® AWS Compromising fun and profit Simon Whittaker Cyber Security Director - Vertical Structure Ltd for
Slide 1
Slide 2
Prepare, Protect, Persist® • Prepare • We help you and your partners to understand how to identify and resolve potential security issues at the earliest stages with hands on ‘hack yourself first’, threat modelling and GDPR compliance workshops as well as security training for non-technical colleagues. • Protect • Using automated and manual penetration testing techniques, we provide a comprehensive security report for your Web and mobile applications, including API testing, and networks. The report highlights potential issues and their resolutions. • Persist • We ensure that your organisation benefits from continual improvements in security levels through information assurance processes, auditing and certification including ISO27001:2013 and Cyber Essentials. © Vertical Structure Ltd where applicable [email protected]
Slide 3
Qualifications © Vertical Structure Ltd where applicable [email protected]
Slide 4
Shared Responsibility Model Image from: https://aws.amazon.com/compliance/shared-responsibility-model/ © Vertical Structure Ltd where applicable [email protected]
Slide 5
What do attackers want? © Vertical Structure Ltd where applicable [email protected]
Slide 6
Working fast • Never commit credentials • Never commit credentials • Use principle of least privilege • Never commit credentials https://technodrone.blogspot.com/2019/03/the-anatomy-ofaws-key-leak-to-public.html © Vertical Structure Ltd where applicable [email protected]
Slide 7
Let’s have a play © Vertical Structure Ltd where applicable [email protected]
Slide 8
Find the user privileges © Vertical Structure Ltd where applicable [email protected]
Slide 9
Find Instance User Data © Vertical Structure Ltd where applicable [email protected]
Slide 10
Decode the User Data © Vertical Structure Ltd where applicable [email protected]
Slide 11
What instances can we manage? © Vertical Structure Ltd where applicable [email protected]
Slide 12
Stop the instance to modify data © Vertical Structure Ltd where applicable [email protected]
Slide 13
Start the instance with new User Data © Vertical Structure Ltd where applicable [email protected]
Slide 14
Find a debug SG to attach © Vertical Structure Ltd where applicable [email protected]
Slide 15
Reaching the instance © Vertical Structure Ltd where applicable [email protected]
Slide 16
Reverse Shell © Vertical Structure Ltd where applicable [email protected]
Slide 17
EC2 Escalation © Vertical Structure Ltd where applicable [email protected]
Slide 18
Show current policy attached to role © Vertical Structure Ltd where applicable [email protected]
Slide 19
Show the current role policies © Vertical Structure Ltd where applicable [email protected]
Slide 20
Get Current Policy Version © Vertical Structure Ltd where applicable [email protected]
Slide 21
Connect in and update policy as default © Vertical Structure Ltd where applicable [email protected]
Slide 22
Verification © Vertical Structure Ltd where applicable [email protected]
Slide 23
Version 1 vs Version 2 © Vertical Structure Ltd where applicable [email protected]
Slide 24
Another way © Vertical Structure Ltd where applicable [email protected]
Slide 25
See what permissions Joe has © Vertical Structure Ltd where applicable [email protected]
Slide 26
List Joe’s policies © Vertical Structure Ltd where applicable [email protected]
Slide 27
Inject a lambda script © Vertical Structure Ltd where applicable [email protected]
Slide 28
Inject a lambda script © Vertical Structure Ltd where applicable [email protected]
Slide 29
Create a DynamoDB and test it © Vertical Structure Ltd where applicable [email protected]
Slide 30
Create a table and a stream © Vertical Structure Ltd where applicable [email protected]
Slide 31
Connect Data stream/lambda © Vertical Structure Ltd where applicable [email protected]
Slide 32
Inject a record © Vertical Structure Ltd where applicable [email protected]
Slide 33
Joe is now an admin © Vertical Structure Ltd where applicable [email protected]
Slide 34
Fun and Profit © Vertical Structure Ltd where applicable [email protected]
Slide 35
Try for yourself • Cloudgoat https://github.com/RhinoSec urityLabs/cloudgoat © Vertical Structure Ltd where applicable [email protected]
Slide 36
Protection Measures • Ask questions • Some great advice from UK NCSC • Secure users • Reduce privileges • Implement tools to help you © Vertical Structure Ltd where applicable [email protected]
Slide 37
Questions? [email protected]
