Slide 1

Slide 1 text

Ýmir Vigfússon Rich Smith  

Slide 2

Slide 2 text

•  Ýmir  Vigfússon,  PhD   – Now:  Prof.  of  Computer  Science,  Reykjavík   University  &  Chief  Science  Officer  of  Syndis   – Prior:  IBM  Research,  Yahoo  Research,  ...   – Where:  Reykjavík   •  Rich  Smith   – Now:  Principal  Researcher  and  CEO  of  Syndis   – Prior:  VP  at  Morgan  Stanley,  HP  Labs,  ...   – Where:  NYC  &  Reykjavík  

Slide 3

Slide 3 text

Who  are  Syndis?     •  Group  of  offensive  security  professionals  who   use  aHack  simulaJons  against  our  clients  to   help  them  understand  real-­‐world  threats   •  We  focus  on  bespoke  aHack  technology  for   clients  who  need  deep  security  insight  

Slide 4

Slide 4 text

•  Rapidly  changing  area  of  technology   •  Example  of  how  aHack  opportuniJes  are  created   •  ARackers  understand  more  about  the  security   implicaJons  of  a  technology  change  than  you  do   CLOUD  SECURITY  

Slide 5

Slide 5 text

CLOUD  

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

Before  the  cloud   Reality   Capacity   Requests   Time   Your  users  flee   Bad  uJlizaJon   Capacity  does   not  track  reality  

Slide 8

Slide 8 text

—  Maximum  capacity  should  track  reality   ElasScity   Reality   Capacity   Requests   Time  

Slide 9

Slide 9 text

Up  to  the  clouds   Pros   Lower  capital  and   operaSng   expenditures   Simple  to  use   AHributes   Reliability   ElasScity   Virtual  environment   Distributed  hosSng   Types   IaaS   PaaS   SaaS  

Slide 10

Slide 10 text

Up  to  the  clouds   Clouds  are  an  elasJc,  reliable   operaSng  environments  that  share     common  resources  and  meter  usage   (as  well  as  quality)   Pros   Lower  capital  and   operaSng   expenditures   Simple  to  use   AHributes   Reliability   ElasScity   Virtual  environment   Distributed  hosSng   Types   IaaS   PaaS   SaaS  

Slide 11

Slide 11 text

Cloud  layers   SoXware-­‐as-­‐a-­‐Service   • Google  Docs  /  Gmail   • Salesforce   Pla\orm-­‐as-­‐a-­‐Service   • Google  App  Engine   • Amazon  Beanstalk   • MicrosoX  Azure  /  365   Infrastructure-­‐as-­‐a-­‐Service   • Amazon  EC2   • Rackspace.com   ApplicaJons   Data   Run-­‐Jme  environment   OperaJng  system   Virtual  machines   Equipment   Data  storage   Networking  equipm.   Security  team  

Slide 12

Slide 12 text

Cloud  layers   SoXware-­‐as-­‐a-­‐Service   • Google  Docs  /  Gmail   • Salesforce   Pla\orm-­‐as-­‐a-­‐Service   • Google  App  Engine   • Amazon  Beanstalk   • Heroku   Infrastructure-­‐as-­‐a-­‐Service   • Amazon  EC2   • Rackspace.com   ApplicaJons   Data   Run-­‐Jme  environment   OperaJng  system   Virtual  machines   Equipment   Data  storage   Networking  equipm.   Security  team  

Slide 13

Slide 13 text

ApplicaJons   Data   Run-­‐Jme  environment   OperaJng  system   Virtual  machines   Equipment   Data  storage   Networking  equipm.   Cloud  layers   SoXware-­‐as-­‐a-­‐Service   • Google  Docs  /  Gmail   • Capsule   Pla\orm-­‐as-­‐a-­‐Service   • Google  App  Engine   • Amazon  Beanstalk   • Heroku   Infrastructure-­‐as-­‐a-­‐Service   • Amazon  EC2   • Rackspace.com   Security  team  

Slide 14

Slide 14 text

DelegaSon  of  trust   —  The  cloud  has  many  layers  –  it  is  not  flat     ◦  What  if  Capsule  uses  Heroku,  which  in  turn  uses   Amazon  EC2?   —  It  may  not  even  be  possible  to  know  where  data   is  geographically  stored   ◦  Can‘t  dictate  data  locaJon  for  cloud  providers   ◦  Historic  knowledge  of  where  it  is  does  not  predict   where  it  will  be  in  the  future  

Slide 15

Slide 15 text

DelegaSon  of  trust   —  Do  trust  concerns  stop  companies  from   migraSng  to  the  cloud?   ◦  „More  than  33%  of  company  budgets  spent  on  cloud   services“  (Forbes  [1])   ◦  „79%  of  cloud  providers  allocate  less  than  <10%  to   security“  (Ponemon  InsStute  [2])   ◦  100%  of  aRackers  approve!   [1]  hRp://blogs.wsj.com/tech-­‐europe/2011/04/29/cloud-­‐providers-­‐not-­‐concerned-­‐by-­‐security   [2]  hRp://www.ca.com/us/~/media/Files/IndustryAnalystReports/2012-­‐security-­‐of-­‐cloud-­‐computer-­‐users-­‐final1.pdf  

Slide 16

Slide 16 text

•  Rapidly  changing  area  of  technology   •  Example  of  how  aHack  opportuniJes  are  created   •  ARackers  understand  more  about  the  security   implicaJons  of  a  technology  change  than  you  do   CLOUD  SECURITY  

Slide 17

Slide 17 text

SECURITY  

Slide 18

Slide 18 text

No content

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

No content

Slide 21

Slide 21 text

No content

Slide 22

Slide 22 text

No content

Slide 23

Slide 23 text

No content

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

No content

Slide 28

Slide 28 text

No content

Slide 29

Slide 29 text

No content

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

No content

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

No content

Slide 35

Slide 35 text

ATTACKING IS AN ENTERPRISE Found the original bug by fuzzing Wrote a proof-of- concept exploit Wrote a DEP- resistant exploit Weaponized the exploit Created post- exploitation framework Sponsored the attacks Administered deployment

Slide 36

Slide 36 text

No content

Slide 37

Slide 37 text

•    ASYMMETRY

Slide 38

Slide 38 text

So,  how  do  you  aRack  the  cloud  ?   •  You  are  using  the  cloud  for  a  reason   – Lowering  barriers  to  entry:  a  startup  can  have  a   full  IT  setup  without  upfront  costs   – DelegaJng  responsibility  for  saving  on  costs  and   complexity   – Technology  is  complicated  and  a  distracJon.             Let  someone  else  worry  about  that   – All  of  these  advantages  also  have  trade-­‐offs  

Slide 39

Slide 39 text

So,  how  do  you  aRack  the  cloud  ?   •  ARackers  take  advantage  of  these  features     – Focus  on  those  tradeoffs  and  compromises   – IdenSfy  the  features  of  the  cloud  you  rely  on  that   also  provide  them  aRack  advanatage   •  What  are  the  opportuniJes  for  aHackers?   – We‘ll  give  real-­‐world  examples   – Flaws  -­‐  not  bugs  

Slide 40

Slide 40 text

FLAW   BUG  

Slide 41

Slide 41 text

#0  Clouds  are  opaque   •  Log  availability  is  limited   –  IaaS:  Amazon  S3  does  not  provide  connecSon  logs   –  PaaS:  Logs  in  Google  Apps  (e.g.  Gmail)  have  no  ‘SLA’   could  arrive  0-­‐48  hours  later   •  Thus  you  will  likely  not  see  either  successful  or   failed  log-­‐in  aHempts  at  all  or  in  a  Smely  manner   •  You  are  at  the  mercy  of  your  provider    

Slide 42

Slide 42 text

#1  Clouds  are  accessible   •  Different  requirements  for  access  control   – Clouds  &  OpenAPIs  go  hand  in  han   – API  tokens  /  certs  are  the  keys  to  the  kingdom   – Opaque  with  respect  to  logging   •  Example:  Amazon  S3  credenSals   – Full  remote  access  via  API  keys  /  cerSficates   – We‘ve  found  AWS  admins  keys  on  publicly   accessible  websites,  giving  access  to  everything  

Slide 43

Slide 43 text

#1  Clouds  are  accessible   •  But  what  about  two-­‐factor  authenJcaJon?   •  User  interface  Vs.  ProgramaSc  Interface   – Different  security  models  &  requirements   •  Example:  Gmail  servers.   – May  enforce  2-­‐factor  authenScaSon  for  users   – But  the  API  allows  you  to  sidestep  them  

Slide 44

Slide 44 text

#2  Clouds  are  leaky   •  The  cloud  is  foundaJonal  to  many  companies   and  organizaSons   – Tech  companies  are  very  fast  adopters   •  Lots  of  trust  placed  in  cloud-­‐based  services  

Slide 45

Slide 45 text

#2  Clouds  are  leaky   •  Example:  HipChat   – Private  group  chat  and  team  collaboraSon   – All  files  or  images  are  stored  in  Amazon  S3   – ProtecSon  is  based  on  not  knowing  the  URL   – Google  search  for  “site:s3.amazonaws.com  inurl:/ uploads.hipchat.com”  

Slide 46

Slide 46 text

#2  Clouds  are  leaky   •  Example:  GitHub  /  Gist   –  The  social  network  of  soXware  developers   –  Companies  and  individuals  push  their  code  into  these   services     –  We‘ve  found  lots  of  sensiJve  data  pushed  unwizngly   •  CredenSals  (SSH    keys,  database  credenSals)   •  Internal  documentaSon   •  Internal  infrastructure  informaSon   –  What  applicaSons  are  being  used?   –  Internal  network  set-­‐up  and  structure   –  ARackers  care  about  ROI  –  we  hired  a  summer  intern!  

Slide 47

Slide 47 text

#3  Clouds  get  everywhere   •  Even  if  you  think  you‘re  not  using  the  cloud,   you  may  sSll  be   •  Example:  MacOS  X:  Unsaved  docs  &  iCloud   – Enter  AppleID  at  install  Sme,  iCloud  auto-­‐enabled   – Your  documents  are  stored  locally...   – ...but  unsaved  files  in  apps  supporSng  the  iCloud   API  are  automaScally  pushed  into  iCloud   – This  is  unexpected  to  most  !   hRp://support.apple.com/kb/TS4372  

Slide 48

Slide 48 text

OS   Cloud   App  

Slide 49

Slide 49 text

#3  Clouds  get  everywhere   •  This  a  trend  which  is  ongoing  &  not  just  OS  X   •  Has  significant  impact  to  long  established   security  models  and  boundaries   •  Not  just  network  de-­‐perimiterisaSon  but  the   break  of  the  OS  perimeter   hRp://support.apple.com/kb/TS4372  

Slide 50

Slide 50 text

ARackers‘  takeaways   •  In  the  cloud,  your  tracks  are  harder  for   people  to  see   •  Cloud  users  don’t  understand  the  changes  to   their  security  boundaries  of  the  new  model   •  API  keys  are  everywhere  and  are  the  keys  to   many  kingdoms   •  RegulaJons  fail  to  keep  up  !=  security  

Slide 51

Slide 51 text

No content

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

No content

Slide 54

Slide 54 text

No content

Slide 55

Slide 55 text

HOW MUCH DO I SPEND ON DEFENSE X? HOW MUCH DOES AN ATTACKER HAVE TO SPEND TO BYPASS X? HOW MUCH IS DEFENSE X ACTUALLY WORTH TO ME? WHAT IS BYPASSING DEFENSE X WORTH TO AN ATTACKER ?

Slide 56

Slide 56 text

No content

Slide 57

Slide 57 text

If  you  take  nothing  else  away     Tradeoffs     Asymmetries      

Slide 58

Slide 58 text

Clouds  trade  off  control  for  lower  costs   Caveat:  Also  reduces  security  granularity   Clouds  reduce  operaSonal  complexity   Caveat:  Increase  security  complexity   Cloud  environments  constantly  evolving   Caveat:  Security  understanding  must  evolve  also  

Slide 59

Slide 59 text

Ýmir Vigfússon [email protected] Rich Smith [email protected] #TheSyndis