Upgrade to Pro — share decks privately, control downloads, hide ads and more …

"ざっくり"話す"AWS IAM"の特権昇格の考え方と対策

a_zara_n
June 12, 2021
2.7k

"ざっくり"話す"AWS IAM"の特権昇格の考え方と対策

モブセキュリティで話した内容です。
https://mob-security.connpass.com/event/209884/
情報の倫理的な取り扱いをお願いします。

a_zara_n

June 12, 2021
Tweet

Transcript

  1. lͬ͘͟Γz࿩͢ "84 *".ͷ
    ಛݖঢ֨ͷߟ͑ํͱରࡦ
    ϞϒηΩϡϦςΟ ୈճ-5େձ [email protected]
    "[BSB [email protected][[email protected]


    View Slide

  2. ࣗݾ঺հ
    ໊લ"[BSB
    [email protected][[email protected]
    "CPVU
    ηΩϡϦςΟؔ܎ͷ࢓ࣄΛ͍ͯ͠Δ৽ଔΤϯδχΞͰ͢
    ηΩϡϦςΟͱ8FCͱΫϥ΢υ "84
    ͕޷͖Ͱ͢
    ࠷ۙ͸"84440ͱ$POUSPM5PXFSͱٔΕͯ·ͨ͠
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  3. ༨ஊ
    ࠓͷؾ࣋ͪ
    • ؇͘࿩ͦ͏ͱࢥͬͯ-5ʹొ࿥ͨ͠
    ࣮͸ࡢ೔·Ͱ๨Εͯͨʜ
    ͋ͱࢀՃऀଟ͍ʜ
    • ϏΫϏΫ͍ͯ͠·͢
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  4. ࠓ೔࿩͢͜ͱ
    • "84 *". ͬͯͳʹ
    • "84*".ͷಛݖঢ֨
    • ͳΜͱͳ͘Θ͔Δఔ౓ʹ࿩͢
    • ͢΂ͯͷݸผࣄྫ͸࿩͞ͳ͍
    • ରࡦͲ͏͢ΜͶΜ
    • ূ੻ͷอશͲ͏͢ΜͶΜ
    "84*".ͷ࿩ ಛݖঢ֨ͷߟ͑ํ ରࡦ΍ূ੻ͷอશ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  5. ࿩͢಺༰
    • कΔଆ΋߈ܸऀ͕͢Δ߈ܸͷݪཧΛ
    ஌͓ͬͯ͘ͱରࡦ͠΍͍͢ΑͶͱ͍͏ؾ࣋ͪͰॻ͍ͯ·͢
    • ରࡦํ๏͸ईͷؔ܎্୹͍Ͱ͕ྃ͢͝ঝΛ
    • ݸʑͷࣄ৅ʹ͍ͭͯৄ͘͠࿩͢Θ͚Ͱ͸͋Γ·ͤΜ
    • lͳΜͱͳ͘Θ͔ͬͨzͱ͍͏ͱ͜Ζ·Ͱ࿩͠·͢
    • ֤αʔϏεͷৄ͍͠ར༻ํ๏ʹؔͯ͠͸
    ެࣜυΩϡϝϯτΛࢀরͯ͠Լ͍͞
    • ࠓޙͲ͔͜ͰύϫʔΞοϓ൛Λ࿩͔͢΋͠Ε·ͤΜ͕
    ࠓճ͸͕࣌ؒ୹͍ͷͰ zͬ͘͟Γzόʔδϣϯ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  6. ஫ҙࣄ߲
    • ߈ܸʹ΋ར༻Ͱ͖Δ࿩Λ͠·͢
    • ྙཧ؍Λ࣋ͬͯฉ͍ͯ͘ΕΔͱ͏Ε͍͠Ͱ͢
    • ຊ൪؀ڥ΍࣮؀ڥʹ͸঺հͨ͠߈ܸͳͲΛ
    ڐՄͳ͘ʹ࣮ߦ͠ͳ͍Ͱ͍ͩ͘͞ɻ
    • ࡞ͬͯͨΒ௕͘ͳͬͯ͠·ͬͨͷͰૣޱ͔΋͠Ε·ͤΜ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  7. [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    "84*".ͷ࿩ "84 *".ͷ
    ಛݖঢ֨ͷߟ͑ํ
    ରࡦ΍ূ੻ͷอશ

    View Slide

  8. ࿩͢͜ͱ
    • "84*".ͱ͸
    • lͬ͘͟ΓzΘ͔Δ "84*".
    • *". 1PMJDZ
    • *".6TFS
    • *".3PMF
    • *".(SPVQ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  9. "84*".ͱ͸
    ˞͜ͷεϥΠυͰ͸ "84*".͕ఏڙ͢Δ6TFS΍3PMFΛҰׅΓʹ͢Δࡍʹ l"84*".zͱදه͠·͢
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    "84ެࣜͷ *".ͷ঺հϖʔδ ͜ͷεϥΠυͷొ৔ਓ෺

    View Slide

  10. lͬ͘͟ΓzΘ͔Δ "84*".
    *".1PMJDZ
    • *".ͷج൫
    • ͜ͷϙϦγʔʹݖݶΛॻ͘
    • ར༻Ͱ͖Δ৚݅΍ڋ൱ʹؔͯ͠΋͔͚Δ
    • ݖݶʹ lzΛ͚ͭΔͱϫΠϧυΧʔυʹͳΔ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    こいつ
    ͜Μͳײ͡ʹهड़͢Δ Πϝʔδ

    View Slide

  11. lͬ͘͟ΓzΘ͔Δ "84*".
    *".6TFS
    • "84Λ࢝ΊΔͱΈΜͳ࢖͏
    • ίϯιʔϧʹ΋$-*ʹ΋ରԠ͍ͯ͠Δ
    • ࿙ΕΔͱΊΜͲ͍͘͞
    • ࿙ΕΔέʔε
    • ਓҝతϛεͰ࿙Εͯ͠·͏
    • ΫϥΠΞϯτϚγϯ͕৵ೖ͞Ε౪·ΕΔ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    こいつ

    View Slide

  12. lͬ͘͟ΓzΘ͔Δ "84*".
    *".6TFS
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    ϙϦγʔΛΞλον΍ޙड़ͷάϧʔϓʹ
    ௥Ճͯ͠ݖݶΛ෇༩͢Δ
    *".6TFS͸ΞΫηεʹؔ͢Δ
    ೝূ৘ใ΋ఏڙ͍ͯ͠·͢

    View Slide

  13. lͬ͘͟ΓzΘ͔Δ "84*".
    *".3PMF
    • Ұ࣌తͳೝূ৘ใΛ෇༩ͯ͘͠ΕΔ
    • ผΞΧ΢ϯτʹ΋෇༩Ͱ͖ΔΑ
    ΫϩεΞΧ΢ϯτ

    • αʔϏεʹΞλον͢Δ͜ͱͰ
    ͦͷαʔϏε͔Βͷૢ࡞ʹར༻Ͱ͖Δ
    Ұ࣌తͳೝূ৘ใΛ෷͍ग़͢Α
    • &$΍-BNCEBɺ$PEF#VJMEͳͲͳͲ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    こいつ

    View Slide

  14. lͬ͘͟ΓzΘ͔Δ "84*".
    *".6TFS
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    *".6TFSͷΑ͏ʹQPMJDZΛΞλονͯ͠
    ݖݶΛ෇༩͢Δ
    *". 3PMFΛར༻Ͱ͖ΔϦιʔε΍
    ΞΧ΢ϯτͳͲʹ৴པؔ܎Λઃఆ͠·͢
    &$Ͱ࢖͍͍ͨ࣌͸͜Μͳײ͡
    Πϝʔδ

    View Slide

  15. lͬ͘͟ΓzΘ͔Δ "84*".
    *".(SPVQ
    • *". 6TFSΛ·ͱΊͯ͘ΕΔ
    • ͜ΕʹϙϦγʔΛΞλον͢Δͱάϧʔϓʹ
    ଐ͍ͯ͠Δ*".6TFS͕ΈΜͳڧ͘ͳΔ
    • *".6TFS͕૿͑Δͱׂͱ࢖͏
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    こいつら

    View Slide

  16. lͬ͘͟ΓzΘ͔Δ "84*".
    *".6TFS
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    ϢʔβʔΛ௥Ճͯ͠·ͱΊͯ
    ϙϦγʔΛ෇༩Ͱ͖Δ
    *".6TFS΍3PMFಉ༷
    ϙϦγʔʹΑΔݖݶΛΞλον͢Δ

    View Slide

  17. *".ͷzͬ͘͟Γz·ͱΊ
    *".1PMJDZ
    • ݖݶΛهड़͢Δ
    • 3PMF΍6TFSɺ(SPVQʹΞλονΛͯ͠ݖݶΛ෇༩Ͱ͖Δ
    *". 6TFS
    • 6TFSͷར༻͢Δೝূ৘ใͳͲΛఏڙͰ͖Δ
    *". 3PMF
    • αʔϏε΍ผΞΧ΢ϯτʹҰ࣌తͳݖݶΛ෇༩Ͱ͖Δ
    *". (SPVQ
    • *".6TFSΛ·ͱΊͯ؅ཧͰ͖Δ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  18. [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    "84*".ͷ࿩ ରࡦ΍ূ੻ͷอશ
    "84*".ͷ
    ಛݖঢ֨ͷߟ͑ํ

    View Slide

  19. ࿩͢͜ͱ
    • "84*".ʹ͓͚Δಛݖঢ֨ͱ͸
    • ߈ܸαΠΫϧͷҰ෦ͱͯ͠ͷಛݖঢ֨
    • ख๏ʹ͍ͭͯ
    • lͬ͘͟Γzख๏Λେผ͢Δͱ
    • "84*".ʹ௚઀తͳมߋ΍ૢ࡞Λߦ͏
    • طଘͷ΋ͷΛѱ༻͢Δ
    • FUD
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  20. "84*".ʹ͓͚Δಛݖঢ֨ͱ͸
    • "846TFS΍ 3PMF͕ʹ෇༩͞ΕͨݖݶΛ
    ΑΓڧྗ·ͨ͸༗༻ͳݖݶʹΞοϓάϨʔυ͢Δߦҝ
    • ΞοϓάϨʔυͷख๏͸
    • ݖݶͷॻ͖׵͑มߋ
    • ଞͰར༻͞Ε͍ͯΔผͷೝূ৘ใͷऔಘ
    • *". 3PMF΍ϙϦγʔͷ͛͢ସ͑
    • FUD
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  21. ߈ܸαΠΫϧͷҰ෦ͱͯ͠ͷಛݖঢ֨
    • ߈ܸऀ͕ "84Λૂ͏ཧ༝
    • ଞਓͷ&$Ϧιʔε࢖͍͍ͨͥ
    • 3%4ͱ͔ͷ৘ใൈ͖औΓ͍ͨͥ
    • SPPUݖݶऔͬͯΈ͍ͨͥ
    • FUD ʜ
    • ͱ΋͔͘ѱ༻ͷͨΊʹ
    ͍ΖΜͳ͜ͱΛͯ͘͠Δ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    ೝূ৘ใΛऔಘ
    ͲͷΑ͏ͳݖݶ͕
    ෇༩͞Ε͍ͯΔ͔
    ୳ࡧ
    ಛݖঢ֨
    ѱ༻
    ͋͘·Ͱ΋
    Πϝʔδ

    View Slide

  22. lͬ͘͟Γz ख๏Λେผ͢Δ
    • "84*". ʹ௚઀తͳมߋ΍ૢ࡞Λߦ͏
    • ྫ
    • *".QPMJDZͷ௚઀తͳมߋ
    • *".3PMF΁ͷϙϦγʔΞλον
    • ϦιʔεΛܦ༝ͯ͠طଘͷ*".3PMF͔Βऔಘ
    • ྫ
    • -BNCEBͷίʔυΛมߋ͠ɺFOW͔Βೝূ৘ใΛൈ͘
    • ϋΠϒϦοτ
    • ྫ
    • *". 3PMFΛ৽͘͠࡞Γ &$ʹΞλον
    • ͦͷଞ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  23. lͬ͘͟Γz ख๏Λେผ͢Δ
    • "84*". ʹ௚઀తͳมߋ΍ૢ࡞Λߦ͏ ܰ͘৮Ε·͢

    • ྫ
    • *".QPMJDZͷ௚઀తͳมߋ
    • *".3PMF΁ͷϙϦγʔΞλον
    • ϦιʔεΛܦ༝ͯ͠طଘͷ*".3PMF͔Βऔಘ ͬͪ͜Λ࿩͠·͢

    • ྫ
    • -BNCEBͷίʔυΛมߋ͠ɺFOW͔Βೝূ৘ใΛൈ͘
    • ϋΠϒϦοτ
    • ྫ
    • *". 3PMFΛ৽͘͠࡞Γ &$ʹΞλον
    • ͦͷଞ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  24. "84*". ʹ௚઀తͳมߋ΍ૢ࡞Λߦ͏
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    ͲͷΑ͏ͳ΋ͷͷ͜ͱΛࢦ͢ͷ͔
    • *".6TFSͷ࡞੒
    • طଘͷ*".6TFS͔ΒݤΛ࡞੒
    • *". 1PMJDZͷ࡞੒มߋ
    • *".3PMFʹ*".1PMJDZͷΞλον
    ͳͲ
    ෇༩͞Εͨ "84*".΁ͷݖݶΛར༻͠
    ࣗ෼ͷཉ͍ͯ͠ΔݖݶΛऔಘઃఆ͢Δ

    View Slide

  25. ϦιʔεΛܦ༝ͯ͠
    طଘͷ*".3PMF͔Βऔಘ
    ͲͷΑ͏ͳ΋ͷͷ͜ͱΛࢦ͢ͷ͔
    • طଘͷ-BNCEBͷίʔυΛมߋ
    • $MPVE'PSNBUJPOʹ*". 3PMFΛ෇༩
    • &$ʹ*".3PMFΛ෇༩
    ͳͲ
    Ϧιʔεʹ෇༩͞ΕΔҰ࣌తͳೝূ৘ใΛ
    ͳΜΒ͔ͷख๏Ͱऔಘ͠ར༻͢Δ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    例: Lambdaから取得する場合の
    ⼤体のイメージ

    View Slide

  26. ϦιʔεΛܦ༝ͯ͠
    طଘͷ*".3PMF͔Βऔಘ
    ొ৔͢Δ෺
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    ˞ ຊղઆʹ͓͍ͯ߈ܸऀ͸ࣄલʹ*".3PMF໊Λ೺Ѳ͍ͯ͠Δલఏͱ͢Δ

    View Slide

  27. ϦιʔεΛܦ༝ͯ͠
    طଘͷ*".3PMF͔Βऔಘ
    طଘͷϦιʔεΛ࣮ߦ͢Δ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  28. ϦιʔεΛܦ༝ͯ͠
    طଘͷ*".3PMF͔Βऔಘ
    طଘͷϦιʔεΛߋ৽͢Δ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  29. ϦιʔεΛܦ༝ͯ͠
    طଘͷ*".3PMF͔Βऔಘ
    ৽نͰϦιʔεΛ্ཱͪ͛3PMFΛड͚౉͢
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  30. [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    "84*".ͷ࿩
    "84 *".ͷ
    ಛݖঢ֨ͷߟ͑ํ
    ରࡦ΍ূ੻ͷอશ

    View Slide

  31. ରࡦ
    • औಘΛ·ͣ͸્ࢭ͢Δ
    • HJUTFDSFUͷಋೖͰ HJU΁ͷೝূ৘ใࠞೖΛ๷͙
    • ΍ͨΒʹೝূ৘ใΛڞ༗͠ͳ͍૿΍͞ͳ͍
    • FUD
    • ࠷খݖݶͷݪଇΛकΓ *".ͷϙϦγʔΛ࡞੒
    • Θ͔Βͳ͍৔߹͸*"."DDFTT"OBMZ[FSͳͲΛ༻͍Δ
    • ݖݶ͚ͩͰ͸ͳ͘ར༻Ͱ͖ΔϦιʔεͳͲΛ੍ݶ͢Δ
    • 4FDVSJUZ)VCΛ༻͍ͯΞΧ΢ϯτͷڴҖ৘ใΛऩू
    • ΞΧ΢ϯτͰར༻͠ͳ͍ݖݶ͸
    4$1 4FSWJDF$POUSPM1PMJDZ
    Ͱ੍ݶ͢Δ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  32. ূ੻ͷऔಘͱอશ
    ূ੻ͷऔಘ
    • $MPVE5SBJMͳͲΛ"1*ͷར༻ϩάΛऔಘ
    • ΞϓϦέʔγϣϯͷϩάͳͲ΋$MPVE 8BUDI-PHTΛ༻͍ͯऔಘ
    ূ੻ͷอଘ
    • 4΍ΫϩεΞΧ΢ϯτઌͷ4ʹอଘ
    ূ੻ͷอશ
    • ࡟আͤ͞ͳ͍ͨΊʹ΋
    • 4ͷόʔδϣχϯάΛ༗ޮԽ
    • .'" EFMFUFͷ༗ޮԽ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  33. [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    ·ͱΊ
    "84*".ͷ࿩
    "84 *".ͷ
    ಛݖঢ֨ͷߟ͑ํ
    ରࡦ΍ূڌͷอશ

    View Slide

  34. ·ͱΊ
    ͜ͷ-5Ͱ͸ͬ͘͟Γͱͨ͠ݖݶঢ֨ͷϑϩʔʹ͍ͭͯ৮Ε·ͨ͠
    • "84*". ʹ௚઀తͳมߋͳͲʹΑΓѱ༻͢Δ΋ͷ
    • طଘͷ΋ͷΛѱ༻͢Δ΋ͷ
    • ೋͭΛ߹ΘͤͨϋΠϒϦοτ
    "84ͳͲͷΫϥ΢υαʔϏεʹରͯ͠ɺ߈ܸऀ͸ৗʹ໨ΛޫΒͤ
    ͍ͯ·͢ɻ
    ར༻ऀͱͯ͠ɺࢲͨͪ͸Ͱ͖ΔݶΓͷରࡦͱূڌΛूΊམͪண͍ͨ
    Ϋϥ΢υϥΠϑΛա͝͠·͠ΐ͏ɻ
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  35. ͓͠·͍
    4QFDJBMUIBOLT*$000/.0/0
    IUUQTJDPPPONPOPDPN
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  36. [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    ͓·͚
    ֶशʹ͍ͭͯ

    View Slide

  37. ֶशؔ࿈
    • "84ެࣜυΩϡϝϯτͱᛀΊͬ͜
    • ࣮؀ڥͰࢼͯ͠ΈΔ
    • ࠷ॳ͸ GMBXTDMPVE ͱ͔Ͱ΋͍͍͔΋
    • 4FSWFSMFTTपΓͩͱಈ͘ͷগͳ͍
    • ҰԠ঺հ
    • 08"41%74"
    • 08"414FSWFSMFTT(PBU
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  38. ֶशؔ࿈
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    View Slide

  39. ֶशؔ࿈
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    https://github.com/RhinoSecurityLabs/cloudgoat

    View Slide

  40. ֶशؔ࿈
    [email protected][[email protected]@TFDVSJUZϞϒηΩϡϦςΟ

    https://rhinosecuritylabs.com/blog/?category=cloud-security

    View Slide