AWS Security Digest

Monday,
December 23, 2024

🥖 Palette Cleanser

Greetings festive readers,

What a ride 2024 has been! Today's issue is a special one. We're looking back at all the fun we had this year. We did have fun, didn't we?! New content will be back next week and there will be no interruption to scheduled programming.

The year was more than just content of course, it was defined by some big events and milestones. AWS launched its public vulnerability disclosure program and also made it's previously secret bug bounty, not so secret. The XZ backdoor set the internet on fire for a few weeks and cloud security vendors were at the pointy end of the response. Let's not forget the CUPS bugs. And at the end we got Resource Control Policies and organisational root account management at re:Invent.

Unrelated but important: it might feel like ASD is my baby but I am just the step father. Victor Grenu built AWS Security Digest from the ground up and ran it diligently for many years. In June he agreed to entrust me and Plerion with it going forward. Thank you Victor! None of this would be possible without you. <3

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

I put the call out to the community for their highlights and got an overwhelming response. There's not enough room for everything so here is the content that defined the year:

fwd:cloudsec presentations
A few people mentioned one talk specifically, Hacking clouds using the power of the sun by Ian Mckay. It's both fun and informative about the dangers of bit flips at AWS scale.
Introducing TrailDiscover: Simplifying Access to Security Insights about CloudTrail Events by Adan Álvarez Vilchez

Adan launched TrailDiscover to gather CloudTrail events linked to security incidents. It puts real world data in the hands of defenders.
What Do Hackers Know About Your AWS Account? by Daniel Grzelak

Awseye (pronounced o-zee 🦘🇦🇺) is an open-source intelligence (OSINT) and reconnaissance service that tracks and analyzes publicly accessible AWS data. No bias here - people actually voted for it, I promise.

My personal favourites are a little bit different. You may have noticed I have a bias towards attack research. Instead of hiding it, I've gone all in:

Amplified exposure: How AWS flaws made Amplify IAM roles vulnerable to takeover by Nick Frichette

Nick identified two variants of a vulnerability in AWS Amplify that exposed IAM roles associated with Amplify projects, allowing them to become assumable by anyone in the world.
Breaching AWS Accounts Through Shadow Resources by Yakir Kadkoda, Ofek Itach, and Michael Katchinskiy

These gentlemen discovered that it was possible to predict the names of S3 buckets used by AWS services, and sometimes manipulate data inside those buckets to gain remote code execution (RCE), full-service user takeover (which might provide powerful administrative access), manipulation of AI modules, exposure of sensitive data, data exfiltration and denial of service.
Non-Production Endpoints as an Attack Surface in AWS by Nick Frichette

Nick shared his magic for finding non-production and undocumented AWS APIs and abused some of them to find cool bugs. He also published a tool to enable anyone to do the same.

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS Security Bulletins