Scary false positive or story about Best practice to secure your root AWS account

What the best practice of securing AWS root account? - Not using it at all!

Let's clean it up first:

1. remove any API key associated with root account
2.  reset root password and change email assoicated
3. enable MFA (or deactivate previous and create new) on the root account.

Start using IAM:

1. Copy/bookmark/save IAM sign-in url 
2. create required users including one with AdministratorAccess policy attached. 
3. Enable MFA on all users created

Secure root account:

1. Print you root account credentials.
2. Log in using printed credentials to ensure that it works.
3. Put in tamper evident envelope
4. Add some signatures, stamps or voodoo on envelope. 
5. Hide it in SafeBox
6. Use it only in case of emergency :-)  

Now let's add some monitoring just in case:

1. Enable and configure CloudTrail + bucket for Logs
2. Configure CloudWatchLogs (CloudWatch) to process CloudTrail logs
3. Add metric filters to detect root-user related events
4. Set-up alarm and notifications (SNS) for the metrics

For root users  CloudWatchLog metric filter looks like:

Filter Name:

Security-CloudWarchAlarms-RootAccessMetricFilte

Filter Pattern:

{$.userIdentity.type = "Root"}

I did everything mentioned above and was ,let's say, "surprised" to get months after notification saying "Root log-in  detected" . Checked CloudTrail looking for  the root user - nothing....Hmm.. Start looking into CloudTrailLogs content  for the detailed row events and found this:

"eventVersion": "1.02", "userIdentity": { "type": "Root", "principalId": "577343344455", "arn": "arn:aws:iam::577343344455:root", "accountId": "5577343344455", "userName": "my_company", "invokedBy": "support.amazonaws.com" }, "eventTime": "2016-03-22T19:22:23Z", "eventSource": "iam.amazonaws.com", "eventName": "GetAccountSummary", "awsRegion": "us-east-1", "sourceIPAddress": "support.amazonaws.com", "userAgent": "support.amazonaws.com", "requestParameters": null, "responseElements": null, "requestID": "675d-fxx3-1x5-9xxd-4768xxx17", "eventID": "b9xxxxfcaf-3xx7-4xxd-a220-exxxx8", "eventType": "AwsApiCall",  "recipientAccountId": "577343344455"

Dear AWS support - you got me :-))

Advanced Persistent Threat (APT)

These chinese guys are really Persistent:

--------------------- SSHD Begin ------------------------ 

Illegal users from:

   67.228.251.6 (67.228.251.6-static.reverse.softlayer.com): 60 times

   

211.151.62.218: 10490 times

But not really Advanced:   for all password guessing attempt they must've got:

-----Permission denied (publickey). ---  

:-)

Security overseas

I thought that even people who faraway from infosec knows that WEP encryption for personal access point is bad idea.... But not for the biggest Canada telecom: Bell.

All Bell's new DSL-modem (with AP) shipping to the customer WEP enabled! More over it's not just shipping from stock- all AP already came preconfigured for the customer!

 The second surprise was: Canadian banks have no slightest idea about such simple thing of m-banking as sms notifications! So, in country where cash is used really rarely  there is absolutely  no way to stay informed by sms about you credit/debit card transactions! 

Sure thing, all bank have self-care web portals or , even, an iPhone apps, but , guess what? - no two-factors  authentication for end customer at all! No sms notification of login attempts to your online account too.

How to see unseen

If I say that you 100% have a lot of infrared cameras at home you probably will not trust me.
So, lets test it! As a infrared light source we gonna use remote control.
First tests - Sumsung Corby mobile phone:


Second test - build-in web camera in MacBook laptop.


How it's possible? Sensor in you camera (CCD or CMOS) is sensitive for Infrared. CMOS sensor is sensitive in the near infrared than CCD sensor, but both of them work good with infrared projector (that could be made from infrared light emitting diodes ) Usually vendors install IR cut filter before the sensor, so, if you remove it (for a lot of cameras models it's really easy) you will get possibility to make cool IR photos.

How we can use it? For fun, as a very simple night vision system, or even as kind of x-ray system for some kind of materials transparent in IR lights (some types of paper, synthetics, etc)