AWS Security Digest

Monday,
August 12, 2024

🥖 Palette Cleanser

Blackhat and Defcon happened. Hope everyone had a good time. I'm sure it was great. I don't have much gossip to share (yet?). Send gossip to gossip@awssecuritydigest.com and I'll give it the appropriate treatment.

One AWS security presentation made noise and leads this week's chef's selections. One event organiser made some horrible career choices that deserve our ire.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

Breaching AWS Accounts Through Shadow Resources by Yakir Kadkoda, Michael Katchinskiy & Ofek Itach

SC Magazine did a solid job interviewing the presenters and summarising the juicy bits. Some AWS services create and use buckets automatically as part of how they work. It was possible to pre-register buckets with predictable names, and have AWS services interact with them in ways that were bad for customers. AWS has fixed the issues but the techniques are cool and make me wonder, 'what else'?
AWS IAM Privilege Escalation Leads to EC2 Ransomware Deployment by Adam Messer

This is a cool approach to awesome content - simulate an AWS ransomware deployment, do forensics on it take the reader through the evidence. If Windows on AWS is your thing, this is a fun read.
Emerging phishing campaign targeting AWS accounts by Scott Piper & Gili Tikochinski

A short and sweet look at how cyber bandits are taking off with your credentials, after many clicks and redirects. Using AWS services to phish AWS service users is a nice touch. The screenshots and indicators of compromise are worth a gander - that's British for squiz, which Australian for look.

Bonus: Surprising behaviour in AWS web console session duration by Aidan Steele

🥗 AWS security blogs

How to implement Zero Standing Privileges with CyberArk for securing access to the AWS console by Rajendra Kulkarni
Review your Amazon Aurora and Amazon RDS security configuration with Prowler’s new checks by Sanjeet Singireddy
From Data Chaos to Cohesion: How OCSF is Optimizing Cyber Threat Detection by Mark Terenzoni
National framework for AI assurance in Australian government: Guidance when building with AWS AI/ML solutions by Natacha Fort

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities