Download to read offline
Uploaded byGreg Foss
Cloud Crime Ops
The document presents a detailed analysis of the rising threat of cybercrime, particularly in the context of cloud computing, which is generating $1.5 trillion annually. It explores various tactics and techniques used in ransomware attacks, especially within AWS environments, outlining the importance of early detection and comprehensive security measures. Additionally, it discusses the underground economy and cryptocurrency-related attack vectors that further complicate the cybersecurity landscape.
More Related Content
Cloud Crime Ops
- 1. Enterprise-Grade Crime Ops CybercrimeIndustrialization in the Cloud
- 2. whoami Greg Foss OSCP, paCSP,GMON, GPEN, GAWN, GWAPT, GCIH, C|EH, APT Principal Cloud Security Researcher Lacework Labs @35Foss
- 3. Cybercrime - $1.5Trillion in revenue annually Source: Atlastvpn Blog: Cybercrime annual revenue is 3 times bigger than Walmart’s
- 4. Supply Chain Attacks– The “New” Hotness
- 9. Turning all yourbad feelings into good feelings Cloud Computing BUILD CODE TEST PLAN PUSH DEPLOY OPERATE MONITOR
- 10. Leveraging your cloudto attack your customers Cloud Compromise DISRUPT BACKDOOR CODE MONITOR MODIFY DESTROY INFECT ENCRYPT MONETIZE
- 11.
- 12. MITRE ATT&CK –Ransomware Tactics Traditional Ransomware: Significant number of required tactics and techniques leads to an abundance of detection potential Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact Color Key: Used Sometimes Used / Skipped Skipped
- 13. MITRE ATT&CK –Ransomware Tactics Traditional Ransomware: Cloud Ransomware: Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact Color Key: Used Sometimes Used / Skipped Skipped
- 14. MITRE ATT&CK –Ransomware Tactics Traditional Ransomware: Cloud Ransomware: Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact Color Key: Used Sometimes Used / Skipped Skipped Configuration Hardening
- 15. Cloud Initial Access– AWS Example Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact Typically exploit a web vulnerability to execute code on the server (RCE), then look for AWS access keys
- 16. Cloud Reconnaissance –AWS Example Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact
- 17. Cloud Reconnaissance –AWS Detection Potential
- 18. Cloud Discovery –AWS Example Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact
- 19. Cloud Discovery –AWS Detection Potential
- 20. Cloud Exfiltration –AWS Example Both Collection and Exfiltration often go hand-in-hand within the cloud… Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact
- 21. Cloud Impact –AWS Ransomware Example 7 awscli commands Under 30-seconds No other recovery PoC courtesy of: Michael Bentley Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact
- 22. Focus on EarlyDetection and Eradication “Left of Bang” “Right of Bang” Prevention, Compliance, Detection Fallout, Incident Response, Recovery Time
- 23. Cloud Persistence –AWS Example Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact
- 24. Cloud Privilege Escalation– AWS Example Assume Role Method Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact
- 25. Cloud Credential Access– AWS Example Recon Resource Dev Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection C2 Exfiltration Impact
- 26.
- 27. Initial Access Brokers Sellingaccess to compromised corporate assets, via passwords, keys, cookies, logs, shells, etc.
- 28. Access Markets Remote DesktopProtocol (RDP) Secure Shell (SSH) Web Shells (Compromised Websites) SMTP Services and Webmail Session Tokens Logs Credentials Keys Access Marketplace Offerings:
- 29. Access Resale Compromise Initial Accessvia Slack Cookies purchased for $10 Internal Social Engineering Obtained priceless source code Significant brand and financial impact…
- 30. Most Common CryptocurrencyAttack Vectors • Cryptojacking • Monetization of the target’s CPU/GPU • Reverse Proxy Phishing • Domain Spoofing MITM attack • Sniff traffic to bypass MFA • Clipping • Infecting a target system / hardware wallet • Stealing crypto during transactions • Hot-swapping wallet addresses • Dusting • De-anonymizing target wallets through small transactions in order to monitor • Used offensively and defensively
- 31. Cryptojacking It’s rarely justcryptocurrency mining Someone has gained unauthorized access Impact is only limited by creativity Adversaries want diversity in monetization Single compromised host is bad… What about Cloud Root Keys? The tools themselves can expand your organization’s attack surface Jared Stroud – Examining Vulnerabilities within Cryptocurrency Miners: https://www.lacework.com/blog/hidden-bugs-in-the-mines-examining-vulnerabilities-within-cryptocurrency-miners/
- 34. Cloud Service Providers– Ideal Targets
- 35. Training Rotate Keys Multifactor Authentication UtilizationLimits Vulnerability Management Patch Management Compliance Defense in Depth IR Playbooks Awareness Visibility Alerting Proactive Cloud Security
- 36. Thank You! Greg.Foss@lacework.net @35Foss Twitter: @LaceworkLabs LinkedIn:Lacework Labs YouTube: Lacework Labs