3 ms·

I’m not a security researcher, but a normal backend dev (possibly) This comment intrigued me and led me down the typically great HN rabbit-hole. I found a cou

by ek750 4y ago

I’m not a security researcher, but a normal backend dev (possibly) This comment intrigued me and led me down the typically great HN rabbit-hole. I found a couple of sources related to this, fascinating, thank you! https://www.techtarget.com/searchsecurity/news/252467901/Capital-One-hack-highlights-SSRF-concerns-for-AWS https://www.techtarget.com/searchsecurity/news/252467901/Cap... https://www.shellntel.com/blog/2019/8/27/aws-metadata-endpoint-how-to-not-get-pwned-like-capital-one https://www.shellntel.com/blog/2019/8/27/aws-metadata-endpoi... I knew about SSRFs, but the ability of attackers to pivot and stack and chain minor vulnerabilities continues to amaze me. I hope AWS mitigated this metadata endpoint weakness by now.

porpoisemonkey 4y ago
> I hope AWS mitigated this metadata endpoint weakness by now. AWS offers a version 2 of the Instance Metadata Service (IMDS) API that includes mitigations for many common SSRF attacks. IIRC both IMDSv1 and IMDSv2 are turned on by default and it's a recommended AWS best practice to disable IMDSv1 when launching new instances. https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/ https://aws.amazon.com/blogs/security/defense-in-depth-open-...
- midasuni 4y ago
  Why isn’t best practice the default?
  - toomuchtodo 4y ago
    Backwards compatibility. Lots of legacy cloud infra and infrastructure as code written out there.