Unmasking the Subnet - Lookalike IP Ranges in Cloud Environments

Unmasking the Subnet:
Lookalike IP Ranges in Cloud
Environments
Asaf Aprozper
June, 2023

Asaf Aprozper | @3pun0x | fwd:cloudsec 2023
● Leading the SecOps team at Moon Active
● Securing Gaming cloud infrastructures with a
global network of DevOps teams
● Previously spoken at CodeBlue Japan, BSides
Cyprus and Black Hat USA Arsenal
Asaf Aprozper

23%
Misconfiguration is the number one reason
of cloud security incidents in 2022
Check Point, 2022 Cloud Security Report

2022 Cloud Security Incidents

Takeaways
01
Private IP addresses
Implementation in
today’s cloud
RFC 1918 Standart
02
Common misconfigurations
Proactive hunting flow
New cloud misconfiguration
Misconfigurations
03 Identify the exact issue
Evaluate it using
different resources
Assessing scope of
security issue
05 Splunk & Sigma hunting
rules;IP Unmasker;SG
Unmasker
Open source tools
04 Getting a proxy
configure it using open
source tools
Proxying like a pro

Issue - Allowing unrestricted inbound access to some or all ports
using the IP range 0.0.0.0/0
Security Risks - Enabling external security attacks such as port
scans, log4shell payloads, and other exploitations attempts
Recommendation - Restrict inbound access to specific required IP
addressesVPN range and by port, even within internal networks
The Common MistakeMisconﬁguration
0.0.0.0/0

AWS Suggestion - Easy to Get Misconﬁgured

Discovering a
New Cloud
Misconﬁguration!

Lookalike Private
IP Ranges

Proactive
Threat Hunting

● Actively searching for undetected cyber threats that
have bypassed initial security defenses within a
network
● Not waiting for alerts, taking initiative
● Game-changer in the defense strategy of organizations
Proactive Threat Hunting

Proactive Threat Hunting Flow

Proactive Hunting After
Cloud Misconﬁgurations
That Can Lead for
Threats

Proactively Hunting Using Splunk

Detecting Unusual IPs over Security Groups
Aws
Region eventName
Recipient
AccountId
Source IP
Range
Security
Group Desc org asn country
us-east-2
Authorize
SecurityGroup
Ingress
123456789101 178.62.238.39/32 Site24x7 DIGITALOCEAN-ASN AS14061 Netherlands
us-east-2 123456789101 188.166.3.204/32 Site24x7 DIGITALOCEAN-ASN AS14061 Netherlands
us-east-2 123456789101 104.24.0.0/14 WAF CLOUDFLARE-NET AS13335 Canada
us-east-2 123456789101 172.64.0.0/13 WAF CLOUDFLARE-NET AS13335 Germany
us-east-2 123456789101 77.125.230.136/32 Home Lab
Partner Communications
Ltd. AS12400 Israel
us-east-2 123456789101 172.16.0.0/12 Private IP Range
us-east-2 123456789101 172.32.0.0/11 Private IP Range T-MOBILE AS21928 United States
us-east-1 123456789101 172.0.0.0/8 Private IP Range ATT-INTERNET AS7018 United States
Data Enrichment
CloudTrail Log

Source IP Range Security Group Desc org asn country
172.32.0.0/11 Private IP Range T-MOBILE-AS21928 AS21928
United
States
172.0.0.0/8 Private IP Range ATT-INTERNET4 AS7018
United
States

New Cloud Misconﬁguration!

Is it possible to get a
lookalike IP address
of my own?

Let’s go back
to the start…

● Established by the Internet Engineering Task Force in 1996 due to
the rapid growth of the Internet and shortage of IPv4 addresses
● Enabled private organizations to use specific IP addresses
internally, separate from the public Internet
● Created a division between public and private hosts, with private
hosts not directly accessible from the Internet
RFC 1918 Standard

RFC 1918 Private Addresses
Class CIDR block Private Address Range
A 10.0.0.0/8 10.0.0.0 - 10.255.255.255
B 172.16.0.0/12 172.16.0.0 - 172.31.255.255
C 192.168.0.0/16 192.168.0.0 - 192.168.255.255
Asaf Aprozper | fwd:cloudsec 2023 https://github.com/3pun0x/Unmasking-The-Subnet

RFC 1918 in
The Cloud

What is Virtual Private Cloud (VPC)?

IPv4 VPC CIDR blocks

Public/Private
Subnet
Architecture

Where is The
LookAlike
Misconﬁguration?

Creating a VPC
with LookAlike
IPv4 CIDR?

AT&T IP
Ranges

IP Addressing for Your Vpcs and Subnets
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html

Security
Groups?

Security Group - LookAlike Inbound Rule

Security Group - LookAlike Inbound Rule
LookAlike IP Range Total
172.0.0.1 172.255.255.254 16,777,216

Implemented
over
Infrastructure

Public Subnet

Getting a
LookAlike Private
IP Address
$4.99

Generic Website Selling Mobile Proxy

1 - Choose The
Proxy Package

2 - Select the Desired
LookAlike IP Range
(Carrier)

3 - Pay by
Credit
Card/Crypto

60 Seconds
Later

��

Proxy Information

Using Mobile Proxy to bypass restrictions

Now What?

● Misconfiguration identified
● LookAlike IP address
● Attacker & Victim
● Scope of security risk
Where We Stand Now

Attacker

Attacker’s Toolset
Kali Linux
LookAlike Proxy

Victim

Nginx EC2 in a Public Subnet

Attached to a Security Group with a lookalike
Private IP Range
CIDR LookAlike IP Range Total IPs
172.0.0.0/8 172.0.0.1 - 172.255.255.254 16,777,216

PoC Demo

Misconﬁguration
Scope

GitHub

GitHub -
Search
after
lookalike
ranges

GitHub -
Hashicorp
● AS7018 - AT&T
Services, Inc.

GitHub - AWS ELB Listen Rule Example
Misconﬁgured
CIDR LookAlike IP Range Total IPs
172.0.0.0/8 172.0.0.1 172.255.255.254 16,777,216

Scanning the
Internet after
Misconﬁguration

Proxy IP Unmasker

AWS EC2s IP
Ranges as
Ready-To-Scan
Targets

Reviewing The Findings
● Dev environments
● Sensitive internal companies
web platforms
● Apache directory listing of
internal files
● More…

Leveraging ProxyChains
with Nmap to scan a
Misconﬁgured Asset After
Exposed Services

ProxyChains

ProxyChains + Nmap
CMDline:
proxychains nmap -Pn -n -sT --top-ports 10 --open target_ip_address

Detecting the
creation/modiﬁcation of
security groups with lookalike
misconﬁgurations

Splunk Query: CreationModify of Security
Group with LookAlike Private IP Address
index="aws" (eventName="AuthorizeSecurityGroupIngress" OR eventName="ModifySecurityGroupRules") AND
errorCode=success
| rename requestParameters.ipPermissions.items{}.ipRanges.items{}.cidrIp as cidrIpAuthoriz
| rename requestParameters.ModifySecurityGroupRulesRequest.SecurityGroupRule.SecurityGroupRule.CidrIpv4
as cidrIpModify
| eval cidrIp = coalesce(cidrIpAuthoriz,cidrIpModify) #Combine different event types and grabbed the cidrIp
| mvexpand cidrIp #Handling multi-value CIDRs
| eval single_ip = mvindex(split(cidrIp, "/"), 0) #Split CIDR to single IP
| where cidrmatch("172.1.0.0/22", single_ip) OR cidrmatch("172.32.0.0/11", single_ip) #Search for single IP in
AT&T and T-Mobile lookalike private IP ranges

Preventing the
creation of lookalike
security groups

● AWS Config Rule
● GCP Organization Policy
● Raise Awareness for Cloud Users
○ Share this Talk with Your DevOps Teams
○ Use My Informative Stickers
○ Subnet Calculator Websites for Easy Checking
How to prevent?

The Shared
Responsibility Model

● Ensuring security by properly configuring and managing
security settings according to their needs
● Monitoring their cloud resources for unusual or
unauthorized activities
● Ensuring that the teams responsible for managing and
using cloud resources are well trained and aware of
security risks
Customer's Responsibility

Cloud Service Provider's Responsibility
● Can provide tools, best practices, guidelines to
assist in properly secure cloud
● UI Message alerts
● GuardDuty alerts for public exposure

New
Instance =
Public
Exposure

No alert when
creating a
public security
group

After Capital One
Data Hack, AWS Will
Scan for
Misconﬁgurations

Recommendation for the cloud service
provider - Check button for public exposure
over Security Groups as for S3 buckets

● As a cloud defender you must think ahead of the users, not only the
attackers
● The impact can be very high, I only scanned a small amount of AWS
EC2 ranges in only specific region and only under the HTTP service
● Think about what a bad actor could do - they could increase their
scan to GCP, Azure, more AWS ranges, and do more once found a
misconfigured asset - they can brute force directories too
● Can we leverage that issue to find lookalike over S3 buckets as
well?
Closing Words

Thank You
Asaf Aprozper
@3pun0x
GitHub Repository

Unmasking the Subnet - Lookalike IP Ranges in Cloud Environments

Recommended

Recommended

More Related Content

Similar to Unmasking the Subnet - Lookalike IP Ranges in Cloud Environments

Similar to Unmasking the Subnet - Lookalike IP Ranges in Cloud Environments (20)

Recently uploaded

Recently uploaded (20)

Unmasking the Subnet - Lookalike IP Ranges in Cloud Environments