγ Image by D()MENICK on flickr, CC-BY-ND 2.0
15. TEXT LAMBDA MONSTER ▸ WebΞϓϦશମΛLambdaʹ… ΍Γ͕ͪ ▸ Function͸ҰͭͰ͋Δඞཁ͸ͳ͍ →ͨͩ෼͚Δͱ໘౗ →API Gateway͔Βͷઃఆ͕… →deploy͕… Image by Robin Hutton on flickr, CC-BY-NC-ND 2.0
16. TEXT LAMBDA MONSTER ▸ Function͸େ͖͘ଟػೳԽ͢Δ܏޲ ▸ େ͖͍ͱ ▸ ىಈ࣌ؒ΋ϝϞϦ΋ඞཁ →ίετ͕… Ԡ౴࣌ؒن੍͕… ▸ ೝՄ੍ޚ΋େม Image by Robin Hutton on flickr, CC-BY-NC-ND 2.0
17. TEXT LAMBDA MONSTER ▸ ରࡦ ▸ LambdaΛػೳ୯ҐͰׂΔ ▸ Ͱ͖ͳ͍৔߹ ▸ deployment͝ͱͷΞΧ΢ϯτ෼ׂ Image by sammynetbook on flickr, CC-BY 2.0
18. TEXT PARAMETRIC NEEDS ▸ ύϥϝʔλΛ؀ڥม਺Ͱ౉͕ͪ͠ ▸ ͦ͜·Ͱѱ͘͸ͳ͍ख ▸ AWS: Lambda͸؀ڥม਺Λ҉߸Խ͍ͯ͠Δ ▸ AWS: CloudFormationύϥϝʔλ͸ӅṭՄೳ Image by knowablemag on flickr, CC-BY-NC-ND 2.0
19. TEXT PARAMETRIC NEEDS ▸ ͕ͩ… ▸ AWS: AWS managed keys ▸ AWS: server-sideͷΈ… →Πϯϑϥ಺Ͱ҉߸Խ͞Ε͍ͯΔͱ͍͏͚ͩ →CloudFormation͕Ӆṭ͍ͯ͠Α͏ͱ΋ Lambdaͷ৘ใ͔Βී௨ʹݟ͑Δ (e.g. aws lambda get-function) Image by flikr on flickr, CC-BY 2.0
20. TEXT PARAMETRIC NEEDS ▸ ରࡦʁ ▸ AWS: CMKΛ࢖༻ ▸ AWS: custom environment helperͰ࣮ߦ࣌ʹ ղಡ ʢͳ͔ͥެࣜͰ͸͜Ε͕in-transitͷอޢͱ͠ ͯॻ͔Ε͍ͯΔ…ʣ ▸ ͜Ε͸…
21. TEXT PARAMETRIC NEEDS ▸ ྑ͍͜ͱͰ͋Δ͕߇͑Ίʹݴͬͯ΋misleading ▸ AWS: CMKΛ࢖༻ →ࠓͷ໰୊͸Կ͔ʁ ▸ AWS: custom environment helperͰ࣮ߦ࣌ʹ ղಡ →in-transitͷอޢͱ͍͏ͷ͸͍ͩͿ͓͔͍͠ →client-side҉߸Խͷڧ੍͸error-prone →Ωʔ؅ཧͷ໰୊ Image by Thirteen Of Clubs on flickr, CC-BY-SA 2.0
22. TEXT PARAMETRIC NEEDS ▸ ରࡦ: ͦ΋ͦ΋؀ڥม਺͸ෆద ▸ AWS: secret managerΛ࢖͏ →ඇݱ࣮తͳΒparameter store (ssm)ͳͲ ▸ AWS: secret managerΛॏ఺తʹ؂ࠪ Image by Liz Brooks on flickr, CC-BY-NC 2.0
23. TEXT CALLING FROM HEAVEN ▸ Lambdaͷݺग़͠ʹؔΘΔAPI Gateway ▸ HTTPϦΫΤετΛղऍ ▸ LambdaΛݺͼग़͢ ▸ AWS: Application Load Balancer, API Gateway v2 (REST/HTTP) Image by Arlekom on flickr, CC-BY-NC-ND 2.0
24. TEXT CALLING FROM HEAVEN ▸ APIͷೝՄ੍ޚ →࣮ମͰ࣮૷͢Δέʔε͕ଟ͍ͷͰ͸ ▸ ໰୊͸ͳ͍ͷ͕ͩ… →ೝՄ֬ೝͷͨΊʹશମΛىಈ →ΞΫηε͕ूதͨ͠Βʁ Image by Arlekom on flickr, CC-BY-NC-ND 2.0
25. TEXT CALLING FROM HEAVEN .. OR HELL ▸ TLSͷద༻͸ݱࡏͰ͸΄΅ඞਢ →ACMͳͲͰূ໌ॻΛऔಘͰ͖Δ ▸ LambdaͷҰൠ։์͸ආ͚Δ΂͠ →API Gateway͕ݺͿͷͰ͋Ε͹ͦ͏ݶఆ →Function URL΋Ұൠ։์ʹ૬౰ ʢ঎༻؀ڥͰͦΜͳ͜ͱ͸͠ͳ͍ͱࢥ͏͕…ʣ Image by beelaineo on flickr, CC-BY-NC 2.0
26. TEXT CALLING FROM HEAVEN .. OR HELL ▸ APIೝՄ੍ޚͷଟ૚ԽʹΑΔؤ݈Խ ʢਖ਼౰ੑ֬ೝˠೝՄ֬ೝʣ ▸ ྫ͑͹… ▸ AWS: Lambda authorizer →API Key͓ΑͼJWTͷਖ਼౰ੑ֬ೝ ▸ AWS: IAM authorizer →ϦΫΤετͷॺ໊֬ೝʢV4ʣ Image by beelaineo on flickr, CC-BY-NC 2.0
27. TEXT CALLING FROM HEAVEN .. OR HELL ▸ AWS: V4 Signatureͷੜ੒ʹ͍ͭͯ ▸ https://gist.github.com/marcogrcr/ 6f0645b20847be4ef9cd6742427fc97b ▸ ߇͑Ίʹݴͬͯ΋࢖͍ʹ͍͕͘ɺaccountability ͷ୲อʹ͸ͳΔͩΖ͏͔ɻ Image by marfis75 on flickr, CC-BY 2.0
28. TEXT TAKEAWAYS ▸ Serverless؀ڥ͸ຊ࣭తʹෳࡶ… ▸ ೝՄ੍ޚΛ࠷খʹ͢Δͷ͸େม →deployment͝ͱͷΞΧ΢ϯτ෼ׂ΋༗ޮ ▸ Lambda͸Ͱ͖Ε͹ػೳ୯ҐͰ෼ׂ ▸ ໌ࣔతΑΓ҉໧తͳखஈΛબͿ ▸ ೝՄ੍ޚ: IAM Function Roleʢcf. ॺ໊ʣ ▸ ύϥϝʔλ: Secret Managerʢcf. ؀ڥม਺ʣ Image by Nata Luna Sans on flickr, CC-BY-NC 2.0
29. TEXT TAKEAWAYS ▸ TLS͸ඞਢ ▸ LambdaͷҰൠ։์ʹ͸஫ҙ →୭΋ΞΫηεՄೳͳͷͰͱ͍͏ҙຯ ▸ APIೝՄ੍ޚͷଟ૚Խ͸ؤ݈Խʹ༗༻ ʢਖ਼౰ੑ֬ೝ → ೝՄ֬ೝʣ Image by Jeff-o-matic on flickr, CC-BY-NC-ND 2.0
30. ONE MORE THING.. Image by Chris Pirillo on flickr, CC-BY-NC-ND 2.0
31. TEXT DEPLOYMENT TOOLS ▸ Serverless؀ڥʹ͓͚Δdeployment ▸ ख࡞ۀ → **͓͓ͬͱ** ▸ Serverless →v4͔Βproprietaryʴ༗ঈԽ ▸ Terraform →Ͱ͖ͳ͘͸ͳ͍ ▸ AWS: AWS SAM →ߏ଄తʹಡΈʹ͍͘ͳͲͷบ͕͋Δ →CLIपΓΛϥΠϒϥϦʹ೚ͤΔͷ͸…… Image by HJ Media Studios on flickr, CC-BY-SA 2.0
32. STAY SAFE! Image by KaCey97078 on flickr, CC-BY-NC 2.0
33. FIN. 6.24.2025 TAKAHIRO YOSHIMURA (@ALTERAKEY) Image by ivan dokov on flickr, CC-BY-NC 2.0