6 ms·

Does anyone know how she gained the IAM role? Many comments mention her exploiting a misconfigured WAF to gain the role needed to access the S3 bucket, but that

by poxrud 7y ago

Does anyone know how she gained the IAM role? Many comments mention her exploiting a misconfigured WAF to gain the role needed to access the S3 bucket, but that is not enough detail to understand the attack.

shifty-key 7y ago
Well let's look at some of the policies typically attached to a WAF (https://docs.aws.amazon.com/waf/latest/developerguide/access-control-identity-based.html https://docs.aws.amazon.com/waf/latest/developerguide/access...) Maybe instead of waf:* for the action, it was just * ? { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:*" ], "Resource": [ "arn:aws:waf::444455556666:webacl/112233d7c-86b2-458b-af83-51c51example" ] } ] }
Scoundreller 7y ago
It sounds like that’s the critical detail that is unknown or deliberately being withheld. Probably lots of vulnerable setups out there unless C1 brewed its own, which doesn’t sound like it’s the case.
- howard941 7y ago
  What are the best practices when advising IT? iAm and SSO and windows authentication stuff are strange other worlds to this firmware dweeb
foobiekr 7y ago
This is the only question that matters and the lack of information is interesting.
spullara 7y ago
It sounds to me like she got access to an instance running on AWS and used its role to access S3. How she got access to that instance hasn't been revealed but likely to be vulnerable software running on it that would have been protected by the WAF. All assumptions but my guess is that the particular vulnerability exploited is probably not that relevant to people in general.
ownagefool 7y ago
FBI Report suggests something, probably an instance, was left opened to the world. Misconfigured firewall is what they said. It's unclear why the resource couldn't widthstand attack, maybe it had known vulerable software, a weak password, I'm not sure it's been published, but something happened. Whatever it is was able to assume the *-WAF-Role which had an amazing amount of access. Given the name of the role and the stupid amount of access, I'd wager it was some shitty security product, but who knows. Maybe we'll find out.
- akamai 7y ago
  modsec
  - october_sky 7y ago
    What's wrong with modsec?
    - akamai 7y ago
      Nothing. The problem here was not the waf, but the credential/role being compromised.
      - ownagefool 7y ago
        Apparently it was both. The WAF was used to SSRF the metadata service which would have exposed the role. Why a WAF role needed so much access to data is something that's hard to explain, and would suggest a major fuckup by the teams involved.
  - ownagefool 7y ago
    Doubt it. Modsec wouldn't need access to all your data, would it? Something commercial that was bought by a ciso or security person who has no common sense, that asks to specifically be configured with access to that much data. That's my bet.
- Aperocky 7y ago
616c 7y ago
I'd be curious to know since C1 is responsible for a popular open source tool for reporting and remediation of AWS configuration, security and otherwise. Look up cloudcustodian. That being said, breaking into an instance with a bad S3 role is a foregone conclusion once on that EC2 instance. It will be interesting to learn details. Common mistake is allowing S3 policies and other IAM policies in general from any was account ID not just "yours" which might explain the TFA and other threads here that indicate the accused somehow has data from other companies not just C1.

by poxrud 7y ago

shifty-key 7y ago

Well let's look at some of the policies typically attached to a WAF (https://docs.aws.amazon.com/waf/latest/developerguide/access-control-identity-based.html https://docs.aws.amazon.com/waf/latest/developerguide/access...) Maybe instead of waf:* for the action, it was just * ? { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "waf:*" ], "Resource": [ "arn:aws:waf::444455556666:webacl/112233d7c-86b2-458b-af83-51c51example" ] } ] }

Scoundreller 7y ago

It sounds like that’s the critical detail that is unknown or deliberately being withheld. Probably lots of vulnerable setups out there unless C1 brewed its own, which doesn’t sound like it’s the case.

howard941 7y ago
What are the best practices when advising IT? iAm and SSO and windows authentication stuff are strange other worlds to this firmware dweeb

foobiekr 7y ago

This is the only question that matters and the lack of information is interesting.

spullara 7y ago

It sounds to me like she got access to an instance running on AWS and used its role to access S3. How she got access to that instance hasn't been revealed but likely to be vulnerable software running on it that would have been protected by the WAF. All assumptions but my guess is that the particular vulnerability exploited is probably not that relevant to people in general.

ownagefool 7y ago

FBI Report suggests something, probably an instance, was left opened to the world. Misconfigured firewall is what they said. It's unclear why the resource couldn't widthstand attack, maybe it had known vulerable software, a weak password, I'm not sure it's been published, but something happened. Whatever it is was able to assume the *-WAF-Role which had an amazing amount of access. Given the name of the role and the stupid amount of access, I'd wager it was some shitty security product, but who knows. Maybe we'll find out.

akamai 7y ago
modsec
- october_sky 7y ago
  What's wrong with modsec?
  - akamai 7y ago
    Nothing. The problem here was not the waf, but the credential/role being compromised.
    - ownagefool 7y ago
      Apparently it was both. The WAF was used to SSRF the metadata service which would have exposed the role. Why a WAF role needed so much access to data is something that's hard to explain, and would suggest a major fuckup by the teams involved.
- ownagefool 7y ago
  Doubt it. Modsec wouldn't need access to all your data, would it? Something commercial that was bought by a ciso or security person who has no common sense, that asks to specifically be configured with access to that much data. That's my bet.
Aperocky 7y ago

616c 7y ago

I'd be curious to know since C1 is responsible for a popular open source tool for reporting and remediation of AWS configuration, security and otherwise. Look up cloudcustodian. That being said, breaking into an instance with a bad S3 role is a foregone conclusion once on that EC2 instance. It will be interesting to learn details. Common mistake is allowing S3 policies and other IAM policies in general from any was account ID not just "yours" which might explain the TFA and other threads here that indicate the accused somehow has data from other companies not just C1.