AWS S3 Security by Aditya Balapure

1. S{0x3} Security -
EXPLOITation & DETECTion

2. $whoami
@adityabalapure
● aka Adi
● Security Engineer @ Grubhub
● Builder, Breaker, Fixer, author, speaker
● I love crypto, malware, the web and CVEs
● Tweet Tweet: @adityabalapure

3. Whats going on - Recon
[1] [2] [3] [4]

4. Tools of the trade - Exploitation
● Bucket Finder
● DNS Recon
● Website Spidering
● Sandcastle
● AWSBucketDump
● teh_s3_bucketeers

5. Access 101
● IAM Policies
● Bucket Policies
● Access Control Lists (ACL)
● Static Website Hosting

6. I will find you and I will fix you! - Detection
● Boto works phenomenally for automating detection scanning for S3
Objects/buckets
● AWS Config
● Cloudtrail/CloudWatch
● AWS Trusted Advisor (paid)
● Security Monkey AWS Config Capture
Boto Scanning

7. I will find you and I will fix you! - Detection
[1]
CloudWatch logs detecting the ACL Change

8. I will find you and I will fix you! - Detection
● CloudWatch Rule Event Pattern

9. I will find you and I will fix you! - Detection
● CloudWatch Rules + Simple Notification Service (SNS) Rocks!

10. Lambda’s Great! - Detect & Fix
● Lambda constantly monitors CloudWatch events for PutObjectAcl API Calls
and fixes the “public” object permission automatically as soon it is triggered
CloudWatch Rule triggering our Lambda Function
Lambda Function logs of objects being fixed
automatically that were found to be public
[1]

11. I will find you and I will fix you! - Detection
● S3 Bucket Event Notifications

12. Thank you!