通过影子资源入侵 AWS 账户.pdf

1、#SECTORCA SecTorCABreaching AWS AccountsBreaching AWS AccountsThroughThroughShadow ResourcesShadow ResourcesYakir KadkodaOfek Itach#SECTORCA SecTorCAAWS Account IDEach AWS account has a unique account ID12-digit IDSome treat it as a secret,others dont#SECTORCA SecTorCA#SECTORCA SecTorCA#SECTORCA Sec

2、TorCAhttps:/ SecTorCA#SECTORCA SecTorCAYakir KadkodaSecurityLead Security ResearcherYakirKadOfek ItachSecuritySenior Security Researcherofekitachaws sts get-caller-identity#SECTORCA SecTorCAYakir KadkodaSecurityLead Security ResearcherYakirKadOfek ItachSecuritySenior Security Researcherofekitachaws

3、sts get-caller-identity Michael KatchinskiyFormerly SecuritySenior Security Researchermike_katch#SECTORCA SecTorCAAgendaIntroduce“Shadow Resources”Showcase several AWS vulnerabilitiesIntroduce BucketMonopolyMitigations and RecommendationsDemonstrate open-source tool TrailShark#SECTORCA SecTorCA#SECT

4、ORCA SecTorCAShadow Resources AWS resources generated automatically or semi-automaticallyMost of the time,spawned without user interventionMight go unnoticedby the account owner#SECTORCA SecTorCAS3 Buckets as Shadow Resources#SECTORCA SecTorCABucket UniquenessIf you create cool-bucket-1,no one else

5、can claim that bucket nameS3 bucket names must be globally unique across all AWS accounts#SECTORCA SecTorCAAWS CloudFormation Vulnerability#SECTORCA SecTorCAWhat is AWS CloudFormation?https:/ or use an existing templateSave locally or in S3 bucketUse AWS CloudFormation to create a stack based on you

6、r template123#SECTORCA SecTorCACloudFormation S3 Bucket#SECTORCA SecTorCACloudFormation Bucket NameRegionPrefixHashcf-templates-a3gjv31ap90h-us-east-1#SECTORCA SecTorCAus-east-1Bucket name:cf-templates-a3gjv31ap90h-us-east-1AWS AccountAWS CloudFormationAWS S3 Bucket#SECTORCA SecTorCABucket name:cf-t