</CLOUD> - Speaker Deck

Slide 1

Slide 1 text

Ýmir Vigfússon Rich Smith

Slide 2

Slide 2 text

•  Ýmir Vigfússon, PhD – Now: Prof. of Computer Science, Reykjavík University & Chief Science Oﬃcer of Syndis – Prior: IBM Research, Yahoo Research, ... – Where: Reykjavík •  Rich Smith – Now: Principal Researcher and CEO of Syndis – Prior: VP at Morgan Stanley, HP Labs, ... – Where: NYC & Reykjavík

Slide 3

Slide 3 text

Who are Syndis? •  Group of oﬀensive security professionals who use aHack simulaJons against our clients to help them understand real-‐world threats •  We focus on bespoke aHack technology for clients who need deep security insight

Slide 4

Slide 4 text

•  Rapidly changing area of technology •  Example of how aHack opportuniJes are created •  ARackers understand more about the security implicaJons of a technology change than you do CLOUD SECURITY

Slide 5

Slide 5 text

CLOUD

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

Before the cloud Reality Capacity Requests Time Your users ﬂee Bad uJlizaJon Capacity does not track reality

Slide 8

Slide 8 text

  Maximum capacity should track reality ElasScity Reality Capacity Requests Time

Slide 9

Slide 9 text

Up to the clouds Pros Lower capital and operaSng expenditures Simple to use AHributes Reliability ElasScity Virtual environment Distributed hosSng Types IaaS PaaS SaaS

Slide 10

Slide 10 text

Up to the clouds Clouds are an elasJc, reliable operaSng environments that share common resources and meter usage (as well as quality) Pros Lower capital and operaSng expenditures Simple to use AHributes Reliability ElasScity Virtual environment Distributed hosSng Types IaaS PaaS SaaS

Slide 11

Slide 11 text

Cloud layers SoXware-‐as-‐a-‐Service • Google Docs / Gmail • Salesforce Pla\orm-‐as-‐a-‐Service • Google App Engine • Amazon Beanstalk • MicrosoX Azure / 365 Infrastructure-‐as-‐a-‐Service • Amazon EC2 • Rackspace.com ApplicaJons Data Run-‐Jme environment OperaJng system Virtual machines Equipment Data storage Networking equipm. Security team

Slide 12

Slide 12 text

Cloud layers SoXware-‐as-‐a-‐Service • Google Docs / Gmail • Salesforce Pla\orm-‐as-‐a-‐Service • Google App Engine • Amazon Beanstalk • Heroku Infrastructure-‐as-‐a-‐Service • Amazon EC2 • Rackspace.com ApplicaJons Data Run-‐Jme environment OperaJng system Virtual machines Equipment Data storage Networking equipm. Security team

Slide 13

Slide 13 text

ApplicaJons Data Run-‐Jme environment OperaJng system Virtual machines Equipment Data storage Networking equipm. Cloud layers SoXware-‐as-‐a-‐Service • Google Docs / Gmail • Capsule Pla\orm-‐as-‐a-‐Service • Google App Engine • Amazon Beanstalk • Heroku Infrastructure-‐as-‐a-‐Service • Amazon EC2 • Rackspace.com Security team

Slide 14

Slide 14 text

DelegaSon of trust   The cloud has many layers – it is not ﬂat ◦  What if Capsule uses Heroku, which in turn uses Amazon EC2?   It may not even be possible to know where data is geographically stored ◦  Can‘t dictate data locaJon for cloud providers ◦  Historic knowledge of where it is does not predict where it will be in the future

Slide 15

Slide 15 text

DelegaSon of trust   Do trust concerns stop companies from migraSng to the cloud? ◦  „More than 33% of company budgets spent on cloud services“ (Forbes [1]) ◦  „79% of cloud providers allocate less than <10% to security“ (Ponemon InsStute [2]) ◦  100% of aRackers approve! [1] hRp://blogs.wsj.com/tech-‐europe/2011/04/29/cloud-‐providers-‐not-‐concerned-‐by-‐security [2] hRp://www.ca.com/us/~/media/Files/IndustryAnalystReports/2012-‐security-‐of-‐cloud-‐computer-‐users-‐ﬁnal1.pdf

Slide 16

Slide 16 text

Slide 17

Slide 17 text

SECURITY

Slide 18

Slide 18 text

No content

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

No content

Slide 21

Slide 21 text

No content

Slide 22

Slide 22 text

No content

Slide 23

Slide 23 text

No content

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

No content

Slide 28

Slide 28 text

No content

Slide 29

Slide 29 text

No content

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

No content

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

No content

Slide 35

Slide 35 text

ATTACKING IS AN ENTERPRISE Found the original bug by fuzzing Wrote a proof-of- concept exploit Wrote a DEP- resistant exploit Weaponized the exploit Created post- exploitation framework Sponsored the attacks Administered deployment

Slide 36

Slide 36 text

No content

Slide 37

Slide 37 text

•  ASYMMETRY

Slide 38

Slide 38 text

So, how do you aRack the cloud ? •  You are using the cloud for a reason – Lowering barriers to entry: a startup can have a full IT setup without upfront costs – DelegaJng responsibility for saving on costs and complexity – Technology is complicated and a distracJon. Let someone else worry about that – All of these advantages also have trade-‐oﬀs

Slide 39

Slide 39 text

So, how do you aRack the cloud ? •  ARackers take advantage of these features – Focus on those tradeoﬀs and compromises – IdenSfy the features of the cloud you rely on that also provide them aRack advanatage •  What are the opportuniJes for aHackers? – We‘ll give real-‐world examples – Flaws -‐ not bugs

Slide 40

Slide 40 text

FLAW BUG

Slide 41

Slide 41 text

#0 Clouds are opaque •  Log availability is limited –  IaaS: Amazon S3 does not provide connecSon logs –  PaaS: Logs in Google Apps (e.g. Gmail) have no ‘SLA’ could arrive 0-‐48 hours later •  Thus you will likely not see either successful or failed log-‐in aHempts at all or in a Smely manner •  You are at the mercy of your provider

Slide 42

Slide 42 text

#1 Clouds are accessible •  Diﬀerent requirements for access control – Clouds & OpenAPIs go hand in han – API tokens / certs are the keys to the kingdom – Opaque with respect to logging •  Example: Amazon S3 credenSals – Full remote access via API keys / cerSﬁcates – We‘ve found AWS admins keys on publicly accessible websites, giving access to everything

Slide 43

Slide 43 text

#1 Clouds are accessible •  But what about two-‐factor authenJcaJon? •  User interface Vs. ProgramaSc Interface – Diﬀerent security models & requirements •  Example: Gmail servers. – May enforce 2-‐factor authenScaSon for users – But the API allows you to sidestep them

Slide 44

Slide 44 text

#2 Clouds are leaky •  The cloud is foundaJonal to many companies and organizaSons – Tech companies are very fast adopters •  Lots of trust placed in cloud-‐based services

Slide 45

Slide 45 text

#2 Clouds are leaky •  Example: HipChat – Private group chat and team collaboraSon – All ﬁles or images are stored in Amazon S3 – ProtecSon is based on not knowing the URL – Google search for “site:s3.amazonaws.com inurl:/ uploads.hipchat.com”

Slide 46

Slide 46 text

#2 Clouds are leaky •  Example: GitHub / Gist –  The social network of soXware developers –  Companies and individuals push their code into these services –  We‘ve found lots of sensiJve data pushed unwizngly •  CredenSals (SSH keys, database credenSals) •  Internal documentaSon •  Internal infrastructure informaSon –  What applicaSons are being used? –  Internal network set-‐up and structure –  ARackers care about ROI – we hired a summer intern!

Slide 47

Slide 47 text

#3 Clouds get everywhere •  Even if you think you‘re not using the cloud, you may sSll be •  Example: MacOS X: Unsaved docs & iCloud – Enter AppleID at install Sme, iCloud auto-‐enabled – Your documents are stored locally... – ...but unsaved ﬁles in apps supporSng the iCloud API are automaScally pushed into iCloud – This is unexpected to most ! hRp://support.apple.com/kb/TS4372

Slide 48

Slide 48 text

OS Cloud App

Slide 49

Slide 49 text

#3 Clouds get everywhere •  This a trend which is ongoing & not just OS X •  Has signiﬁcant impact to long established security models and boundaries •  Not just network de-‐perimiterisaSon but the break of the OS perimeter hRp://support.apple.com/kb/TS4372

Slide 50

Slide 50 text

ARackers‘ takeaways •  In the cloud, your tracks are harder for people to see •  Cloud users don’t understand the changes to their security boundaries of the new model •  API keys are everywhere and are the keys to many kingdoms •  RegulaJons fail to keep up != security

Slide 51

Slide 51 text

No content

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

No content

Slide 54

Slide 54 text

No content

Slide 55

Slide 55 text

HOW MUCH DO I SPEND ON DEFENSE X? HOW MUCH DOES AN ATTACKER HAVE TO SPEND TO BYPASS X? HOW MUCH IS DEFENSE X ACTUALLY WORTH TO ME? WHAT IS BYPASSING DEFENSE X WORTH TO AN ATTACKER ?

Slide 56

Slide 56 text

No content

Slide 57

Slide 57 text

If you take nothing else away Tradeoﬀs Asymmetries

Slide 58

Slide 58 text

Clouds trade oﬀ control for lower costs Caveat: Also reduces security granularity Clouds reduce operaSonal complexity Caveat: Increase security complexity Cloud environments constantly evolving Caveat: Security understanding must evolve also

Slide 59

Slide 59 text

Ýmir Vigfússon [email protected] Rich Smith [email protected] #TheSyndis