aws-customer-security-incidents

aws-customer-security-incidents copied to clipboard

Background

Security is an exercise in managing risk. Reviewing the common root causes of security incidents is an effective way to guide prioritized remediation efforts.

This repository seeks to index all publicly disclosed AWS customer security incidents with a known root cause. It will exclude incidents involving exposed data stores (e.g S3 bucket leaks, exposed managed or hosted databases). Those incidents are already well understood, and examples can be found cataloged in places like nagwww's s3-leaks repo, upguard's reports, hackmeggedon's annual rollup reports (2022) and Corey Quinn's LWIAWS S3 Bucket Negligence Award.

It also excludes incidents impacting individuals, such as the periodic reports of cryptomining due to compromised credentials. 1 2 3

Other Cloud Threat Trend Analysis

GCP's November 2021 Cloud Threat Intelligence report found that:

Of 50 recently compromised GCP instances, 86% of the compromised Google Cloud instances were used to perform cryptocurrency mining

Their July 2022 report also highlights that:

the most common attack vectors used across cloud providers was brute force of cloud services that are exposed to the internet and have a weak or default password ... close behind brute force attacks was the exploitation of vulnerable software

Rich Mogull's summary of a 2022 AWS re:Inforce session on ransomware highlight's that ransomware is a common problem for AWS customers, stemming from two common exploit vectors:

A traditional ransomware attack against instances in AWS. The attacker compromises an instance (often via phishing a user/admin, not always direct compromise), then installs their malware to encrypt the data and spread to other reachable instances. This is really no different than ransomware in a data center since it doesn’t involve anything cloud-specific.

The attacker copies data out of an S3 bucket and then deletes the original data. This is the most commonly seen cloud native ransomware on AWS.

Talks

The initial data was collected for a talk at BSidesCT 2020: Learning from AWS (Customer) Security Incidents slides here A follow up talk was given at OWASP DevSlop in May 2022. video, slides

A Note on Blameless Postmortems

This repository is in no way intended as a criticism of the listed companies. In the spirit of blameless postmortems ¹, our goal is to learn from incidents without an atmosphere of blame.

Catalog of AWS Customer Security Incidents

A repository of breaches of AWS customers

Catalog of Vendor Reports on AWS Customer Security Incidents

Catalog of AWS Exploits via SSRF

Server-side request forgery is a class of attack that is not cloud or AWS specific. However, the existence of cloud metadata services, such as IMDS in AWS, have historically allowed for a substantial straightforward impact when SSRF is achieved on a cloud hosted application. For that reason, we include this list of SSRF attacks against AWS environments.

• Bypassing SSRF Protection to Exfiltrate AWS Metadata from LarkSuite
• ESEA Server-Side Request Forgery and Querying AWS Meta Data
• A pair of Plotly bugs: Stored XSS and AWS Metadata SSRF
• Dropbox - Full Response SSRF via Google Drive
• Mandiant - Old Services, New Tricks: Cloud Metadata Abuse by UNC2903
• SSRF leads to access AWS metadata.
• Escalating SSRF to RCE
• SSRF Leads To AWS Metadata Exposure
• How I discovered an SSRF leading to AWS Metadata Leakage
• Exploitation of an SSRF vulnerability against EC2 IMDSv2
• Mozilla - AWS SSRF to Pull AWS Metadata and Keys

For more about this attack, please see Hacking the Cloud - Steal EC2 Metadata Credentials via SSRF

Catalog of AWS Threat Actors

Postmortem Culture: Learning from Failure

Note: There have been numerous identified incidents of Magecart exploiting S3 Global Write - in one review targeting "well over 17,000 domains"