CyberSecurity news

FlagThis - #Amazon

Aman Mishra@gbhackers.com //
A cyber threat group known as JavaGhost has been exploiting misconfigured Amazon Web Services (AWS) Identity and Access Management (IAM) permissions to conduct sophisticated phishing campaigns. Palo Alto Networks Unit 42 is tracking this group, known as TGR-UNK-0011, which overlaps with JavaGhost. Since 2022, JavaGhost pivoted from website defacement to cloud-based phishing attacks, targeting unsuspecting targets for financial gain.

The group exploits leaked long-term AWS access keys to gain initial access, then misuses AWS services like Simple Email Service (SES) and WorkMail to send phishing emails, bypassing typical email protections. They create new SMTP credentials and IAM users, some for active attacks and others for long-term persistence, even leaving the same calling card in the middle of their activities.

JavaGhost's tactics include generating temporary credentials and utilizing advanced evasion techniques to obfuscate their identities in CloudTrail logs, a tactic historically used by Scattered Spider. The attackers create IAM roles with trust policies, allowing access from attacker-controlled AWS accounts, and attempt to enable all AWS regions to potentially evade security controls. These activities leave detectable events in CloudTrail logs, providing opportunities for threat detection and response for vigilant organizations.

Share: bluesky twitterx--v2 facebook--v1 threads


References :
  • The Hacker News: Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail
  • gbhackers.com: JavaGhost: Exploiting Amazon IAM Permissions for Phishing Attacks
  • Talkback Resources: JavaGhost: Exploiting Amazon IAM Permissions for Phishing Attacks
  • Talkback Resources: Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail [cloud]
  • Cyber Security News: JavaGhost Exploits Amazon IAM Permissions for Phishing Attacks
Classification:
  • HashTags: #AWS #Phishing #CloudSecurity
  • Company: Palo Alto Networks
  • Target: AWS Users
  • Attacker: JavaGhost
  • Product: AWS
  • Feature: IAM permissions
  • Type: Phishing
  • Severity: Medium
@csoonline.com //
Cybersecurity researchers have uncovered a new "whoAMI" attack that exploits name confusion in Amazon Machine Images (AMIs) to achieve remote code execution within Amazon Web Services (AWS) accounts. The attack allows anyone publishing an AMI with a specific, crafted name to potentially gain access and execute malicious code. The vulnerability stems from misconfigured software that can be tricked into using a malicious AMI instead of a legitimate one when creating Elastic Compute Cloud (EC2) instances.

Researchers found that the attack vector requires specific conditions to be met when retrieving AMI IDs through the API, including the use of the name filter and a failure to specify the owner. An attacker can create a malicious AMI with a matching name, leading to the creation of an EC2 instance using the attacker's doppelgänger AMI. Amazon addressed the issue following a responsible disclosure in September 2024, introducing new security controls and HashiCorp Terraform implemented warnings to prevent misuse of the API.

Share: bluesky twitterx--v2 facebook--v1 threads


References :
  • Talkback Resources: Cybersecurity researchers disclosed the whoAMI attack, enabling attackers to execute code within AWS accounts by tricking misconfigured software into using a malicious AMI with a specific name, prompting AWS to introduce new security controls and HashiCorp Terraform to implement warnings.
  • The Hacker News: New “whoAMIâ€� Attack Exploits AWS AMI Name Confusion for Remote Code Execution
  • www.bleepingcomputer.com: Security researchers discovered a name confusion attack that allows access to an Amazon Web Services account to anyone that publishes an Amazon Machine Image (AMI) with a specific name.
  • www.csoonline.com: whoAMI name confusion attacks can expose AWS accounts to malicious code execution
  • BleepingComputer: Security researchers discovered a name confusion attack that allows access to an Amazon Web Services account to anyone that publishes an Amazon Machine Image (AMI) with a specific name.
  • aws.amazon.com: AWS blog post on the fix.
  • securitylabs.datadoghq.com: Datadog Security Labs report detailing the whoAMI attack.
  • securityaffairs.com: whoAMI attack could allow remote code execution within AWS account
  • Security Affairs: whoAMI attack could allow remote code execution within AWS account
Classification:
  • HashTags: #AWS #whoAMI #CloudSecurity
  • Company: Amazon
  • Target: AWS accounts
  • Product: AWS
  • Feature: Name Confusion Attack
  • Malware: whoAMI
  • Type: Hack
  • Severity: Major
@therecord.media //
Researchers at WatchTowr Labs have uncovered a significant security vulnerability related to abandoned Amazon Web Services (AWS) S3 buckets. These buckets, previously used by various software projects, governments, Fortune 500 companies, and even cybersecurity firms, are now posing a serious threat to the global software supply chain. The study revealed that approximately 150 S3 buckets, after being abandoned, could be re-registered with the same AWS account name. This would allow malicious actors to inject malicious code into software update mechanisms or deployment code, potentially compromising systems and sensitive networks.

WatchTowr researchers, through their analysis, demonstrated the potential for attackers to exploit these abandoned S3 buckets. They found that these buckets were still receiving millions of HTTP requests, including requests for software updates, making them prime targets for supply chain attacks. CEO Benjamin Harris emphasized the inherent issue with the world's approach to infrastructure abandonment and how easy it is to insert malicious code. To mitigate this, AWS has blocked the specific buckets identified by WatchTowr from being re-created and noted having unveiled a bucket ownership condition functionality curbing inadvertent bucket name reuse.

Share: bluesky twitterx--v2 facebook--v1 threads


References :
  • labs.watchtowr.com: Researchers at WatchTowr Labs have uncovered a critical security vulnerability in abandoned Amazon Web Services (AWS) S3 buckets that could enable attackers to hijack the global software supply chain.
  • therecord.media: Researchers warned of malicious actors taking over abandoned AWS S3 buckets.
  • www.scworld.com: Extensive software supply chain compromise possible with deserted AWS S3 buckets.
Classification:
  • HashTags: #AWS #S3 #SecurityRisk
  • Company: Amazon
  • Target: AWS S3 Buckets
  • Product: AWS S3
  • Feature: Abandoned S3 Buckets
  • Type: Vulnerability
  • Severity: Major