Compromising AWS® for fun and profit
A presentation at Tech Connect Live Conference in in Dublin, Ireland by Simon Whittaker
® AWS Compromising fun and profit Simon Whittaker Cyber Security Director - Vertical Structure Ltd for
Prepare, Protect, Persist® • Prepare • We help you and your partners to understand how to identify and resolve potential security issues at the earliest stages with hands on ‘hack yourself first’, threat modelling and GDPR compliance workshops as well as security training for non-technical colleagues. • Protect • Using automated and manual penetration testing techniques, we provide a comprehensive security report for your Web and mobile applications, including API testing, and networks. The report highlights potential issues and their resolutions. • Persist • We ensure that your organisation benefits from continual improvements in security levels through information assurance processes, auditing and certification including ISO27001:2013 and Cyber Essentials. © Vertical Structure Ltd where applicable [email protected]
Qualifications © Vertical Structure Ltd where applicable [email protected]
Shared Responsibility Model Image from: https://aws.amazon.com/compliance/shared-responsibility-model/ © Vertical Structure Ltd where applicable [email protected]
What do attackers want? © Vertical Structure Ltd where applicable [email protected]
Working fast • Never commit credentials • Never commit credentials • Use principle of least privilege • Never commit credentials https://technodrone.blogspot.com/2019/03/the-anatomy-ofaws-key-leak-to-public.html © Vertical Structure Ltd where applicable [email protected]
Let’s have a play © Vertical Structure Ltd where applicable [email protected]
Find the user privileges © Vertical Structure Ltd where applicable [email protected]
Find Instance User Data © Vertical Structure Ltd where applicable [email protected]
Decode the User Data © Vertical Structure Ltd where applicable [email protected]
What instances can we manage? © Vertical Structure Ltd where applicable [email protected]
Stop the instance to modify data © Vertical Structure Ltd where applicable [email protected]
Start the instance with new User Data © Vertical Structure Ltd where applicable [email protected]
Find a debug SG to attach © Vertical Structure Ltd where applicable [email protected]
Reaching the instance © Vertical Structure Ltd where applicable [email protected]
Reverse Shell © Vertical Structure Ltd where applicable [email protected]
EC2 Escalation © Vertical Structure Ltd where applicable [email protected]
Show current policy attached to role © Vertical Structure Ltd where applicable [email protected]
Show the current role policies © Vertical Structure Ltd where applicable [email protected]
Get Current Policy Version © Vertical Structure Ltd where applicable [email protected]
Connect in and update policy as default © Vertical Structure Ltd where applicable [email protected]
Verification © Vertical Structure Ltd where applicable [email protected]
Version 1 vs Version 2 © Vertical Structure Ltd where applicable [email protected]
Another way © Vertical Structure Ltd where applicable [email protected]
See what permissions Joe has © Vertical Structure Ltd where applicable [email protected]
List Joe’s policies © Vertical Structure Ltd where applicable [email protected]
Inject a lambda script © Vertical Structure Ltd where applicable [email protected]
Inject a lambda script © Vertical Structure Ltd where applicable [email protected]
Create a DynamoDB and test it © Vertical Structure Ltd where applicable [email protected]
Create a table and a stream © Vertical Structure Ltd where applicable [email protected]
Connect Data stream/lambda © Vertical Structure Ltd where applicable [email protected]
Inject a record © Vertical Structure Ltd where applicable [email protected]
Joe is now an admin © Vertical Structure Ltd where applicable [email protected]
Fun and Profit © Vertical Structure Ltd where applicable [email protected]
Try for yourself • Cloudgoat https://github.com/RhinoSec urityLabs/cloudgoat © Vertical Structure Ltd where applicable [email protected]
Protection Measures • Ask questions • Some great advice from UK NCSC • Secure users • Reduce privileges • Implement tools to help you © Vertical Structure Ltd where applicable [email protected]
Questions? [email protected]
We will demonstrate the ease with which a malicious user can escalate privileges and own an AWS account through a very simple IAM mis-configuration.
This will include a demonstration on our own vulnerable AWS account and show a number of tools and methods for testing, compromising and protecting your accounts.
Resources
The following resources were mentioned during the presentation or are useful additional information.
