Dev secops on the offense automating amazon web services account takeover

SESSION ID:SESSION ID:
#RSAC
Javier Godinez
DevSecOps on the Offense: Automating
Amazon Web Services Account Takeover
IDY-W10
Founding Member
DevSecOps.org
@isomorphix
Ian Allison
Founding Member
DevSecOps.org
@iallison

#RSAC
Disclaimer
2
This is not an Amazon Web Services (AWS) issue
This is a DevOps education issue
It is the user’s responsibility to understand the technology being used
With power user privileges come great responsibilities

#RSAC
How our Grandfathers Ran a Stack
3
Glen Beck (background) and Betty Snyder (foreground) program ENIAC in BRL building 328. (U.S. Army photo)

#RSAC
How our Mothers Ran a Stack
4
Lawrence Livermore National Laboratory [Attribution], via Wikimedia Commons

#RSAC
© 2007 Nuno Pinheiro & David Vignoni & David Miller & Johann Ollivier Lapeyre & Kenneth Wimer & Riccardo Iaconelli / KDE, via Wikimedia Commons
5
aws ec2 run-instances ami-12345678 -t m3.large -k $my-key-pair -g $my-security-group
How We Run a Stack

#RSAC
6
Attack Surface + Misunderstanding of Technology == Low Hanging Fruit
The Cloud is Ripe for the Picking

#RSAC
Acceleration into the Cloud
7
Information Security Job Postings DevOps Jobs Postings

#RSAC
Understanding the Technology You Use
8
How fast can I move while still staying safe?
Always develop in separate account (Blast Radius Containment)
Read the docs for everything and make conscious decisions and
document those decisions
Attackers will try to leverage everything against you
Bleeding edge does not mean stable and secure. However, it can be
with enough testing

#RSAC
Instance
9
Virtual host
Virtual environment on
Xen hypervisor
Feels very much like a
host running on bare
metal
Hypervisor
Instance
Operating System

#RSAC
Metadata Service
10
Internal HTTP service
that provides Instances
information about its
environemt
Available from host at
http://169.254.169.254/
Provides temporary
credentials to hosts with
instance profiles
Hypervisor
Instance
Metadata
OS
Instance
OS

#RSAC
Instance Profile
11
AWS construct that maps
a role to an instance
Instance may or may not
have a profile associated
with it
Instance

#RSAC
AWS Identity and Access Management Overview
12
Users
Groups
Roles
Policies
Effect
Actions
Resources
Condition

#RSAC
The Good
13
Policy is specifically created for
the application
Least privilege
Made to be as granular as
possible

#RSAC
The Bad
14
ec2:*
iam:*
anything:*

#RSAC
The Ugly
15
All Access
Great for Development
Really Bad for Security

#RSAC
16
What Does Ugly Really Look Like?
The best way to determine whether you truly have an ugly duck is by exploiting the
most dangerous vulnerabilities.

#RSAC
How do we catch up?
17
Through automation with a dash of Ruby

#RSAC
AWS Create IAM User (CIAMU) Module
18
Allows for the creation of a user with Admin Privileges to the
AWS account
Needs access to AWS Access Keys or Instance Role with:
iam:CreateUser
iam:CreateGroup
iam:PutGroupPolicy
iam:AddUserToGroup
iam:CreateAccessKey
If you have instances/instance roles with this combination of
IAM privileges it’s very dangerous.

#RSAC
AWS Launch Instances Module
19
Launches an EC2 instance with a Public IP
Required Privileges:
ec2:RunInstances
ec2:ImportKeyPair
ec2:CreateSecurityGroup
ec2:AuthorizeSecurityGroupIngress
ec2:Describe*
Can launch instance with Instance Profile
Can launch cluster of Instances
Can automate tasks via bootstrap

#RSAC
AWS IAM Account Lockout Module
20
Requires an IAM admin role (created by CIAMU module)
Enumerates all users and access keys
Accepts a user to keep
Locks out all other accounts
Allows security teams to protect potentially compromised accounts

#RSAC
Demonstration Network Diagram

#RSAC
Upcoming Modules and Ongoing Projects
23
AWS IAM privilege enumeration module
AWS Lambda module
AWS s3 bucket and access enumeration
module
Cumulus Cloud Attack Toolkit
AWS
Google Cloud Platform
DevSecOps.org Community
https://github.com/devsecops/lambhack

#RSAC
24
Helping you get from ugly to…

#RSAC
How Apply This Knowledge
25
Read the AWS IAM Best Practices Documents:
http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
Monitor IAM actions using AWS CloudTrail
Get creative with AWS services: Config + CloudWatch Events + Lambda
Audit your AWS Account IAM Policies and Roles
Red Team your applications and instances
Think to yourself: “How would an attacker use this against me?”
Use repeatable secure patterns: https://github.com/devsecops
Help build awareness through community: http://www.devsecops.org

#RSAC
Use sshexec to gain a foothold

#RSAC
Retrieve temporary credentials

#RSAC
Enumerate the Metadata service

#RSAC
Escalate privileges on account A

#RSAC
Setup a tunnel and scan for vulns

#RSAC
Launch a new instance with Admin privs

#RSAC
Establish a session with new host

#RSAC
Escalate privileges on account B

Dev secops on the offense automating amazon web services account takeover

More Related Content

What's hot (19)

Similar to Dev secops on the offense automating amazon web services account takeover (20)

More from Priyanka Aash (20)

Recently uploaded (20)

Dev secops on the offense automating amazon web services account takeover