OWASP Atlanta 2018: Forensics as a Service
Download as PPTX, PDF2 likes463 views
This document discusses digital forensics as a service in the cloud. It begins with an introduction to challenges of digital forensics in and of the cloud. It then provides an example architecture diagram of an AWS deployment and discusses common attacks and incidents seen in cloud environments. Finally, it covers topics like evidence acquisition from AWS, tools for incident response and forensics in the cloud, and hardening strategies for cloud assets and networks.
OWASP Atlanta 2018: Forensics as a Service
- 1. Toni de la Fuente (@ToniBlyx :: blyx.com) Lead Security Operations / Senior Cloud Security Architect Digital Forensics as a Service: DFIR in the Cloud
- 2. Prowler / phpRADmin / Alfresco BART / Docs
- 3. Once upon a time… • Digital Forensics IN and OF the Cloud • Generic Challenges • Attacks • Incident Response • Hardening Security IN the Cloud!
- 4. AWS Region Amazon RDS MySQL Master Internet gateway Availability Zone 1 Availability Zone 2 Public subnet Public subnet NAT gateway EC2 Bastion 10.0.128.5 NAT gateway EC2 Bastion 10.0.144.5 Alfresco One Auto Scaling Group Elastic Load Balancing Amazon RDS MySQL Slave S3 for Shared Content Store 10.0.0.0/16 10.0.128.0/20 10.0.144.0/20 10.0.0.0/19 10.0.32.0/19 Alfresco Index Auto Scaling Group Private SubnetPrivate Subnet Alfresco Server Alfresco Server Alfresco ServerAlfresco Server Index Server Index Server Index Server Index Server * Immutable infrastructure
- 6. Disadvantages and Challenges Cloud Forensics and Operations Ubiquity Enumeration Legal jurisdiction Elasticity Preservation of evidence Data integrity Data persistence (replication) Chain of custody Evidence integrity Multi-tenancy Data attribution Chain of custody Abstract Determine the best evidence Preservation and visualization of evidence Quantity of data and Big Data Systems that cannot be investigated or managed in a traditional manner Knowledge Trained staff Continuous evolution and new features almost daily Providers Service level agreement / service level objectives Relationship client-provider / transparency
- 7. Service Level Objectives to Guarantee with Provider IaaS PaaS SaaS Provider’s network logs Web server logs Web server logs DNS providers logs Application server logs Application server logs Virtual machine hypervisor logs Tenant operating system logs Database logs Host logs Host access logs Host access logs API logs Virtualization platform logs Virtualization platform logs Management portal logs Management portal logs Management portal logs Packet capture logs Packet capture logs Packet capture logs Billing records Billing records Billing records
- 8. Traditional vs Cloud Forensics Processes Traditional Forensics Cloud Forensics Identification Identification of an event or incident Multiple tools Few tools Preservation Securitization and assessment of the scene Yes No Documentation of the scene Yes No Evidence collection: origin of the evidence Physical hardware Virtual hardware Evidence collection: location of the evidence Crime scene Provider’s data center Marking, packaging and transport Physical Digital through the Internet or physical media Acquisition / Extraction Acquisition time Slow Fast RAM acquisition Yes Dependant Hash Slow Fast Erased data recovery Possible Difficult Metadata acquisition Yes Yes Time stamp Precise Complex Installation (action) of forensic software Expensive Cheap Configuration and availability of forensic software Expensive Cheap Transport Yes No Analysis Analysis Slow Fast (potentially) Presentation Documentation of evidence Acquired evidence Data from many sources Declaration Common Difficult to explain to a judge
- 9. Storage Options Type AWS Azure GCP Objects S3 Object Storage • Buckets • 5TB max per object • Encryption In-flight and at-rest Azure Storage • Blob storage • 500TB limit per storage account • Encryption In-flight and at-rest Google Cloud Storage • Buckets • 5TB max per object • Encryption In-flight and at-rest SAN / Block EBS (Volumes) • Volume size: 1GB to 16TB (in 1GB increments) • Magnetic, SSD • Encryption available • Snapshots Azure Virtual Disks • Page blobs • Volume size: 32GB to 4TB • Standard (Magnetic), SSD premium • Snapshots • Encryption available Google Block Storage • Volume size: 1GB to 10TB • Magnetic, SSD • Snapshots • Encryption by default NAS Shared Storage (NFS4.0/4.2) • EFS File Storage (SMB3.0) Single Node File Server + Others Archive Glacier Azure Backup Google Cloud Storage Nearline Migration Import Export / Snowball Import Export Third Party Solution (Iron Mountain, etc.) CDN AWS CloudFront (CDN) Azure CDN Google Cloud CDN * Ephemeral, DBs, Queues, Caching and Storage GW not included
- 10. Common Attacks
- 11. Common incidents • Top 3: EC2, IAM, S3 – Access Keys compromise – Information leaks through misconfigured services or DNS – Phishing attacks – Compromised resources – Poisoned AMI – Application running in a role – Infection through 3rd party services – Hybrid attacks – Subdomain takeovers – Bitcoin mining – Did I say MISCONFIGURATIONS? • Other services (RDS, ES, Redshift) • What about targeted attacks?
- 12. S3 Leaks • Time Warner (BroadSoft) • Verizon • Auto Lender • U.S. Voters • And many others! https://github.com/nagwww /s3-leaks • Amazon Macie: Machine Learning, discover and classify sensitive data in AWS. PII or intellectual property.
- 13. Where to find AWS Access Keys… • UserData, CloudFormation, Metadata Server • Code: Github or other source code repositories, versions, commit history* • Public EBS volumes • Public AMIs • Public S3 buckets • Workstation or Server ~/.aws/credentials or C:UsersUSERNAME.awscredentials • Containers • Dev Tools: Vagrant images, Packer files, Bamboo, Jenkins… • Vim swap files • Service Providers (Slack bots, DataDog, CloudHealth, Okta, OneLogin, etc.) • Google… *See truffleHog from dxa4481 in Github
- 14. Some fun with Social Engineering… Change default Spotlight shortcut and don´t trust USBs!
- 16. • Notifications from AWS • Access activity (IAM) • Billing activity (Budget alerts) new cloud IDS! • API Logs • CloudWatch Events/Alarms • Service Specific Events • Dashboards • CloudWatch • Personal Health • Cost Explorer • Other • Third party (dedicated tools) • NIDS (Snort, Suricata, etc.) • HIDS (Wazuh/OSSEC, Osquery, rkhunter, Auditd) • ELK Incident Indicators https://cloudonaut.io/aws-monitoring-primer/
- 17. Cloud Incident Handling Workflow Instance Compromise Start Forensic Workstation Live or Dead Attach the Tools Volume Apply Isolation SG Credential Compromise Check new resources created Disable Keys Make API log report if enabled If found Isolate them Create a report Attach the Evidence Collection Volume Isolate it? Log in to the instance Perform Evidence Acquisition Take snapshot to all volumes Stop it Make Volumes to Snapshots Attach Volumes to Forensic Workstation Attach the Evidence Collection Volume Log in to the Forensic Workstation Analyze / Further Investigation Incident Live Dead Create Support Case with Provider Revoke Access Revoke Sessions Outside Info Acquisition (instance profile,endpo ints,metadat a, etc)_ Perform Timeline Pre-built Volatiliy frofile Pre-built LiME krnl mod RAM Acquisition Yes NIC Network Scan Create Internal Case Separate Network with Internet Access to Scan CAINE / SIFT / DEFT / FCCU / HELIX3 / FIRE Windows_Life_Response Sysinternals Nirsoft FTK Imager Autopsy Sleuthkit Trigger a Network Capture / VPC Logs TAG Resources under investigation * Hashing comparison-gold image, carving, cloud-init, search malware, IOC, etc
- 18. Assets Acquisition Specific to AWS Perform Evidence Acquisition AWS Infrastructure Logs: CloudTrail and VPC FlowLogs AWS Service Logs: S3 Logs, RDS Logs, Lambda, API Gateway, Route53, CloudFront, etc. Host Based Logs (volume snapshot) Messages/System, security, audit, applications, etc. Additional data from AWS view: instance profile, endpoints, syslogs, screen, metadata, etc More Outside: Limits, check resources creation from given date (all regions)
- 19. Digital Forensics as a Service? How to be Prepared • DFaaS: capabilities we can use from a cloud vendor to perform tasks related to Digital Forensics • Multi Account Strategy • Dedicated Account for Forensics • Dedicated Account for Security Operations • Acquisition tools ready to use • Live Data • Acquire data, what data?
- 20. • CIS Benchmark security assessment tool (52 checks + 20 additional) • New “forensics-ready” group of checks: • Checks if you are collecting all what you may need in case of an incident • Forensics as a Service helper • CloudTrail, S3, Config, VPCFlowlog, Macie, GuardDuty, CloudFront, ES, Lambda, ELB/ALB, Route53, Redshift and more • https://github.com/Alfresco/prowler
- 21. <DEMO> Prowler, specific group check for AWS forensics readiness
- 23. Digital Forensics as a Service: Tools/Challenges • Userland / Process Memory Acquisition • AWS System Manager (ssm) • aws_ir, Margaritashotgun (LiME) • Volatility and Rekall automation • ECFS: extended core file snapshot format • Containers • Analysis process • IOC • Something like LibVMI: VM introspection would help (Volatility integration) • Storage Acquisition and Processing • Depends on the Storage used • Easier for EBS Snapshots Volumes • DFTimewolf (Grr) • Multiple Account Tools, Resources and Vendors • We don’t capture just one resource! • Enterprise grade • Processing collected data • Turbinia • Plaso • Laika BOSS • BinaryAlert • Analyze data • Timeline with ALL ACQUIRED DATA? • Timesketch • EVERYTHING? Room to improve here! • Multiple data formats • Multiple sources • Correlation
- 24. Threat Response Tools • Incident Response Tool for AWS • http://threatresponse.cloud/ • Compromised AWS API credentials (Access Keys) • Mitigate compromise: Lock • Compromised EC2 instance • Mitigate compromise • Isolation • Collect evidence • Memory acquisition • Plugins • gather_host (metadata, screen, console) • tag_host • examineracl_host • get_memory • isolate_host • stop_host
- 25. <DEMO> ThreatResponse: aws_ir, margaritashotgun • Instance compromise https://youtu.be/-dnljYRMMsU
- 26. SANS Reading Room: DF Analysis of an EC2 Instance Kudos! Ken Hartman https://www.kennethghartman.com
- 27. Hardening
- 28. Instance / Network / Provider • Put all what you need in your well known AMI (gold image): • Hardening applied / Tested (Packer/Vagrant) • CIS Benchmark! • No configuration or access needed • Local tools • Osquery / Wazuh-OSSEC / rkhunter / grr • Update rules / serverless • local configuration (SELinux/AppArmour) • AuditD • Collect telemetry host network data (Snort/Suricata) • Collect everything your provider allows you • Networking • APIs / Accesses (AWS API Call Limit) • Red Team / Third party pentesting*
- 29. Auditing, Assessment and Hardening Tools • AWS • Amazon GuardDuty • Amazon Macie • AWS Trusted Advisor • AWS CloudTrail • Amazon Inspector • AWS Organizations • AWS Config Rules • Alfresco: Prowler • Wazuh (wodle) • Nccgroup: Scout2 • Netflix: SecurityMonkey • Capital One: CloudCustodian • AWS CIS Benchmark Python code and Lambda functions • CloudSploit • Widdix Hardening Templates • Awslimitchecker • Git Secrets (AWS) • Azure • Security Center • OMS Security & Compliance • Azure logs Analitics • Windows Defender • Azure Op Insights • MWR Azurite • AzSDK • AzureStackTools • GCP • Spotify: gcp-audit • SecurityMonkey • ALL: • Analytics (ELK, Splunk, etc)
- 30. Takeaways This presentation and some bits already available at: https://github.com/toniblyx/
- 31. Thanks! Special Thanks to: Ismael Valenzuela @aboutsecurity Andrew K. @andrewkrug & ThreatResponse.cloud Team Alex Maestretti @maestretti Lorenzo Martinez @lawwait Lórien Domenech @loriendr Open Source Community improving Prowler!
- 33. References • Cloud Security Alliance, Mapping the Forensic Standard ISO/IEC 27037 to Cloud Computing, June 2013 • Dr. Keyun Ruan University College Dublin, Designing a Forensic-enabling Cloud Ecosystem, 2013 • International Standard ISO/IEC 27037, Information technology — Security techniques — Guidelines for identification, collection, acquisition, and preservation of digital evidence, October 2012 • Josiah Dykstra, Digital Forensics for IaaS Cloud Computing, June 2012 • Keyun Ruan, Ibrahim Baggili (PhD), Prof Joe Carthy, Prof Tahar Kechadi University College Dublin, Zayed University, Survey on Cloud forensics and critical criteria for Cloud forensic capability: A preliminary analysis • Keyun Ruan, Joe Carthy, Tahar Kechadi and Mark Crosbie, Cloud Forensics • Keyun Ruan, University College Dublin, Cloud Forensics: challenges & opportunitiess, 2010 • NIST Cloud Computing Forensic Science Working Group Information Technology Laboratory, NIST Cloud Computing Forensic Science Challenges, June 2014 • Peter Mell Timothy Grance, NIST Special Publication 800-145, The NIST Definition of Cloud Computing, September 2011 • Report From the First Digital Forensic Research Workshop (DFRWS), A Road Map for Digital Forensic Research, August 2001 • Forensics-as-a-Service (FaaS): Computer Forensic Workflow Management and Processing Using Cloud. Yuanfeng Wen, Xiaoxi Man, Khoa Le and Weidong Shi • http://static1.squarespace.com/static/5417f7f9e4b0b77770545590/t/56f3c598906340a7f6e78dbd/1458816415654/AWS_Cloud_and_Security.pdf • https://www.blackhat.com/docs/us-16/materials/us-16-Amiga-Account-Jumping-Post-Infection-Persistency-And-Lateral-Movement-In-AWS-wp.pdf • https://alestic.com/2015/10/aws-iam-readonly-too-permissive/ • Backdooring an AWS account • Exploring an AWS account post-compromise • Disrupting AWS logging • AWS IAM "ReadOnlyAccess" Managed Policy is Too Permissive (For Us) • Access Keys will kill you before you kill the password • Account Jumping Post Infection Persistency and Lateral Movement in AWS • Disrupt CloudTrail and pwning automation tools • RSA 2017 talk: Cloud Security Automate or Die, same tittle as mine but a bit different approach • RSA 2017 talk: Securing Serverless applications in the Cloud • RSA 2017 talk: DevSecOps on the Offense: Automating Amazon Web Services Account Takeover • https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/when-a-web-application-ssrf-causes-the-cloud-to-rain-credentials-and-more/ • https://www.sans.org/reading-room/whitepapers/cloud/digital-forensic-analysis-amazon-linux-ec2-instances-38235
Editor's Notes
- #4: Contents: Dealing with Incidents AWS specifics Attacks Incident Response Assessment and Hardening
- #5: PCI-DSS compliance other for NIST, etc. Kinda Immutable infrastructure / instances (bastion) Logging externally, config management, monitoring Blue-green upgrades Canary upgrades
- #9: x1.32xlarge = $13.338 hourly 1952.0 GB RAM 128 vCPUs 3840.0 GB (2 * 1920.0 GB SSD) 25 Gigabit Network
- #13: Amazon Macie
- #14: Bamboo, Jenkins…
- #15: https://gist.github.com/toniblyx/d2cae4f4b4cb74524dc1f7b198d024c2 How to prevent this hack?? Change spotlight keys shortcut and don´t trust USBs!
- #17: https://cloudonaut.io/aws-monitoring-primer/
- #18: Assess other systems running in the same VPC Was the instance running in a role? Do we have flow logs we can grab and archive for the incident? Do we need to do live response? Do we need to preserve a snapshot for offline forensics?
- #24: Many companies like Netflix, Google, Facebook, AirBnB or Adobe are working in cloud forensics automation
- #29: Low hanging fruit
- #30: Guardduty (CloudTrail, VPCFlowLogs and DNS queries) git-secrets (git hooks) AZURE: Azure logs Analitics (https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/log-analytics/log-analytics-overview.md) AZURE: Azurite (https://github.com/mwrlabs/Azurite) AzSDK (https://github.com/azsdk/azsdk-docs) AzureStack (https://github.com/Azure/AzureStack-Tools)