house
[Music]
made Cloud Ops for red teamers in case
anyone's wondering who I am I am John
Ventura back in the day I was part of
issx force the original X-Force since
then I've worked for a number of Cl a
number of software service providers
Platformers and service providers I've
done some work in cloud computing
there's been some lessons learned a lot
of that's been learned the hard way
hopefully today you'll be learning it
the easy way along the way they've also
published some work publicly some people
call that security research so if you
want to see I'm a security researcher
I'm not going to disagree with that also
because this talk is how the sausage is
really made if you want to say I'm the
Sausage King of Chicago I'm not going to
disagree with that either
all right so this is what we're doing
today today we are going to learn by
building infrastructure security is huge
it's holistic it touches a lot of
different areas of computing maybe all
the different areas of computing
and how do you learn it how do you stay
fresh uh we're always learning I think
one of the better ways to do that is uh
through development build something code
something choose a project that's maybe
a little bit beyond what you're
currently able to do because you're
gonna you're gonna have stumbling blocks
you're gonna have hurdles that are hard
to get to uh jump over that's okay
because the people who are building the
systems that you're going to be
assessing or breaking into they face
those same stumbling blocks that you're
facing along the way and that's where
the vulnerabilities lie so if you want
to get better at security development is
absolutely a really uh valid path
towards that and we'll be exploring that
today of course
development is not the only way to learn
security a lot of people like ctfs
Capture the Flag exercises but what
happens if you go beyond that maybe you
want to host a CTF you know for all your
friends well you're going to need a
stable secure environment to do that and
we're going to be discussing some of the
tools and techniques that will enable
you to do that also
if you're on a red team you will need a
controlled environment to test from
you'll see how to build that too or
maybe you want a environment to test out
the new exploits the new techniques and
and you will learn proper ways to do
that I know a lot of people here uh you
know you've got those ideas for startups
and maybe you've got uh maybe you want
to do the you know Uber for firewall
rules well you're going to need a back
end for that so if you've got that great
startup idea you know uh it's not
necessarily security related or whatever
but you're in the right place
um so
how are we gonna
so are we going to build that well I'm
going to tell you how we're not going to
build that
today we're having a funeral for the
mouse okay
all of the major Cloud providers uh
sorry about that the guest of honor
almost didn't show up but that's okay
because uh you know we miss him uh all
the major Cloud providers they uh
they give you these wonderful GUI based
tools you can point and click you can
Define your cloud-based resources you
can Define the the relationships between
them your whole Cloud environment but uh
they're insufficient they're going to
lead you down some dark paths and
there's a better way
here's that better way we're talking
configures code you are going to write
code to Define your Cloud environment
the resources how they talk to each
other the whole thing and there are some
real good benefits to this some great
benefits not the least of which is once
you've typed out that code that
description of how you want your Cloud
environment to be you're going to have a
canonical record of what's supposed to
be there if changes are made you know
what the original plan was because you
typed it all out
and you can enforce best practices so
you want some you want secure Computing
and imagine if you're here you want
secure Computing well
uh two heads are better than one it
facilitates collaboration if you just
you pick up that most you start pointing
and clicking how do you know you did it
the right way if you have a record of
what you did someone can audit that or
you can avoid anti-patterns the the
guise they they encourage you to do some
choices that you're not going to want to
make much easier to avoid those bad
choices if you're if you're doing code
you'll see what I mean if you don't
believe me and redeployment
maybe you have a production environment
you probably have a production
environment and if that's true
you need a staging environment uh
sooner or later you're going to have to
fix something in that production
environment maybe do some upgrades and
increase capacity
whatever uh but how do you know your
changes are going to work well you take
that code that you use to build your
production environment you build it
somewhere else in a different project in
a different account and then you make
your changes there you test them out you
make sure it doesn't blow up make sure
everything works there's efficacy and
once you're satisfied you once you know
it's fine
take those changes apply them to
production and uh there you go you've
got some stability there you know it's
not going to blow up because you tested
it try doing that with point and click
now before we move on I want to address
uh this image on screen here
um obviously this man is Richard Pryor
but
in this still he's playing Gus Gorman
Superman's greatest friend of me and if
if you watch the movies if you know what
if you know uh your lore there you know
Gus Gorman hacks infrastructure so
throughout this presentation I've
included images of 80s Hackers from
movies pop culture TV shows all that and
I know they inspired a lot of us to be
here to be in this room today today
they're going to inspire us for either
learning how to do cloud computing
securely or they're going to inspire us
to you know explain other people's
mistakes like uh like Gus Gorman and um
honestly uh look that Zack Snyder guy he
you know he did the scenario cut he gave
us a four-hour Super Friends movie and
where's Gus Gorman I don't know but he's
here tonight so he's gonna Inspire us
all right so um how do you do configures
code I'm not just going to tell you how
to do it I'm going to show you how to do
it and the first step in that journey is
to figure out what software you can use
what software is available thankfully
for us all the major Cloud providers and
here I'm I'm only listing three of them
I realize Alibaba Cloud exists if you
use it you're you're beautiful but we're
talking about the big three here at a
usgcp Azure they all have configures
code solutions that come with the CLI
with the the command line interface
program that they already give you so if
you're using AWS you can use cloud
formation gcp you can use deployment
manager Ezra has resource manager
they're all great they all do the job
but they're lacking something really
important and that none of them are
multi-cloud and I think you should want
to be multi-cloud uh if your Enterprise
is married to one of these providers you
know and that's pretty common uh what
happens when that provider starts
charging more than you want to pay or
their pricing becomes
non-competitive what happens when one of
the other providers comes up with a new
tool or a new service
that you want to use you need some you
need some multi-cloud in your in your
platform and and honestly the the new
services are coming out I think AWS
probably published three or four of them
all we've been talking here you know
especially in the AI space there's some
exciting tools uh Toys you should be
playing with uh don't be locked into one
provider fortunately for us there are
configurus code providers that are
multi-cloud like you should be
there's terraform there's ansible
there's Chef in this presentation we
will have code samples and if I go too
quickly don't worry about it they're in
my GitHub you'll get the link at the end
uh we'll show you how to do certain
things in terraform all the examples but
I'm not here to sell you on terraform
I'm only here to sell you on configures
code on best practices on security uh
ansible Works Chef works if there's a
tool that can do this that you're
already comfortable with go ahead and do
that but uh today today's a there's
going to be a lot of terraform also I'm
not just uh Tony you should be
multi-cloud this presentation is going
to be multi-cloud you're going to see
examples in AWS and gcp one of the
things I hope you get from this
presentation is the idea that
a lot of the service offerings between
the cloud providers if you don't if you
don't realize this already a lot of
those service offerings map one for one
and uh we'll demonstrate that here but
if you do want to Port your your entire
environment from one cloud provider to
another if you have a configurus code
multi-cloud provider you can certainly
do that you'll see that that is not
unreasonable
so uh I don't know the backgrounds of
everybody here today that's fine uh
Security's huge not everybody has the
same skill set and you might be telling
yourself hey I I don't know devops I
don't know how to learn that it is more
simple than you might think
and here's a basic command so you learn
these commands you can get started you
can you can go uh terraform not as hard
as it looks terraform in it that is your
first step into this much larger world
if you take your code base and you take
your uh your production environment
terraform in it will sync that up
terraform is going to keep track of
everything it built and you that's how
you initial initialize that it's going
to look at the code it's going to look
good in reality and it's going to start
tracking from there
terraform plan uh you've got your code
you're going to build things you're
going to delete things you're going to
change things what's terraform going to
do for you what it's going to do to you
terraform plan is going to show you on
your screen all those changes additions
deletions whatever before you destroy
yourself hopefully it warrants you
terraform apply that
you want to render your code you want to
make that real there you go that's the
command not that hard uh terraform
format so there's a lot of arguments
that people get into fairly regularly
one of the bigger ones is tabs versus
spaces I'm not going to check the
position in that I honestly think the
the real answer there is consistency
but terraformant will format your code
it's going to make it readable
consistently please make your code
readable uh terraform destroy so we use
the example of a capture the flag
exercise earlier let's say you're done
with that CTF somebody won it was a
great time but you don't want to keep
paying for those resources terraform
destroy is going to delete everything uh
save you some money clean up after
yourself
terraform import uh that's hero mode so
when you take a new job especially in
any kind of it related field you are
inheriting the mistakes and the tech
debt of the of the person who sat in
that chair before you and if that person
picked up that Mouse and made a whole
Cloud environment that way terraform
import is the path towards bringing that
uh probably poorly built Cloud
environment into configure's code uh
it's going to be meticulous that's not
easy but that is uh that's the way
and finally terraform State list uh like
I've been saying terraform will keep
track of everything that it built
everything that it's tracking if you
want to see that there you go it's going
to show you the list
and this is what we're going to build
today this is a data flow diagram for a
sausage tracker we're going to track all
the sausage in the world and uh here's
that data this is how it goes
um
you can build something much larger than
this this is just isn't just this is
just an example if you could build
something Fortune 500 scale larger than
I can even imagine it were smaller if
it's a personal thing you can do all
that don't think that you're limited to
something this scale
first thing we're going to do is we're
going to import that data into a bucket
for those who might not be Cloud aware
that's okay you can think of a bucket as
being more or less a file system that
lives out in the cloud you can store
your files in it there's directories or
if you want to call them folders there's
folders and you can share those files
and directories easily between different
systems and once the data gets imported
in there we have what I consider to be
the heart of the system we have a
virtual machine a lot of times people in
the cloud call those instances
and I'm probably going to go back and
forth but this virtual machine or
instance is going to import that data
from the bucket it's going to normalize
it and then it's not going to save it
locally at least not for very long and
you you'll see why shortly it's going to
save that data in an external database
server also part of the environment
external to itself but not external to
you know to your cloud
and once it becomes time to query that
data our sausage hacker you can see here
at the bottom of the screen here she's
much cooler than any of us she and only
she will access that virtual machine
she'll query that machine that machine
is going to go be a go between between
the database server she knows what's
going on with sausage more than the rest
of us
now we're going to start building this
environment by looking at that virtual
machine or that instance and we're going
to build it with an auto scaler an auto
scale are also called an auto scaling
group allows you to scale up or scale
down a cluster so if you want uh tens
thousands I don't know how many you can
afford uh copies of the same virtual
machine processing data because maybe
you have data spikes and auto scaler
will help you with that if that kind of
scaling appeals to you then I'm going to
ask you please look into kubernetes
looking at Docker swarm that's that's
more of a containerization thing but
Auto scalers will do it too that's not
where we're using Auto scalers for auto
scalers are going to help us promote
stability stability is not necessarily
security but it's definitely in the same
same arena there
so we're going to be using an auto
scaler it's going to help us out a
couple of things we're not going to do
and this relates directly to those
anti-patterns that I mentioned a lot of
times when you are pointing and clicking
uh those gooeys they want you to go down
some dark paths and we're going to avoid
those paths and we're going to do it
with configures code much easier we're
not going to be coerced and specifically
what I mean by that is we aren't going
to be using default rules uh if you are
doing anything in a cloud environment
you are accessing an API even if you
don't realize it if you're just looking
at things making changes adding things
deleting things whatever it's all an API
access to that API is conducted with
identity and access management or IAM
and I am depends on roles your resources
get assigned a role you get assigned a
role or an identity however you want to
put that and
uh you will have access to certain parts
of the API and not others that default
role especially in gcp the default role
that the default rules are way too
powerful that's not personal the least
privileged that's a trap and we're going
to avoid that similarly no remote access
we're going to make it nearly impossible
for anyone outside this environment to
access it again our sausage hacker she's
the only person who should be accessing
this system we're going to make sure of
it and there's definitely some
anti-patterns that we're going to be
avoiding there and finally we mentioned
it earlier all of that sausage data is
going to be saved to that database
server that we built
you'll love it
so here is the first part of the auto
scaler or the auto scaling group this is
some code for what I'm going to call a
group manager in uh in AWS and the first
thing I want to draw your attention to
is that that row of One's near the top
of the screen
that's our capacity how many of copies
of this machine do we want to run here
we are running one no more no fewer at
any given time maximum minimum capacity
our desired capacity all one we don't
really want to scale this up we don't
want to scale it down that's not what
we're doing here we're not we're not
pretending to be you know kubernetes
here we're we're doing stability and how
are we doing stability if you see in Red
Letters if you see ec2 there we are
telling the group manager
check on this machine do some health
checks keep checking it up on it if that
if this machine ever becomes unhealthy
if it's non-responsive delete it remove
it from the universe and replace it with
an identical copy that's going to keep
on trucking keep on going processing our
data so if that machine becomes wedged
if it becomes inoperable you know we're
going to still keep track in the sausage
and um
just to look ahead a little bit that's
why we're not that's why we have that
external database server because uh if
this machine does become inoperable we
don't want to lose that sausage data
we'll want to keep tracking it and
here is a group manager uh for uh for
gcp again multi-cloud well you got that
really nice one for one mapping in in
service offerings now here we only have
two ones in the configuration we have a
maximum and a minimum because we only
want one copy of that machine running no
more no fewer under those ones you're
going to see 60 that is the cooldown
period it was 300 in the last slide
those numbers are kind of made up uh use
what works for you but we're trying to
prevent a boot loop here those health
checks are great but so what you bring
up a virtual machine it loads up uh you
know it's got a boot process it needs to
wake up
you don't want to do the health checks
before it has its coffee
uh if you do that it's going to fail the
health checks during the Buddha process
and then it's going to get killed the
next one's going to fail and get killed
and then you're in a really awful boot
loop that cooldown period that's how we
avoid it again 300 seconds in the last
one one for one mapping it's pretty
great so we've told the cloud uh how we
want to run that machine but we have not
talked about well we want that machine
to be like what we want it to do
here's a profile maybe you want to call
it a template here's the ews version and
I want to address
direct your attention there to that big
long hexadecimal ASCII representation
number there that's the image ID
uh Amis or machine images if you don't
already know those are comparable to
isos so if you want to install your
favorite Linux distro you're going to
need niso
unfortunately for us those Cloud
providers they've thought of this they
have machine images already there
waiting for you to use them for probably
what is your favorite Linux distribution
they probably have it in there already
that code number there that is for
Ubuntu 2204 which is what we're using
I'm not endorsing Ubuntu they'll like a
different Linux go ahead I'm not going
to have that argument because they
probably support it they even support a
lot of alternative os's so I don't know
if you're in like Microsoft Windows or
something you know they'll support you
and you can see once we've decided what
we're going to install from we have a T2
micro we have our machine class this is
a cheap machine class we're talking
cores we're talking Ram this is pretty
cheap we're not asking for a lot of
resources we don't want to pay for a lot
of resources if you want to do that I
don't know your Computing needs you want
some gpus they'll sell you some gpus uh
you know you want to mine your Monero or
whatever uh
they'll help you out with that or you
know with a lot of a lot of that AI
stuff is really GPU intensive but uh
that's not what we're doing today today
we're tracking sausage and you can see
under that we we can load up an SSH
public key so we can access this machine
via our SSH key we keep the private one
at home and the next 80s hacker pop
culture guide that we have here and I
think you knew to expect them you have
David Lightman here and uh it's not an
accident that he's next to the metadata
options
so for those who might not know the
metadata service is an HTTP not https
there's no TLS magic uh going on there
it's an HTTP endpoint that your
cloud-based resources can query to get
information about themselves or their
environment and it is actually a pretty
great tool for for computing but it's
got a dark side here so specifically in
AWS you can query that metadata service
for your session tokens you take those
session tokens you plug them into your
own computer into your own CLI and then
the that AWS Cloud thinks you are the
you thinks you are that role it thinks
you're more or less that thinks you're
this virtual machine so if you're David
Lightman David lightman's I don't know
how you got access to your virtual
machine but he did that uh he he did a
session hijacking he talked to the
metadata service all this in AWS thinks
he's Professor Falcon and he's launching
a global thermonuclear war
we don't want that so uh or if you are
David Lightman hey look look out for
that you know play some tic-tac-toe but
um here we have some metadata options
and the first one here we are disabling
that that service entirely it's not
necessarily the most uh useful uh not
necessarily the most functional way to
do it but it is it is pretty secure but
if that's not your bag if you still need
the metadata service and it's pretty
useful uh look what we have we can
disable uh we can require tokens we can
put a hop limit on that so I know
there's a high profile breach a few
years back where someone you uh they
abused a uh a proxy that was running on
an on an instance or a virtual machine
and they proxied themselves into the
metadata service
uh yeah they got they got the tokens
that way but here we're putting a hop
limit on that we're disabling that we're
trying to do things in a secure way and
when I talk about the danger of using
that Mouse uh this is sort of what I
mean
uh try to find those metadata options in
the GUI that's not easy that's not
that's not in the front uh
you can put best practices in code you
can cut and paste that a lot easier than
you uh than you can ever you know find
it in the GUI it's hidden
here uh David lightman's back for the
profile for gcp and again this should
look really familiar or we're setting
the machine type we're also saying hey
we want Ubuntu 2204 but there's other
you know other options there and uh
David Lyman is next to the network
interface and there's one thing you're
not seeing here in that network
interface and that's a request for a
public IP address we don't want this
thing to be on the internet we only want
it on our private Network that network
interface code you see that's the local
network that's the local project or
local subnet we don't want that on the
internet
um
that's a that's a really
kind of deadly anti-pattern that the GUI
is going to lead you down the the option
to turn that off to not request that
public IP address that's hidden in my
opinion there but we're avoiding that
we're not including that we're we're not
including those directives we don't want
that public IP address why would we
and similarly the default service
account or the default rule assigned to
the to these uh to these machines that
compute service account is uh it's
really overpowered uh that is it the
default configuration the escalation
path's there so if David Lightman get
his access to that virtual machine he
can get he can query the compute
environment get a lot of information
about the machines that you're running
and in some cases he can even launch his
own machines in your account uh with
gpus or whatever you don't want that so
we created a new service account just
for this demo the sausage user that
sausage user has some limited Scopes you
see we're defining those Scopes you can
think of Scopes as slices of of the API
instead of the whole thing we're given
the sausage user access to compute read
only so we can query information about
the environment but we can't make any
changes there's no writing
and similarly storage read only so we
can we can access data from that bucket
we can read it we can't write to it we
don't want to contaminate that sausage
data we want the sausage to be
uncontaminated we want it to be clean
and uh yeah we're protecting it that way
again uh not the easiest thing to do in
the GUI but here it's code
so we've created virtual we've created
an instance we've created a virtual
machine we've got uh we told the cloud
how to run it but you know it's out of
the box it's fresh it's it's pristine
and you know I like disk space but I
also like functionality we need to
configure that machine and so we're
going to use a cloud configure a cloud
in its script
and cloud cloud in it is a really great
tool if you're installing from the
machine images that the clouds give you
is probably already installed there it's
a service that's going to run at boot
time and it is going to query the
metadata from uh from your Cloud
environment and it's going to download a
script that looks like this there's a
yaml based instructional language there
with a bunch of different uh directives
a bunch of different things you can do
this is only an example you can do a lot
more than this but right here the first
thing we're doing is write files we're
creating a file you can create files
with uh
uh and any file you want any anywhere in
the any anywhere in the file system you
want any kind of permissions ownership
whatever you have a lot of flexibility
there and we have a boot command and a
run command the boot command starts
earlier than the Run command but those
are bash commands so whatever commands
you would type in to configure your
machine to set up those Services you can
do it right there a lot more that I'm
not showing you but yeah so
the auto scalar group would increase
this machine it runs this boot script
and then you start running you start
processing sausage data
but who can access this machine
well
um hopefully you and only you uh or the
sauce attacker so here is an example of
a firewall rule sometimes they're called
ACLS sometimes they're called security
groups it's all the same idea you're
limiting Network traffic so here's an
example uh for AWS and you can see two
IP addresses listed there I'm not
necessarily saying they're my home IPS
please don't please don't hack me but we
are limiting access to that SSH service
to those two IPS those two IPS are the
only people in the whole world who can
access that service again it's a real
kind of specific AWS anti-patter in
there and I think that the gui's gotten
better in the last few years but when
you create a virtual machine with that
Mouse it sort of wants you to create to
open up that service to the whole world
you don't want to do that if you do open
up SSH the whole world you're going to
get Brute Force attacks pretty quickly
no uh here we're limiting it and uh you
know you can audit this a lot easier I'm
going to direct your attention also to
that egress block this egress block
admittedly not the best way to do it but
if you want to do patch management you
need to download those Debian packages
there's RPMs from from a server
uh real world those those Cloud
environments they they're they're just
as dynamic as any other and it's a
little hard sometimes to predict what
those IP addresses should be so here
we're opening that up to the whole world
this virtual machine can access the
whole world you see that row of zeros we
can access that but if you want to be
more secure than this and you should
probably want to be more secure than
this delete that egress block completely
and this machine will not be able to
talk to the internet uh there you go
almost an air gap not quite but all you
have to do is delete some code
here is a firewall rule for gcp kind of
the equivalent but one big difference
here I'm going to draw your attention to
the source range that Source range isn't
mine that's not my home that belongs to
the Google's identity aware proxy and if
you don't know about that it's almost
Magic
your gcloud CLI that that command line
interface that Google gives you that gcp
gives you it is so feature Rich it's
pretty amazing and one of the best
things that it does is that it has an
SSH or s
scps FTP whatever you want to call it as
an SSH client built into it
which has a really killer feature that
they added in that you can use the IAP
the identity aware proxy you log into
gcp with your username your password
hopefully your MFA you authenticate that
way and then you've got uh what it what
amounts to a VPN between you and your
private Network environment no need for
public IPS unless you need public IPS
I'm not going to debate the you know the
whether or not it's the VPN it doesn't
matter your SSH packets are going to
Tunnel through
Google's backplane they're going to
Tunnel through https so you've got the
the TLs security features on top of the
SSH security features you're encrypting
your encryption it's pretty crazy it's
great and all you need to do to enable
it super easy there you go just to open
up CCP to that to that to that uh to
that range there
so let's talk about exploitation because
this is cloud Ops for red teamers and
maybe people did things the wrong way if
you remember that cloud in its script
though those directives that were uh
yaml based well what if
what if uh you know what if people put
secrets in there and I don't know why
but people love to put secrets in
metadata uh people like to put passwords
in there they like to put certificates
in there so if you're an attacker and if
you get access to that cloud-based
environment if you did it the wrong way
AWS describe instances attribute that's
going to show you that cloud in a script
and if there's a password in there
that's a certificate guess what they're
yours similarly if you're uh you know if
you're in gcloud if you're in gcp gcloud
compute instances describe is going to
dump that metadata so
um I don't know why people put passwords
and tags but they do so you want to see
those passwords you want those passwords
there you go uh not that hard and if you
remember
uh David Lightman do you know pretending
to be Professor Falcon if you want to
pretend to be Professor Falcon if you
want to play those games there you go
it's a simple curl command if you want
to do a session hijacking attack
hopefully they disabled it we showed you
how to disable it uh but if you're you
know if they didn't disable it if they
use the GUI there you go not that hard
let's talk a little bit more about
identity and access management uh I am
and uh we are going to restrict what
parts of the API are users or our roles
can access and here uh here's an example
policy for for AWS and those policies
have policy statements that have three
elements to it there's an action and
effect and a resource and in this first
this first example we our action has one
API call it has list bucket and that is
essentially LS or dur if you like
Windows we can list the contents of that
bucket so it's like a file system and
you can do an LS
and we're enabling that for the sausage
user you know we're enabling it because
the effect is allow you can very easily
make that a deny if you want to
explicitly prevent this user from from
listing those Contents I don't know why
but you could do that and the resource
uh you're not going to see uh you're not
going to see a wild card in there if you
if you made that resource a star we
would be enabling the sausage user to to
list the contents of any bucket in the
world assuming that bucket let them do
it but that's not principle of least
privilege we're better than that so uh
yeah we are going to limit
the sausage user to being able to to
access the sausage bucket
similarly in the next example uh get
object we are allowing get objects for
the sausage user and I said I didn't
like wild cards but I think we have a
more constructive use of wild cards
there uh you can see that Arn and Arns
you can think of them like like URLs for
for AWS resources we are only allowing
that sausage user to download files that
start with the the word sausage and end
with CSV so if it starts with sausage
and has a CSV extension the sausage user
can read it if you are for some reason
sharing this bucket with other
applications
um the sausage user won't know about it
the sausage user can only download files
and can only download the sausage CSV
files that's all it needs to do
principle of least privilege we love it
finally SSM
uh we're going to talk more about
uh secrets and code and how we can avoid
it but uh yeah the cloud providers give
you SSM which is part of KMS
it's a Secrets management system you can
name a secret like a password or a
certificate and then restrict who has
access to that secret and here we are
giving access to the sausage secrets to
the sausage user so for the name secret
if if that name starts with sausage we
can download it but that's it
and here is kind of an equivalent for
gcp and um
so AWS does things a little bit reversed
in the way that I look at things in that
GC AWS is more about assigning the the
permissions to the user in gcp you marry
the permissions to the identity and then
apply that to the resource so in this
case again we're talking about the
secrets management system we are pairing
in the policy statement in the first
block there we're pairing secret
assessor and viewer secret manager
viewer we're pairing that to the sausage
user identity putting them together and
then applying that pairing to the secret
itself in the resource block you see
there
that secret already exists but here
we're just giving the sausage user
access to that secret you'll see you'll
see in the uh the policy statement there
it says members we could put more people
more identities if we wanted in that
list but again we want to limit it to
the sausage user
so uh we talked about Auto scaling
groups and how when that machine becomes
unresponsive when uh
when when it comes time when that
machine dies it's going to be replaced
with a with an exact copy so we don't
want to store the sausage data on that
local hard drive or hard drive
equivalent we want to we want to store
that sausage data somewhere safe so we
have defined a database server a
database instance to to manage that data
for us and uh fortunately we didn't use
the mouse to do it so we we avoided some
anti-patterns those anti-patterns
include uh we aren't going to use
secrets and code uh that's not for us
we're better than that and uh we're not
going to allow remote access again the
cloud providers they want to sell you an
IP address we're not buying
and here is some code to create a
database instance in AWS and I called it
an instance instance just like the
virtual machine because it is an
incident just like that virtual machine
it's a VM I'm pretty sure it runs Linux
unlike the other virtual machine you
don't get to admin this you don't have
to admin this the cloud provider is
going to add administer it for you
the only service you have access to
because you can't SSH into it the
database service is the only service you
have access to and in this case we're
running postgres 14x you have other
choices if you want to run MySQL if you
like that if you like Oracle
is all supported and the instance class
because we have to we have to tell them
how much we're willing to pay for we're
doing a T3 micro this time this is a
little bit better than we were using
before still still not the greatest you
might have to scale that up for a real
world example and I want to draw your
attention to that uh that that line
there if you see that blue false
publicly accessible
we're not buying that IP address and if
you point and click and you create that
database instance it is that's hidden uh
in the GUI they want to sell you that
that IP address we don't want a public
IP address why would you want the
internet to talk to your SQL I don't
know uh
that that astounds me but we're not
going to do that and um before we yeah
that's a mistake and
uh the gentleman on screen here this is
a personal favorite of mine Kerry even
from blake7 the brains of a massive
fraud he ripped off the Federation
banking system and I personally think
the way that he did that was through
this is my head Canon I think he used
publicly available IP addresses and
secrets and code but we're going to
avoid that here
uh in case of Anna Grant is in the
audience uh she's not going to bust us
and uh the name secret here is
sausage.r.ds.password.prod and you can
see where you're defining an
administrative user for this database
instance here at the bottom of the of
the first block the username is p SQL
and you don't see the password for that
that is by Design so that data block at
the bottom terraform is going to act
like an AWS client it's going to act
almost like your CLI and when it comes
time to evaluate this code when
terraform sees that data block at the
bottom
it's going to reach out to AWS as you
and it's going to say hey AWS give me
the
sausage.rds.password.prod secret and I'm
going to store that in memory and when
it comes time to create this P SQL user
I'm going to take that that PC pool user
I'm going to take that password from
memory and I'm going to use those as
parameters to the call that creates a
user and I'm going to create that user
and when someone gets access to uh to
this code maybe they maybe they log into
my GitHub doesn't matter
this is safe
and here is equivalent code again for
that one for one mapping if you ever
need to Port from One Cloud to another
here is equivalent uh database instance
code postgres 14x again for gcp and um
again you look at that ipv4 underscore
enabled that's a little bit of a
misanumer
this database instance it still talks
ipv4 because ipv4 forever but
um no IPv6 or maybe it does but we will
not be claiming a public IP address here
we're setting that to false it we're not
disabling IP we're just not going to be
on the internet and again I think that's
hidden in the GUI that is uh that is
those are some hard clicks to make
and we are doing the same thing with the
secrets management system because again
one for one mapping we're talking to
gcp's SSM gcp secret manager we're
having terraform ask for the sausage
Dash RDS Dash password Dash prod uh the
naming conventions are a little bit
different but there we go we're getting
it from um from the secrets management
system and at the bottom you can see
we're creating that admin user
where's the password not on screen
so let's talk more about exploitation so
uh these secret Management Systems there
are commercial Alternatives and I'm not
uh endorsing those I'm not saying don't
use them but you've already paid for one
SSM is already out there but uh if you
are a red teamer and if you want to
exploit other people's SSM uh go you
know here's here's a way to get started
um
log in if you get access to their AWS
AWS SSM describe parameters that's going
to list out all the secrets in the
secrets management system if you want to
start downloading those Secrets if you
want to start viewing them one by one
AWS SSM get parameter and then the
parameter name with decryption it's
going to show up in your console those
are your secrets those are your
passwords uh your certificates and
Google let's say you're using gcp gcloud
Secrets list it's the same thing it's
going to list all the secrets and if you
want that secret on your screen simply
gcloud Secrets version to access latest
because the SSM in in gcp does secret
versioning but that latest one is
usually the one they're using there you
go that's how you view the secret go
ahead uh you know steal trillion credits
from the banking system uh in a
fictional Universe I'm not advocating
fraud
all right so let's talk about buckets
because we're talking about Cloud
security and buckets are uh
people mess that up a lot but we're
going to be better than that that bucket
doesn't need to be made public uh those
gooeys have gotten better about this
they kind of we used to want you to
create that bucket as public and you'd
have to go out of your way to not make
it public but we're not going to make it
public and we're going to restrict it
even further
here's some code to create a create and
hopefully secure a bucket and uh the
first code block there we are creating
the sausage bucket buckets should be
universally uniquely named so I have the
sausage bucket you can't have it
so right after we create that bucket
we're applying the private ACL to it
this is an AWS uh
the the alternative is to make it public
I don't know why you would want to do
that there are entire search engines
there dedicated to uh scouring data and
other people's public buckets you don't
want to be a part of that uh so here
we're making it private but
what happens when uh when you work
collaboratively and and you know people
make mistakes I make mistakes uh what
happens if someone puts a really
destructive ACL or a bad policy on top
of that bucket uh so even though it's
private they open it up to big chunks of
the world we can stop that before it
even gets started you see that roof
trues there those uh look we are going
to stop people from clicking on anything
that's going to make that bucket public
if they get access to your environment
we're going to stop them from doing even
redundant terraform that's going to make
it public we've stopped it uh those
those truths all represent check boxes
in the real world in the in um you know
in that AWS API I personally think those
check boxes are hard to find but here
they are right here so if um
if Bryce Lynch from Max Headroom if he
wants to help out Edison Carter go live
and direct with your data he's going to
have to look somewhere else because you
did it the right way or if you are brace
Lynch and if you see someone else's
environment there you go that's an
escalation path
and uh Bryce is back because we're here
we are in gcp and we're creating a
sausage Bucket over there and we are
limiting access to that bucket to the
sausage user you can see a macro at the
bottom
um
reader we are only giving reader access
that's why readers and capital letters
there at the bottom of the screen we
could give it owner access that would
allow the sausage user to write data to
that bucket but I don't want that I
don't want to write data I don't want to
pollute the sausage don't contaminate it
we're only going to be reading
uh
so uh before we end here
um
let's talk about Telemetry and Telemetry
is it by that I mean logging and you
want to create a forensic Trail you want
um
those apis that are that are the kind of
the essence of your Cloud environment
right anything you do in that cloud
environment you're accessing that API
there are Telemetry services that will
create logs of that access
um in AWS you have cloudtrail and gcp
you have logging also Cloud the cold
Cloud operation Suite in Azure it's
activity log they exist what they do is
they tell the cloud to start sending uh
Json formatted records of what happened
somewhere where you can access it later
so that Json usually includes a time
stamp it includes the identity of the of
the person or entity who did the call it
unless you know what the call was lets
you know uh hopefully it lets you know
the IP address that the call came from
and what resource was acted upon and if
it's an error hopefully you'll get some
descriptive error information right
there
it's all great but you do have to set it
up
and because it enable us it's cloudtrail
we call those directives to set up
logging we call those Trails here is
some terraform code to create a trail
and we are sending that we are sending
those log messages to an S3 bucket
we're sending them into S3
uh
buckets are the easiest place to send
them you can send them into a bunch of
different places but here we're going to
send them to S3 because it's easy S3 is
cheap long-term storage uh it's pretty
great for that and as a piece of advice
here if you are doing Cloud if you're
doing this for real you might want to
send that data to a destination maybe a
bucket maybe somewhere else send it to a
destination in a different account it if
you separate the data if you separate it
into different accounts then and you can
totally do that your attacker is going
to have to compromise two accounts in
order to obscure their forensic Trail
you don't want them to be able to
obscure the forensic Trail I think if
you are that attacker then you know look
for the buckets
here we have kind of the equivalent here
in gcp logging it's called a sync so
where do we want that where do we want
those logs to go again we're sending it
to a bucket we could send that again a
number of different places you want to
send it to your sim you can send it to
your sim you want to send it to a to a
postgres you can send it a postgres push
pull queue I don't know what you're into
but if you look at that filter
gcp logging you know I'm not going to
debate the whether or not it's a Sim but
it does handle a bunch of different
types of log logs not just these API
logs so we need to filter for those API
logs we need to tell it to filter out
only the API logs and there we are we're
doing that we're sending it to a to a
bucket because you know it's an example
and let's talk about exploitation and
here on this slide we have Kate Libby
from the movie hackers and I know what
some of you might be thinking you know I
told you we were gonna have images of
80s pop culture Hackers from movies and
TV shows and well she's from the 90s but
you know if you're not doing logging
then you don't have a time stamp and you
don't know when she's from
so let's say you are Kate Libby and you
you know you get into a cloud-based
environment one of the first things
you're probably going to want to do is
AWS cloudtrail list Trails you want to
see if they're even doing logging or
similarly if you're in gcp gcloud
logging syncs list go ahead and list out
those things you'll see the filters
you'll know if they're logging and if
they're not logging well then you can go
ahead and hack the planet and you can
invite Lord Nikon and the rest of them
with you and and if you're on the red
team go ahead and lace up those
rollerblades you can come with them
because they're not logging anything you
have at it
so um that's it here we are um at the
summary uh if I can leave you with
anything uh configures code is a much
better way to to secure your environment
there are security mistakes that we you
will avoid and if you're a red team or
look for those security mistakes uh
they're there uh that that Mouse is
nothing but trouble uh you want to avoid
it if you're on the on the blue side but
if you're on the red side then hey it's
nothing but trouble you know have at it
uh watch out for those insecure settings
really there's a lot of anti-patterns in
in those guise don't do that
um yeah you can track your uh
hey no no passwords in code uh
all right so I promised if anybody's
interested uh if you'd like those
examples go to my GitHub you will see
Cloud environments that are almost ready
to be built you can almost render them
you'd only have to make a few changes
but they're I think pretty decent
examples the examples of the the
environment that we showed you here
that's my GitHub if if I inspired you if
you uh if you want to become a cloud Ops
person if you want to build your your
your startup environment your Uber for
firewall rules I'd love to hear about
that uh if you have questions uh you
know shoot him shoot him at me the
easiest way to contact me is probably
publicly social media Twitter Mastodon
there I am I don't know how we're doing
on time I felt like I went pretty quick
do we have time for questions
all right uh do we have questions
I was so clear yes okay thank you
[Music]