|
When Amazon Web Services (AWS) finds leaked credentials, it goes into principal mode and puts them into a Breakfast Club of restrictions.
While the quarantine restricts certain actions—like the listing of identities or the deleting of a role—some malicious actions are still possible. A free, open-source tool from Permiso Security called “DetentionDodger” finds those detained credentials and what threat actors can still do with them.
“Just knowing the key was quarantined is one issue, but it’s going through and saying, based on all the current permissions, what are all the naughty things that this key can still do, even with that quarantine policy applied? What are all the ways an attacker could dodge detention for this access key based on its current capabilities?” Daniel Bohannon, principal security researcher, told IT Brew. (Bohannon did not create the tool. His colleague Bleon Proko, who contacted IT Brew through email, led the development.)
Hardcoded times. Bohannon said he has seen threat actors using leaked credentials to spin up virtual machines and install Bitcoin miners; he’s also seen key thieves use the company’s large language model (LLM) service Bedrock and abuse AWS’s Simple Email Service to send spam.
“If someone compromises an account for a large organization, what if you can send emails as that organization or just send out spam using their infrastructure at their cost?” Bohannon said.
Read more here.—BH
|
