Scary false positive or story about Best practice to secure your root AWS account

What the best practice of securing AWS root account? - Not using it at all!

Let's clean it up first:

1. remove any API key associated with root account
2.  reset root password and change email assoicated
3. enable MFA (or deactivate previous and create new) on the root account.

Start using IAM:

1. Copy/bookmark/save IAM sign-in url 
2. create required users including one with AdministratorAccess policy attached. 
3. Enable MFA on all users created

Secure root account:

1. Print you root account credentials.
2. Log in using printed credentials to ensure that it works.
3. Put in tamper evident envelope
4. Add some signatures, stamps or voodoo on envelope. 
5. Hide it in SafeBox
6. Use it only in case of emergency :-)  

Now let's add some monitoring just in case:

1. Enable and configure CloudTrail + bucket for Logs
2. Configure CloudWatchLogs (CloudWatch) to process CloudTrail logs
3. Add metric filters to detect root-user related events
4. Set-up alarm and notifications (SNS) for the metrics

For root users  CloudWatchLog metric filter looks like:

Filter Name:

Security-CloudWarchAlarms-RootAccessMetricFilte

Filter Pattern:

{$.userIdentity.type = "Root"}

I did everything mentioned above and was ,let's say, "surprised" to get months after notification saying "Root log-in  detected" . Checked CloudTrail looking for  the root user - nothing....Hmm.. Start looking into CloudTrailLogs content  for the detailed row events and found this:

"eventVersion": "1.02", "userIdentity": { "type": "Root", "principalId": "577343344455", "arn": "arn:aws:iam::577343344455:root", "accountId": "5577343344455", "userName": "my_company", "invokedBy": "support.amazonaws.com" }, "eventTime": "2016-03-22T19:22:23Z", "eventSource": "iam.amazonaws.com", "eventName": "GetAccountSummary", "awsRegion": "us-east-1", "sourceIPAddress": "support.amazonaws.com", "userAgent": "support.amazonaws.com", "requestParameters": null, "responseElements": null, "requestID": "675d-fxx3-1x5-9xxd-4768xxx17", "eventID": "b9xxxxfcaf-3xx7-4xxd-a220-exxxx8", "eventType": "AwsApiCall",  "recipientAccountId": "577343344455"

Dear AWS support - you got me :-))

AWS s3 bucket encryption audit

Storing sensitive information at AWS S3?- it's a must to encrypt your data at rest.
How?

• do it yourself (client side encryption) and transfer to S3 already encrypted
• ask AWS to do it for you (server side encryption). In this case you have 2 options: S3 managed encryption keys or KMS-managed encryption keys.

If you create a new bucket for sensitive data NEVER create it without AWS bucket  policy enforcing encryption: encryption is object level attribute at S3 and user specify (technically request) encryption during upload process. Policy will block all uploads if encryption not requested. Simple and Easy.. Except:

      You have existing S3 bucket with data uploaded before you enable this policy, you have mixed (encrypted and non encrypted objects) or just doing security audit. In this case you need to scan the bucket to find unencrypted objects. How? quite easy using  few python lines bellow:


import boto3
import pprint
import sys
boto3.setup_default_session(profile_name='prod')
s3 = boto3.resource('s3')
if len(sys.argv) < 2:
   print "Missing bucket name"
   sys.exit
bucket = s3.Bucket(sys.argv[1])
for obj in bucket.objects.all():
   key = s3.Object(bucket.name, obj.key)
   if key.server_side_encryption is None:
       print "Not encrypted object found:", key

Nice, Yep, But it will take almost forever to scan bucket that contains thousand or tens of thousand of objects. In this it would be nice to have some counters, progress bar, ETA , summary, etc.. So, vuala:

https://github.com/IhorKravchuk/it-security/blob/master/s3_enc_check.py


Small program providing all these features mentioned. Feel free to use it or request reasonable changes/modifications. 

Videowall for SOC. v2

Sure thing you need it for security events visibility. It could be LCD, Plasma or just a projector.

Usually you have more than 5 different security management programs ( SIEM, IDS management, system logs, cloud monitoring,  etc) , so, you need method to show all these on display. You can't tile one display with all these windows - lack of resolution for huge amount of information.

Recently I rewrote quite useful script from my previous post: to just do one simple function: Activate Chrome browser and switch tabs. New days guys - all our security dashboards now in browser. 

Set WshShell = WScript.CreateObject("WScript.Shell") 
ex = True 
WshShell.AppActivate("Google Chrome")
Do
  WshShell.AppActivate(2116)
  WshShell.SendKeys "^{TAB}" 
  WScript.Sleep 10000
  if WshShell.AppActivate("Untitled - Notepad") Then Set ex=False
Loop While ex=True

It gives you possibility to see and read all security information on video wall and adjust visibility interval between tabs.

PS. you must run notepad.exe to kill the script.

AWS CloudFormation template security group viewer

        Almost any AWS CloudFormation template are more then long enough. It's OK when you are dealing with different relatively "static" resources but become a big  problem for something way more dynamic like security group.
    This kind of resource you need to modify and review a lot, especially if you cloud security professional.  Reading AWS CloudFromation template JSON manually  makes your life miserable and you can easily miss bunch of security problems and holes.
     My small aws_secgroup_viewer Python program helps you to quickly review and analyse all security groups in your template.

     https://github.com/IhorKravchuk/it-security/blob/master/aws_secgroup_viewer.py

     Supports both security group notations used by CloudFormation: firewall rules inside security group or as separate resources linked to group.

Remote access to the car or practical aspects of the ELM 327 security

      What would you say if I tell you that many car owners grant open remote wireless access to their cars? More over many of them available on the 4/7 basis.. You probably would tell me that it's impossible or might think I discovered new security bug in the new cars with built-in WiFi or Bluetooth... Nope! I'm taking about yours 5-7-10 years old cars! How come?
      Many of you probably know about OBD-II connector installed in your car.

 It is used for  diagnostic, but at the same time for cleaning  car error codes or even for car firmware upgrade.  Nice and quite useful interface that give you access to the CAN bus and widely used by a car owners to check their cars.
     Currently cheapest 10$  (thanks to our Chinese friends) and widely used adapters are based on  ELM 327 chip plus, guess what, Bluetooth or even WiFi interface.

 Sure things they definitely need wireless interface so you can do car diagnostic using you smartphone or tablet :-)
To collect more data and to simplify life (finding the port and connecting device while sitting in a car on driver's seat is definitely a gymnastic trick :-)  ) many car owners just leave the device always connected!
Not only connected but in the most cases (based on the adapter version ) always powered ON.

So, we have wireless adapter always connected to you car and using as security measure .....  default unchangeable PIN (1234 for Bluetooth and 12345678 for WiFi). What a gift!

What you can do knowing all above? Scan for Bluetooth of WiFi devices broadcasting OBD II name and...

•  diagnose  a car :-))
•  get access to the CAN bus  or hack the CAN bus
• control the car  or even autopilot it.

Have a Good Hack  Luck and stay secure!

PS.

Useful links related to CAN bus security:

• Comprehensive Experimental Analyses of Automotive Attack Surfaces
• Hopping On the CAN Bus. Automotive Security and the CANard Toolkit. Eric EvenchickBlack Hat Asia 2015 
• canbushack: Hack Your Car
• Adventures in Automotive Networks and Control Units
• DEFCON-21-Illera-Vidal-Dude-WTF-in-My-Car-Updated
• Car Hacking Really Is For Dummies With This Sexy (And Free) Software
• How to Hack Your Mini Cooper:Reverse Engineering CAN Message on Passenger Automobiles

     

Multidomain SSL certificate CSR generation and openssl custom config to simplify this process

Bunch of CAs (Certificate authorities ) allow you to sign mutidomain SSL certificates.
Why it's very useful?

• cheaper then wildcard (*.domain.com) when you need SSL cert  just for 2-5 domains like www.domain.com; domain.com and login.domain.com
• cheaper and convenient when you need to have SSL certificate for wildcard domain and doman apex aka  "naked" or "root" domain (*.domain.com and domain.com)

How to make CSR fot these domains? Sure thing using OpenSSL, but you need to do a trick here: OpenSSL does not support multidomain configuration in interactive mode (when you are answering to the OpenSSL question while generating certificate).
   
What options do we have:

• Use non-interactive mode with  long command line and specify all parameters there (really long line)
• Create custom config and specify all there. More over this config will help you during certificate renewal next time.

Let's build our custom config :

Wildcard multidomain:

Create file wild.yourdomain.cnf:

[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
countryName = CA
stateOrProvinceName = Quebec
localityName = Montreal
organizationName = it-security.ca
organizationalUnitName  = infosec
commonName = *.yourdomain.com

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = yourdomain.com
DNS.2 = *.yourdomain.com

Generate csr:

openssl req -new -sha256 -key wild.yourdomain.com.key -out wild.yourdomain.com.csr -config wild.yourdomain.cnf

Multidomain:

Create file yourdomain.cnf:

[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
countryName = CA
stateOrProvinceName = Quebec
localityName = Montreal
organizationName = it-security.ca
organizationalUnitName  = infosec
commonName = *.yourdomain.com

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = yourdomain.com
DNS.2 = www.yourdomain.com

Generate csr:

openssl req -new -sha256 -key yourdomain.com.key -out yourdomain.com.csr -config yourdomain.cnf

And sure thing you can use it for normal domains:

Normal domain:

Create file yourdomain.cnf:

[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
prompt = no

[req_distinguished_name]
countryName = CA
stateOrProvinceName = Quebec
localityName = Montreal
organizationName = it-security.ca
organizationalUnitName  = infosec
commonName = login.yourdomain.com

Generate csr:

openssl req -new -sha256 -key yourdomain.com.key -out yourdomain.com.csr -config yourdomain.cnf

More details about working with CSR, OpenSSL certificates and etc you can find here: http://security-ingvar-ua.blogspot.ca/2012/10/ssl-certificates-commands-and-tips.html

Password management in CLI. Using the standard unix password manager: pass with AWS CodeCommit and multi-environment setup

Install and configure pass utility: http://www.passwordstore.org/

yum install pass

Multi-environment setup: Work and Personal passwords in 2 different locations, gpg keys and version controls.

less ~/.bashrc 

# Switch to personal pass credentials
personal() {
    if [ -e ~/.gnupg ]; then rm ~/.gnupg ;fi 
    export PASSWORD_STORE_DIR=/run/media/my_user/DATA/Personal/credentials/.pass 
    ln -s /run/media/my_user/DATA/Personal/credentials/.gnupg ~/
}

work() {
    if [ -e ~/.gnupg ]; then rm ~/.gnupg ;fi
    export PASSWORD_STORE_DIR=/home/my_user/Big_corp/credentials/.pass
    ln -s /home/my_user/Big_corp/credentials/.gnupg ~/
}

Enable config above:

$. ~/.bashrc

Switch to personal environment:

$personal

Generate gpg keys:

gpg --gen-key

Check

gpg --list-keys

Note Key-ID anb initiate pass:

pass init 75d6793

For versions enable git feature

pass git init

Start using:

pass insert Test/test
pass ls
pass show Test/test
pass rm Test/test

Version Control

Configure remote if you need ( central git repo, github or AWS CodeCommit )

 AWS Code commit example:

Configure CodeCommit: Create repo + allow access to it for you user and add you public ssh key to the user in IAM.

Then on you machine:

1. go to $PASSWORD_STORE_DIR
2. git remote add origin ssh://APrrfrA@git-codecommit.us-east-1.amazonaws.com/v1/repos/credentials
3. git remote -v
4. git push origin master

And now you push your changes

pass git push

---

PS. pass use gpg2 if it available instead of gpg. Recently gpg2 has been updated to version 2.1 that might cause some issues with availability of you gpg keys. So, if you see your kees using gpg --list-keys but can't see them using gpg2 --list-keys, most probably automatic migration to version 2.1 fail and you need to do it manually.  

Force migration from GnuPG 1 to 2.1 

remove files:

rm pubring.kbx 
rm -rf private-keys-v1.d

force migration:

gpg2 --import ~/.gnupg/secring.gpg