(sec404) incident response in the cloud | aws re:invent 2014

Configuration

Amazon S3 Amazon EC2 Amazon VPC Amazon RDS Elastic BeanstalkIAM

Security

GroupVPC

SubnetAmazon

S3 Bucket

Groups,

Users,

Credentials

Applications

Amazon RDS

DB Instances

Objects

Instances

Internet

Gateways

Customer

AWS

Traditional IR

This Talk

Its Here

And Here

And Here

And Here

https://s3.amazonaws.com/reinvent2014-

sec402/SecConfig.py

https://s3.amazonaws.com/reinvent2014-

sec402/SecConfig.py

"accessKeyId": "AKIAJLMGEGEAYMFNTH2Q",

"accessKeyId": "AKIAJLMGEGEAYMFNTH2Q",

"accessKeyId": "ASIAJNH65GHCSCYCGEUQ",

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html#SG_Changing_Group_Membership

beetle@forensics:~$ ping intern

PING intern (54.173.32.252) 56(84) bytes of data.

64 bytes from 54.173.32.252: icmp_seq=1 ttl=63 time=1.34 ms

64 bytes from 54.173.32.252: icmp_seq=2 ttl=63 time=1.10 ms

64 bytes from 54.173.32.252: icmp_seq=3 ttl=63 time=1.30 ms

64 bytes from 54.173.32.252: icmp_seq=4 ttl=63 time=1.50 ms

64 bytes from 54.173.32.252: icmp_seq=5 ttl=63 time=1.25 ms

^C

--- 54.173.32.252 ping statistics ---

5 packets transmitted, 5 received, 0% packet loss, time 4006ms

rtt min/avg/max/mdev = 1.108/1.302/1.500/0.135 ms

beetle@forensics:~/tools$ uname -a

Linux ip-172-30-4-4 3.13.0-36-generic #63-Ubuntu SMP Wed Sep 3 21:30:07 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

beetle@forensics:~/tools$ scp -i beetle-demo-1.pem ./lime* ubuntu@intern:/tmp

lime-3.13.0-36-generic.ko 100% 9896 9.7KB/s 00:00

beetle@forensics:~/tools$ ssh -i beetle-demo-1.pem ubuntu@intern

Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.13.0-36-generic x86_64)

...

ubuntu@intern:~$ cd /tmp

ubuntu@intern:/tmp$ ls

lime-3.13.0-36-generic.ko

ubuntu@intern:/tmp$ sudo insmod lime*.ko "path=tcp:4444 format=lime"

beetle@forensics:~/volatility$ nc intern 4444 > intern_memory.lime

beetle@forensics:~$ zip internUbuntu14.zip module.dwarf \

/boot/System.map-`uname -r`

adding: module.dwarf (deflated 90%)

adding: boot/System.map-3.13.0-36-generic (deflated 79%)

beetle@forensics:~$ cp internUbuntu14.zip ~/volatility

beetle@forensics:~$ cd volatility

beetle@forensics:~/volatility$ python vol.py --info | grep Linux

Volatile Systems Volatility Framework 2.2

LinuxinternUbuntu14x64 - A Profile for Linux internUbuntu14 x64

beetle@forensics:~/volatility$ python vol.py -f ~/intern_memory.lime \

--profile=LinuxinternUbuntu14x64 linux_pstree | more

Volatile Systems Volatility Framework 2.2

Name Pid Uid

init 1 149534510806724

.dhclient 598 149534603226500

.rsyslogd 787 149534603906244

.getty 912 149533581563780

.sshd 953 149534583307268

..sshd 1191 149534598143556

...sshd 1244 149534511131844

....bash 1245 149534510056196

.....sudo 1262 149534509945412

......insmod 1263 149534512334340

.cron 957 149534593742340

beetle@forensics:~/volatility$ python vol.py -f ~/target_memory.lime \

--profile=LinuxinternUbuntu14x64 linux_bash –H 0x6fd618 -P | more

Volatile Systems Volatility Framework 2.2

Command Time Command

-------------------- -------

#1415809185 sudo apt-get update

#1415809185 sudo apt-get upgrade

#1415809185 sudo shutdown -r now

#1415809192 cd /tmp

#1415809194 ls

#1415809258 sudo insmod lime*.ko "path=tcp:4444 format=lime"

beetle@forensics:~/volatility$ python vol.py -f ~/target_memory.lime \

--profile=LinuxinternUbuntu14x64 linux_ifconfig

Volatile Systems Volatility Framework 2.2

Interface IP Address MAC Address Promiscous Mode

---------------- -------------------- ------------------ ---------------

lo 127.0.0.1 00:00:00:00:00:00 False

eth0 172.30.4.75 00:00:00:00:00:00 False

beetle@forensics:~/volatility$ python vol.py -f ~/target_memory.lime \

--profile=LinuxinternUbuntu14x64 linux_check_modules

Volatile Systems Volatility Framework 2.2

Module Name

-----------

https://aws.amazon.com/support

http://media.amazonwebservices.com/AWS_Security_Best_Practices.pdf

http://blogs.aws.amazon.com/security/

https://aws.amazon.com/security

aws-security@amazon.com

http://docs.aws.amazon.com/IAM/latest/UserGuide/IAMGettingStarted.html

http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_ManagingMFA.html

http://docs.aws.amazon.com/AmazonS3/latest/UG/ManagingBucketLogging.html

•http://docs.aws.amazon.com/IAM/latest/UserGuide/WorkingWithRoles.html

http://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html

http://docs.aws.amazon.com/AmazonS3/latest/dev/MultiFactorAuthenticationDelete.html

http://www.youtube.com/user/AmazonWebServices

http://www.sans.org/reading-room/whitepapers/incident

http://www.first.org/resources/guides

http://www.cert.org/incident-management/publications/

Please give us your feedback on this session.

Complete session evaluations and earn re:Invent swag.

http://bit.ly/awsevals