Dieter Van der StockMar 24
27
Monday March, 2023
📣 Sponsor
ProwlerPro is the most comprehensive tool for cloud security. ProwlerPro is trusted by orgs of all sizes, and used everyday so teams can be confident in their cloud security framework.
Sign up for free today to gain visibility and context so your org can identify, prioritize and remediate risks.
🐿 In a nutshell
This week, numerous AWS IAM Managed Policies have been updated, with a total of 27 changes. Take a look at the weekly differences below.
Chris Farris performed a new experiment by deliberately exposing an AWS Access Key to observe the outcome. The results may astonish you.
The Datadog team has published another outstanding paper, detailing a method to circumvent CloudTrail when using AWS Service Catalog. The researchers at Datadog are genuinely committed, and their findings are thoroughly documented and shared.
The AWS API Change section is now operating as intended, featuring current changes and functional URLs.
📢 MAMIP (Monitor AWS Managed IAM Policies)
Policies changed since last week:
- AWSApplicationMigrationFullAccess
- AWSCleanRoomsFullAccessNoQuerying
- AWSConfigServiceRolePolicy
- AWSDataSyncDiscoveryServiceRolePolicy
- AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
- AWSManagedServices_ContactsServiceRolePolicy
- AWSThinkboxAWSPortalAdminPolicy
- AWS_ConfigRole
- AdministratorAccess-AWSElasticBeanstalk
[...]
📊 Poll of the week
Hey folks, just a heads up that we're hitting pause on our poll section for a bit, but don't worry, it'll be back in a future edition of the newsletter!
Past week's poll:
Q: An AWS customer is deploying a web application that is composed of a front-end running on Amazon EC2 and of confidential data that is stored on Amazon S3. The customer security policy that all access operations to this sensitive data must be authenticated and authorized by a centralized access management system that is operated by a separate security team. In addition, the web application team that owns and administers the EC2 web front-end instances is prohibited from having any ability to access the data that circumvents this centralized access management system.
Answer: B (6/19 votes)
Security Newsletter - Breachforums marketplace down for now. Insecure image cropping. Pwn2Own in full swing.
[tl;dr sec] #174 - Mitigating SSRF in 2023, Isolation & Container Namespaces
Clint at tl;dr secMar 23
💸 unusd.cloud
Turn off your unusd AWS instances and save money on your bill. It's like turning off lights to save on your electricity bill, but with CPU cycles instead of wattage.
Our app scans all regions of your AWS accounts to identify assets that you might have left active by mistake and then sends you a digest report with actionable cost-optimizations.
Try it for free at: unusd.cloud
AWS Batch - 4 updated methods
Mar 23
This feature allows Batch to support configuration of ephemeral storage size for jobs running on FARGATE
Amazon Chime SDK Identity - 6 new 2 updated methods
Mar 23
AppInstanceBots can be used to add a bot powered by Amazon Lex to chat channels. ExpirationSettings provides automatic resource deletion for AppInstanceUsers.
Amazon Chime SDK Media Pipelines - 7 new 5 updated methods
Mar 23
This release adds Amazon Chime SDK call analytics. Call analytics include voice analytics, which provides speaker search and voice tone analysis. These capabilities can be used with Amazon Transcribe and Transcribe Call Analytics to generate machine-learning-powered insights from real-time audio.
Automate the deployment of an NGINX web service using Amazon ECS with TLS offload in CloudHSM
Nikolas NikraveshMar 24
Customers who require private keys for their TLS certificates to be stored in FIPS 140-2 Level 3 certified hardware security modules (HSMs) can use AWS CloudHSM to store their keys for websites hosted in the cloud. In this blog post, we will show you how to automate the deployment of …
Use backups to recover from security incidents
Jason HurstMar 22
Greetings from the AWS Customer Incident Response Team (CIRT)! AWS CIRT is dedicated to supporting customers during active security events on the customer side of the AWS Shared Responsibility Model. Over the past three years, AWS CIRT has supported customers with security events in their AWS accounts. These include the …
Simplify management of Network Firewall rule groups with VPC managed prefix lists
Mojgan TothMar 21
In this blog post, we will show you how to use managed prefix lists to simplify management of your AWS Network Firewall rules and policies across your Amazon Virtual Private Cloud (Amazon VPC) in the same AWS Region. AWS Network Firewall is a stateful, managed, network firewall and intrusion detection …
How to use Amazon Macie to reduce the cost of discovering sensitive data
Nicholas DoropoulosMar 20
Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to discover and help protect your sensitive data, such as personally identifiable information (PII), payment card data, and Amazon Web Services (AWS) credentials. Analyzing large volumes of data for the presence of sensitive information …
chime: 33 new actions, 4 new resources | 44 updated actions
Mar 25
33 new actions: CreateAppInstanceBot (Grants permission to create a bot under an Amazon Chime AppInstance), CreateMediaInsightsPipeline (Grants permission to create a media insights pipeline), CreateMediaInsightsPipelineConfiguration (Grants permission to create a media insights pipeline configuration), CreateVoiceProfile (Grants permission to create a voice profile), CreateVoiceProfileDomain (Grants permission to create a voice profile …
ivs: 7 new actions, 1 new resource | 3 updated actions
Mar 25
7 new actions: CreateParticipantToken (Grants permission to create a participant token), CreateStage (Grants permission to create a stage), DeleteStage (Grants permission to delete the stage for a specified ARN), DisconnectParticipant (Grants permission to disconnect a participant from for the specified stage ARN), GetStage (Grants permission to get stage information for …
refactor-spaces: 2 updated actions
Mar 24
2 updated actions: ListRoutes (resources), ListApplications (resources)
fwd:cloudsec
fwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense …
Chris Farris (@jcfarris@infosec.exchange) I better get cracking on my "Don't bother with encryption, its hard and the government can just decrypt it all anyway" talk.
Nick Frichette - @frichetten@fosstodon.org Don’t forget! CFP Submissions for round 1 for @fwdcloudsec are due this Friday evening. If you submit during round 1 you can get feedback to improve …
We updated our RSA SSH host key | The GitHub Blog
At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations …
Matt Fuller It’s been 13 hours and I haven’t seen any vendors claiming they could have stopped this yet - get to it LinkedInfluencers! twitter.com/githubsecurity…
Nick Frichette - @frichetten@fosstodon.org Key/credential leaks are a “when” not an “if”. Always have step-by-step run books for every important credential in your environment. The most recent…
Clint Gibler @clintgibler
🛡️ Mitigating SSRF in 2023
💯 overview of the challenges in preventing SSRF, and the pros/cons of a number of approaches:
* Allowlisting or blocklisting
* Secure by default libraries
* SSRF jail
* Network controls
* Request proxy
By @IncludeSecurity
blog.includesecurity.com/2023/03/mitiga…
96
29Mar 20 · 8:08 PM Clint Gibler @clintgibler
🤖 Offensive AI Compilation
Great list of useful resources on attacking AI models and using AI for offensive purposes:
🕵️♂️ Pentesting
🦠 Malware
🗺️ OSINT
📧 Phishing
👨🎤 Generative AI
+ more
github.com/jiep/offensive…
8331Mar 24 · 6:00 PM
Scott Piper @0xdabbad00
I dream of a day when all AWS API calls that customers can make are documented and that the AWS console uses the same APIs that customers use. I further dream of AWS using a standard interface internally such that all CloudTrail events are documented and logged uniformly.
Nick Frichette - @frichetten@fosstodon.org @Frichette_n
New cloud security research! We found a method to bypass CloudTrail logging for both read AND write API actions in AWS Service Catalog! In addition, we also reported an issue with a lack of CloudTrail logging in AWS Control Tower. securitylabs.datadoghq.com/articles/bypas…
9214Mar 20 · 5:19 PM
Ben Kehoe @ben11kehoe
Anyone who looks at the progress in AI and imagines it will usher in a utopia ignores both the very recent history of capitalism and the much older history.
Cory Doctorow (@pluralistic@mamot.fr) @doctorow
The factory owners wanted machines so simple a child could use them - because they were picking over England's orphanages and recruiting small children through trickery to a ten-year indenture in the factories. 7/
8223Mar 20 · 5:46 PM
Christophe Tafani-Dereeper @christophetd
We just released at @1ns0mn1h4ck the largest available dataset of malicious PyPI packages. Check out our talk "Finding Malicious PyPI Packages in the Wild"!
github.com/DataDog/malici…
dtdg.co/guarddog-insom…
7131Mar 24 · 11:37 AM
rowan @elrowan
Passwordless is the theme of the week? After finding @theburningmonk's post yesterday, I saw AWS released their own version github.com/aws-samples/am…
519Mar 23 · 10:37 AM Scott Piper @0xdabbad00
Another undocumented API by a cloud provider results in a cloudvuln. 😭 This follows on an AWS vuln from earlier this week from undocumented APIs: twitter.com/Frichette_n/st…
And this thread has some more:
twitter.com/0xdabbad00/sta…
Karl @kfosaaen
I'm really excited that we can finally publicly disclose this issue that we found back in July of last year.
TL;DR - The Azure Reader RBAC role could abuse a Function App API to get access to the Function App keys for Linux based Function App containers - netspi.com/blog/technical…
3911Mar 23 · 8:15 PM
Abby Fuller @abbyfuller
do it, bitch.
Twitter Verified @verified
On April 1st, we will begin winding down our legacy verified program and removing legacy verified checkmarks. To keep your blue checkmark on Twitter, individuals can sign up for Twitter Blue here: twitter.com/i/twitter_blue…
Organizations can sign up for twitter.com/i/en/verifiedo…… twitter.com/i/web/status/1…
371Mar 24 · 12:43 AM Ben Kehoe @ben11kehoe
I'm shocked, shocked I tell you, that OpenAI would try to deflect responsibility for something wrong with their product that could cause harm
332Mar 23 · 5:06 PM
Brigid Johnson @bjohnso5y
Did you know in IAM policies condition keys can be used as policy variables as the value❓This helps you compare dynamic values. With this you can ensure that credentials for instances are only used from the instances to which they were issued. Blog ➡️tinyurl.com/msrph364
248Mar 22 · 1:06 AM
Application Load Balancer now supports TLS 1.3
Just like it sounds, TLS 1.3 is now available on ALB.
https://aws.amazon.com/about-aws/whats-new/2023/03/application-load-balancer-tls-1-3/
- 🖊️ Don't miss out on the latest industry insights - stay ahead of the game by subscribing
- 📢 Gain visibility for your brand by sponsoring our content
- 💌 If you have any suggestions for future topics, let us know
