The sky is falling Nephological tales of security woe Ben Toews - - PowerPoint PPT Presentation

▶
the sky is falling
SMART_READER_LITE
LIVE PREVIEW

The sky is falling Nephological tales of security woe Ben Toews - - PowerPoint PPT Presentation

Aug 15, 2023 167 likes •593 views

The sky is falling Nephological tales of security woe Ben Toews Snakeoil as a Service People are concerned about security these days - - People arent sure about the security impact of the cloud - Scared people are good customers - Lots of

slide-1
SLIDE 1

The sky is falling

Nephological tales of security woe

slide-2
SLIDE 2

Ben Toews

slide-3
SLIDE 3

Snakeoil as a Service

  • People are concerned about security these days
  • People aren’t sure about the security impact of the cloud
  • Scared people are good customers
  • Lots of people are exploiting this fear to sell bullshit snake oil
slide-4
SLIDE 4

don’t panic

  • Don’t buy snakeoil
  • The cloud has a lot of security benefits
slide-5
SLIDE 5

tales

  • f

woe

  • We’ll walk through some examples of cloud security incidents and talk about what went wrong.
slide-6
SLIDE 6

Adobe

  • October 2013
  • Adobe is a desktop software company.
  • They manage downloads through a web app.
  • “attackers illegally entered our network”
  • Wasn’t cloud related
http://helpx.adobe.com/x-productkb/policy-pricing/ecc.html http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/ https://github.com/blog/1698-weak-passwords-brute-forced
slide-7
SLIDE 7

38 million passwords

  • Compromise led to 38 million stolen account passwords
slide-8
SLIDE 8

crypto is hard

  • Encrypted, not hashed
  • ECB Block cipher (64 bit blocks)
  • Password hints helped too
slide-9
SLIDE 9

MongoHQ

  • October 2013
  • Internal support system account with same password as on Adobe
  • Adobe ->
  • Internal support system (w/ impersonation) ->
  • Customer data (passwords were bcrypted) ->
  • Buffer mongodb access -> social media auth tokens
http://techcrunch.com/2013/10/29/hosting-service-mongohq-suffers-major-security-breach-that-explains-buffers-hack-over-the-weekend/ http://arstechnica.com/security/2013/10/hack-of-mongohq-exposes-passwords-user-databases-to-intruders/ http://open.bufferapp.com/buffer-has-been-hacked-here-is-whats-going-on/
slide-10
SLIDE 10

GitHub

  • November 2013
  • “Brute force” attack using Adobe passwords
  • Already had strong rate limiting
  • Rate limiting didn’t help much
  • 40,000 unique IP addresses
  • ~5 login attempts per account
  • Used stolen accounts to get Ripple currency
slide-11
SLIDE 11

account security

  • shared passwords
  • 2FA
slide-12
SLIDE 12

Luke Chadwick

  • He’s just one random example
  • Open source repo w/ AWS creds
  • >$3000 AWS bill
  • Thousands of AWS creds in public repos
  • Working with AWS to scan repos
http://vertis.io/2013/12/16/unauthorised-litecoin-mining.html
slide-13
SLIDE 13

Bitly

  • May 2014
  • Link shortener
  • AWS key for backup database stored in source code
  • Employee account compromised
  • GitHub contacted them (they never mention GitHub)
http://www.cso.com.au/article/544802/bitly_reveals_hackers_stole_secret_keys_from_hosted_code_repository/
slide-14
SLIDE 14

Bonsai

  • June 2014
  • Elastic search hosting
  • Old AWS master key hard coded in source code
  • Source code leaked
  • Noticed and outage due to attacker deleting random stuff
  • Worked with Amazon to lock things down and restore backups
http://status.bonsai.io/incidents/qt70mqtjbf0s
slide-15
SLIDE 15

credential storage

  • Don’t store creds in source code
slide-16
SLIDE 16

Code Spaces

June 2014 Code spaces was a git and subversion hosting provider. http://www.csoonline.com/article/2365062/disaster-recovery/code-spaces-forced-to-close-its-doors-after-security-incident.html http://arstechnica.com/security/2014/06/aws-console-breach-leads-to-demise-of-service-with-proven-backup-plan/ http://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761 http://blog.trendmicro.com/the-code-spaces-nightmare/
slide-17
SLIDE 17

DDoS

They noticed a DDoS attack. The attacker left a note in their AWS console asking them for money. WAIT, they left the note *in* the AWS console.
slide-18
SLIDE 18

AWS compromised

DDoS was smokescreen. AWS account was compromised. They tried to regain controll of account. Attacker noticed. Attacker deleted everything.
slide-19
SLIDE 19

“will not be able to

  • perate beyond

this point”

They wen’t out of business 12 hours after the incident began.
slide-20
SLIDE 20

account security

  • shared passwords
  • 2FA
slide-21
SLIDE 21

disaster recovery

  • I hear DR plans are good
slide-22
SLIDE 22

trust

  • Trustworthy providers (not Code Spaces)
  • Verify trust.
slide-23
SLIDE 23

Linode

  • April 2013
  • 0day in ColdFusion
  • DB and webapp access
  • Properly encrypted credit card data
  • Salted/hashed passwords
  • Lost deploy keys for instances
slide-24
SLIDE 24

credential storage

  • They did a pretty good job
slide-25
SLIDE 25

the sky is falling

  • This isn’t just the cloud
  • Alert Logic report
  • Incidents are still more common in on-prem
slide-26
SLIDE 26
  • ebay

145,000,000

  • http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
slide-27
SLIDE 27
  • JP Morgan

Chase

76,000,000

  • http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
slide-28
SLIDE 28
  • Target

70,000,000

  • http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
slide-29
SLIDE 29
  • Home Depot

56,000,000

  • http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
slide-30
SLIDE 30
  • Living Social

50,000,000

  • http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
slide-31
SLIDE 31
  • Community

Health Services

4,500,000

  • http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
slide-32
SLIDE 32
  • AOL

2,400,000

  • http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
slide-33
SLIDE 33
  • How do you actually secure stuff?
slide-34
SLIDE 34

trust

  • You can usually trust your cloud provider
  • They have people who are good at security
  • Don’t get cut on the bleeding edge
  • Use established providers
  • Look for security docs
  • Email support
slide-35
SLIDE 35

verify

  • Audit your logs
  • FIND AWS LOG PRODUCT
slide-36
SLIDE 36
  • Account Security
  • Application Security
  • Network/Host Security
  • Physical Security
slide-37
SLIDE 37
  • SaaS
  • Need to trust everything up to the application
  • Strong account security
  • Password manager
  • 2FA
  • Least privilege
  • Credential storage
slide-38
SLIDE 38
  • PaaS
  • Need to trust everything up to the server
  • Need to focus on appsec in addition to previous concerns (+ more creds to manage)
  • This is where people start putting creds in code
  • Static analysis
  • Hire appsec people
  • Hire consultants
  • Bounty program
slide-39
SLIDE 39
  • IaaS
  • Need to trust everything up to the hardware
  • Host/network security in addition to previous concerns (+ more creds)
  • Harden the OS
  • Patch (not always possible - eg. Heartbleed ELB)
  • Firewall (metadata API)
  • IDS
slide-40
SLIDE 40
  • OnPrem
  • Trust no one
  • Guards with Guns
slide-41
SLIDE 41