! • AppSec guy for 17 years ! • Director of Technology Strategy at Veracode ! • Have been researching the Cloud and building products on top of AWS since 2009 Hi, I’m Erik @silvexis
What you get from AWS • The digital equivalent of infinite empty rack space • A friendly looking web interface • A mile long list of compliance certifications ! ! ! ! ! • The rest is up to you
…and after a few months this might be you • You have 39 security groups named “Launch-wizard-x”, half of which allow all from 0.0.0.0 • Your bill is 5x what you were expecting • 2 teams are asking you why their systems disappeared and 8 more are un-reachable • You have 176 instances running and you only know what 7 of them do
• Treating AWS as just another hosting company is dangerous • For starters, it’s likely the most expensive way to use AWS • IDS and network access controls are unaware of AWS API activity • Certain low priority vulnerabilities become critical Forklifting isn’t safe either
• “If your security sucks now, you’ll be pleasantly surprised by the lack of change when you move to Cloud.”* • In reality is it gets worse because of API access and unexpected information leakage – AWS API endpoints are open by default, trumps all existing controls – Private IP’s might be public – Only thing standing between total compromise of your _entire_ datacenter is the secrecy of your API keys What’s your Attack Surface? *Chris
Hoff,
@beaker
The individual components of your system may be secure but when deployed into the Cloud, the system becomes insecure EMERGENT INSECURITY AND IT GETS WORSE AT SCALE
Instead of trying to enforce change control which creates brittle systems that are insecure and not survivable focus on creating environments that are eventually consistent with your security and operational goals ! If your system requires strict change control to maintain order, in the cloud, you will eventually have chaos. EMERGENT INSECURITY
• The following vulnerabilities can mean total data center compromise in AWS • CWE-918: SSRF • CWE-611: XXE • CWE-441: Unintended Proxy or Intermediary • CWE-77: Command Injection • Why? • Metadata! OLD VULNS NEW LIFE
• Based on RFC 3927 - Dynamic Configuration of IPv4 Link-Local Addresses • Metadata contains all kinds of awesome things, like startup scripts and your AWS access credentials • It’s not just AWS, all cloud providers have it – AWS: http://169.254.169.254/latest/user-data – Google: http://169.254.169.254/computeMetadata/v1/ – OpenStack/RackSpace: http://169.254.169.254/openstack – HP Helion: http://169.254.169.254/2009-04-04/meta-data/ – etc… • There is nothing wrong with any of this, as long as you are aware and protect it What is Cloud Metadata?
• AWS command line tool ec2-metadata will extract some (but not all!) of the metadata • To get everything use wget or curl Accessing AWS Metadata $ wget -q -O - http://169.254.169.254/latest/meta-data/! ami-id! ami-launch-index! ami-manifest-path! block-device-mapping/! hostname! iam/! instance-action! instance-id! instance-type! kernel-id! local-hostname! local-ipv4! mac! metrics/! network/! placement/! profile! public-hostname! public-ipv4! public-keys/! reservation-id! security-groups Each
one
of
these
represents
meta
data
you
can
access $ wget -q -O - http://169.254.169.254/latest/meta-data/instance-id! i-0496132e
• Prezi experienced this first hand • http://engineering.prezi.com/blog/ 2014/03/24/prezi-got-pwned-a-tale-of- responsible-disclosure/ • Andres Riancho demonstrated this in his BlackHat talk “Pivoting in Amazon Clouds” Remote Access to Metadata
• IP Restrictions, they are not just for security groups! • Keys locked down to specific IP’s could accidentally find their way in GitHub with less chance of damage • If you don’t need it or use it, you could also block it • route add -host 169.254.169.254 reject Controlling API Access {! "Version": "2012-10-17", ! "Statement":[{! "Effect":"Deny",! "Action":"*",! "Resource":"*",! "Condition":{! "NotIpAddress":{! “aws:SourceIp”:[“YOUR VPC NAT GATEWAY IP/32”]! }! }! }]! }
• Curious how fast an API key can be stolen from GitHub? • Create a key, lock it to only one IP address and watch your CloudTrail logs • You should see failed access attempts in 60 minutes or less API Honeypot Anyone?
The Full Stack Hack 3.
SSRF
or
XXE
vulnerability
exposes
EC2
Metadata,
revealing
AWS
API
Keys 1.
AWS
DNS
Reveals
Private
IP
of
web
server 2.
Private
IP
of
web
server
reveals
detailed
errors
or
admin
interface 4.
AWS
API
Key
lets
you
create
new
instances
where
your
clone
and
mount
any
existing
EBS
vol. 5.
Cloned
system
gets
you
SSH
keys
to
app
servers
and
API
key
with
IAM:*
giving
you
access
to
everything 6.
With
new
root
credentials
create
trust
relationship
with
external
account
and
clone
DB
for
quiet
extraction
RECOVERY DISASTER After a full compromise, the attacker can do more than just kill a few systems to cover their tracks, they can nuke the entire datacenter Nuke
the
site
from
orbit,
it’s
the
only
way
to
be
sure
• Lets say I have read only to EBS but no access to your servers – Actually, I have access to your servers – Clone the EBS vol’s, mount, extract whatever I need/want • Same is true of RDS, I don’t need your passwords, I just need to snapshot your DB Bypassing Auth with Clones
• How many of you have accounts or API keys with a policy that looks like this? EXCESSIVE LACK of ACCESS CONTROL {! "Version": "2012-10-17",! "Statement": [! {! "Effect": "Allow",! "Action": "*",! "Resource": "*"! }! ]! }
• Tags in AWS are one of the primary means of keeping track of things • Tags however often can contain private data that does not have strong access protections • If you use any 3rd party AWS management system like StackDriver, CloudHealth or others, your tag data is replicated to those systems TAGS
• AWS DNS from within AWS will resolve EC2 Classic public DNS entries to RFC 1918 private address • Good chance of Information Exposure (CWE-200) from web servers listening on private IP’s • A casual poke around the EC2 10.0.0.0/8 address space reveals hundreds of web servers • Remediation: Migrate EC2 Classic environments to VPC PRIVATE IS PUBLIC DNS [ec2-user@heyzeus ~]$ host example.veracodelabs.com! example.veracodelabs.com is an alias for ec2-107-22-197-187.compute-1.amazonaws.com.! ec2-107-22-197-187.compute-1.amazonaws.com has address 10.72.187.67
• Many AWS users use their bill as their IDS • So far, most of these people have been pretty damn lucky ! • Don’t be one of these people, turn on CloudTrail • Use LogStash, develop your own or buy a commercial solution to keep track of API activity LACK OF AWARENESS
• CloudAtlas analyzes the full stack of a cloud based application • Requires only readonly API access • Free SaaS service for exploring your AWS environment • www.cloudatlas.veracodelabs.com ! • Coming Soon • Web Interface not ready yet, sorry! CloudAtlas
• Things it does: • Enumerate all your services, user accounts and permissions • Track and alert on changes in near real time • Map out your applications and services • Perform analysis on services in use CloudAtlas
• Image cracking: • Capable of cracking open AMI’s and EBS volumes to enumerate applications and systems • IAM Permission Analysis • Complete analysis and reporting of who can do what to what, when and where from Adv. Capabilities
silvexis
kuribayashi4
muraoka7
johannyjm
elix
hiroyaonoe
uepon73
cheerfularge
kyoun
kentaro
ryou0634
hpprc
yowata
addyosmani
frogandcode
eileencodes
revolveconf
sferik
kastner
jasonvnalue
chriscoyier
kneath
lauravandoore
jponch
marcelosomers