CyberSecurity news
FlagThis - #aws
|
Jessica Lyons@theregister.com
//
Researchers at watchTowr Labs have uncovered a significant security flaw involving abandoned Amazon Web Services (AWS) S3 buckets, potentially allowing attackers to compromise the software supply chain. The analysis revealed that nearly 150 S3 buckets previously used by various organizations, including cybersecurity firms, governments, Fortune 500 companies, and open source projects, could be re-registered. This re-registration could enable attackers to inject malicious code or executables into deployment processes and software update mechanisms.
Over a two-month period, these abandoned buckets received over eight million HTTPS requests for various files, including software updates and other binary artifacts. The requests originated from a wide range of sources, including government networks in multiple countries, military networks, Fortune 100 and 500 companies, and even cybersecurity companies. This vulnerability could allow threat actors to deliver malware or backdoors to these organizations, leading to widespread security breaches. AWS has since blocked the specific buckets identified by watchTowr to prevent their re-creation and potential misuse. Recommended read:
References :
@csoonline.com
//
Cybersecurity researchers have uncovered a new "whoAMI" attack that exploits name confusion in Amazon Machine Images (AMIs) to achieve remote code execution within Amazon Web Services (AWS) accounts. The attack allows anyone publishing an AMI with a specific, crafted name to potentially gain access and execute malicious code. The vulnerability stems from misconfigured software that can be tricked into using a malicious AMI instead of a legitimate one when creating Elastic Compute Cloud (EC2) instances.
Researchers found that the attack vector requires specific conditions to be met when retrieving AMI IDs through the API, including the use of the name filter and a failure to specify the owner. An attacker can create a malicious AMI with a matching name, leading to the creation of an EC2 instance using the attacker's doppelgänger AMI. Amazon addressed the issue following a responsible disclosure in September 2024, introducing new security controls and HashiCorp Terraform implemented warnings to prevent misuse of the API. Recommended read:
References :
will@LearnAI
//
AWS is enhancing its AI capabilities with the introduction of cost-effective AI inference solutions using Amazon Bedrock serverless features alongside Amazon SageMaker trained models. This advancement allows users to import their own custom fine-tuned models from SageMaker into Amazon Bedrock, providing access through a fully managed API. This new approach eliminates the need for self-managed infrastructure or costly provisioned throughput, making AI more accessible. Amazon Bedrock supports a variety of model architectures, including Mistral, Flan, Meta Llama 2 and Llama 3, which can be interacted with via the Bedrock playgrounds once imported.
AWS also launched a new cloud region in Thailand, aimed at bolstering Southeast Asia’s digital economy and presenting opportunities for Indian businesses to serve a wider audience. This expansion provides a strategic gateway to neighbouring markets in the APAC region. The move highlights AWS's commitment to expanding its global infrastructure and enhancing the availability of cloud-based services. The Thailand cloud region adds to AWS’s growing list of services focused on supporting AI development and deployment. Recommended read:
References :
@www.bleepingcomputer.com
//
A new ransomware campaign is exploiting Amazon Web Services (AWS) Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt S3 buckets. The attackers, known as "Codefinger," utilize encryption keys unknown to the victims. The hackers demand ransoms in exchange for the decryption keys, effectively holding the data hostage. This attack leverages a legitimate AWS feature, making data recovery incredibly difficult without the attacker's keys. The Codefinger crew was first spotted in December, and at least two AWS native software developers were recently targeted.
The attackers gain access to victims’ cloud storage by using compromised AWS keys with read and write permissions and encrypt files by calling the "x-amz-server-side-encryption-customer-algorithm" header and using a locally stored AES-256 encryption key they generate. AWS processes the key during encryption but does not store it, meaning the victim cannot decrypt their data without the attacker-generated key. Furthermore, the encrypted files are marked for deletion within seven days using the S3 Object Lifecycle Management API, adding pressure on the victims. This tactic represents a significant risk, as it’s the first known instance of ransomware using AWS's native secure encryption infrastructure via SSE-C to lock up victims data. Recommended read:
References :
Aman Mishra@gbhackers.com
//
A cyber threat group known as JavaGhost has been exploiting misconfigured Amazon Web Services (AWS) Identity and Access Management (IAM) permissions to conduct sophisticated phishing campaigns. Palo Alto Networks Unit 42 is tracking this group, known as TGR-UNK-0011, which overlaps with JavaGhost. Since 2022, JavaGhost pivoted from website defacement to cloud-based phishing attacks, targeting unsuspecting targets for financial gain.
The group exploits leaked long-term AWS access keys to gain initial access, then misuses AWS services like Simple Email Service (SES) and WorkMail to send phishing emails, bypassing typical email protections. They create new SMTP credentials and IAM users, some for active attacks and others for long-term persistence, even leaving the same calling card in the middle of their activities. JavaGhost's tactics include generating temporary credentials and utilizing advanced evasion techniques to obfuscate their identities in CloudTrail logs, a tactic historically used by Scattered Spider. The attackers create IAM roles with trust policies, allowing access from attacker-controlled AWS accounts, and attempt to enable all AWS regions to potentially evade security controls. These activities leave detectable events in CloudTrail logs, providing opportunities for threat detection and response for vigilant organizations. Recommended read:
References :
@therecord.media
//
References:
labs.watchtowr.com
, therecord.media
,
Researchers at WatchTowr Labs have uncovered a significant security vulnerability related to abandoned Amazon Web Services (AWS) S3 buckets. These buckets, previously used by various software projects, governments, Fortune 500 companies, and even cybersecurity firms, are now posing a serious threat to the global software supply chain. The study revealed that approximately 150 S3 buckets, after being abandoned, could be re-registered with the same AWS account name. This would allow malicious actors to inject malicious code into software update mechanisms or deployment code, potentially compromising systems and sensitive networks.
WatchTowr researchers, through their analysis, demonstrated the potential for attackers to exploit these abandoned S3 buckets. They found that these buckets were still receiving millions of HTTP requests, including requests for software updates, making them prime targets for supply chain attacks. CEO Benjamin Harris emphasized the inherent issue with the world's approach to infrastructure abandonment and how easy it is to insert malicious code. To mitigate this, AWS has blocked the specific buckets identified by WatchTowr from being re-created and noted having unveiled a bucket ownership condition functionality curbing inadvertent bucket name reuse. Recommended read:
References :
|