3 ms·
When AWS came out I was pretty sure there would be escapes. I mean, I can escape my normal account on my computer to root over and over. We see Chrome / web bro
by onphonenow 5y ago
When AWS came out I was pretty sure there would be escapes. I mean, I can escape my normal account on my computer to root over and over. We see Chrome / web browser escapes all the time.
AWS has actually (at very large scale) seemed to avoid tenant to control plane escapes. That HAS to be a result of some type of in depth defense?
The other thought - I wonder how much access even their own engineers have? If their engineers don't have easy customer data access it may make it a bit harder to chain over to other accounts. A lot of control plane stuff you realize is there so internal staff can jump around easily.
- mooreds 5y agoI'm not aware of any public documentation about the defense in depth strategies. Corey's done some tweets about things like the S3 read bug. Stuff like https://twitter.com/QuinnyPig/status/1473705669517791253 https://twitter.com/QuinnyPig/status/1473705669517791253 I'd also look at the re:invent channel, lots of time there is info in there that isn't necessarily publicly documented: https://www.youtube.com/c/amazonwebservices/search?query=security https://www.youtube.com/c/amazonwebservices/search?query=sec...
- onphonenow 5y agoBut the interesting thing about the S3 read bug, because AWS blocks support from reading S3 data on the control plane level, even though the IAM permission had read permissions support COULD NOT read any customer data. https://aws.amazon.com/security/security-bulletins/AWS-2021-007/ https://aws.amazon.com/security/security-bulletins/AWS-2021-... This is that kind of example, even with a total possible failure here, even AWS support staff still couldn't actually do anything. The transparency is very high on AWS. All S3 access is logged, the policies for the support role are public (does Azure provide this) and all changes to polices are logged.
- mooreds 5y agoI ran across this video from a distinguished engineer at AWS: https://www.youtube.com/watch?app=desktop&v=4J8REvs7zaY https://www.youtube.com/watch?app=desktop&v=4J8REvs7zaY Recent and worth a watch.
- belter 5y agoDefense in depth starts with Nitro. Worst I can recall was kind of this: "Hello from the Other Side: SSH over Robust Cache Covert Channels in the Cloud" https://gruss.cc/files/hello.pdf https://gruss.cc/files/hello.pdf "Black Hat Asia 2017: Hello From the Other Side" "Live-streaming a music video over the cache between two Amazon EC2 instances." https://youtu.be/yPZmiRi_c-o https://youtu.be/yPZmiRi_c-o https://news.ycombinator.com/item?id=13995374 https://news.ycombinator.com/item?id=13995374 Azure though ...is just a joke on the Cloud gods.