1 00:00:00,000 --> 00:00:07,300 I'm going to start with the reason why we have went ahead and open sourced this project. 2 00:00:07,420 --> 00:00:12,700 So before that, welcome to DEF CON SAFEMODE. 3 00:00:12,700 --> 00:00:15,720 And about myself, I'm Setu Parimi. 4 00:00:15,720 --> 00:00:19,220 I'm a cloud security architect working at Grumman-Foster. 5 00:00:19,220 --> 00:00:25,540 And my full-time job is designing and deploying enterprise security solutions as a security consultant. 6 00:00:25,740 --> 00:00:34,080 And in my free time, I just work as an independent security researcher with my interests completely towards the cloud native technologies. 7 00:00:34,480 --> 00:00:41,720 I'm a cloud member at CloudVillage and coming to the storyline which I was mentioning earlier. 8 00:00:41,740 --> 00:00:50,080 So a few years back, the ACME Corp is my friend and all his applications are on-premise. 9 00:00:50,080 --> 00:00:53,040 And then he started using AWS. 10 00:00:53,680 --> 00:00:58,860 And after that, the cyber team gets notified about it. 11 00:00:58,860 --> 00:01:10,780 So when the cyber team gets notified about it, what happens is the cyber team is just wrapped up all the enterprise security controls for the organization. 12 00:01:10,800 --> 00:01:21,300 And then the dev folks will come to the cyber team and then they notify like, hey guys, we are just moving all our apps from a data center to the cloud. 13 00:01:21,740 --> 00:01:32,460 And a few months later, what happens is there is another business unit like an infrastructure team who are interested in Office 365 and Azure AD, all this other stuff. 14 00:01:32,460 --> 00:01:34,060 They want to move to Azure. 15 00:01:34,140 --> 00:01:41,160 So now it is on-premise data center and then we have an AWS environment and now the third one is Azure. 16 00:01:41,440 --> 00:01:46,420 So again, the cyber security team will be late to the party as usual. 17 00:01:46,420 --> 00:01:53,080 So they get notified at the end of signing the NDAs and all the other stuff. 18 00:01:53,100 --> 00:02:04,500 Once the cyber security team gets notified, the cyber security team would be in a situation like they have worked so hard in the past few months to go ahead and implement several security controls in cloud. 19 00:02:04,500 --> 00:02:07,340 There will be a huge learning curve and all other things. 20 00:02:07,340 --> 00:02:18,060 And they just wrapped it up and then the infra team says like, we want to go ahead and move our on -premise exchange boxes to Office 365. 21 00:02:18,060 --> 00:02:21,800 We want to move from Skype to Microsoft Teams. 22 00:02:21,800 --> 00:02:23,960 We are going to Microsoft Azure. 23 00:02:24,160 --> 00:02:26,220 You guys have to secure it. 24 00:02:26,400 --> 00:02:30,120 And then the cyber security team has again a learning curve. 25 00:02:30,120 --> 00:02:31,980 They go ahead and secure it. 26 00:02:32,060 --> 00:02:33,360 So it keeps again. 27 00:02:33,360 --> 00:02:36,200 The third team is something like a business intelligence team. 28 00:02:36,200 --> 00:02:41,160 They say like artificial intelligence modules services are good in GCP. 29 00:02:41,160 --> 00:02:50,300 So they start using GCP and every business unit has their own reason to use their own preferred cloud provider. 30 00:02:50,660 --> 00:03:03,200 And the situation gets in a way like an organization with like 50 to 60 applications will be having like four to five public cloud providers. 31 00:03:03,200 --> 00:03:15,220 And it's a nightmare for a security team to go ahead and manage the security for all these public cloud providers and also maintain the shadow risk and all the other stuff. 32 00:03:15,220 --> 00:03:30,240 To make the scenario a bit more complex, what happens is the dev folks, the DevOps folks, they go ahead and follow something called an environment-based hierarchy. 33 00:03:30,480 --> 00:03:39,300 So the resource hierarchy in AWS is something like you can go ahead and have one account for dev, one for prod, one for staging. 34 00:03:39,300 --> 00:03:40,680 Again, one for UAT. 35 00:03:40,680 --> 00:03:44,480 So they have like for a single application, they have three accounts. 36 00:03:44,480 --> 00:03:54,160 And when you think about like an enterprise scale, you grow from three to five AWS accounts to 100 to 150 AWS accounts very quickly. 37 00:03:54,160 --> 00:03:57,460 It's same with Google Cloud or Azure. 38 00:03:57,460 --> 00:04:07,020 So the resource hierarchy makes the security monitoring a bit more complex and it increases the shadow risk of an organization. 39 00:04:08,440 --> 00:04:19,720 So to explain a small problem, it's like we use a lot of open source tools to go ahead and identify the security vulnerabilities across multiple cloud environments. 40 00:04:19,740 --> 00:04:24,300 The first issue is like we have multiple accounts, not one account. 41 00:04:24,300 --> 00:04:28,060 So we need to go ahead and run the scripts, the open source tools in multiple accounts. 42 00:04:28,380 --> 00:04:40,180 And an example is like the tool identifies a security group, which is indicating that all the ports are open to the internet and it's in the DMZ environment. 43 00:04:40,520 --> 00:04:53,260 So the cyber team goes ahead and identifies what are the instances behind that security group and they come to know that this is a dead security group. 44 00:04:53,260 --> 00:04:58,260 It's an idle security group, which is some developer or someone else forgot to delete it. 45 00:04:58,260 --> 00:05:02,240 So there are a lot of challenges like this. 46 00:05:03,080 --> 00:05:10,600 And always my dev friends always love to go ahead and make all the admin services open to the internet. 47 00:05:10,600 --> 00:05:14,660 So that's another challenge as well. 48 00:05:14,660 --> 00:05:17,360 So this is just one service. 49 00:05:17,420 --> 00:05:19,060 How big can it get? 50 00:05:19,060 --> 00:05:28,340 Like how many services are there which can be open to the internet and which can act as a shadow IT services or shadow IT resources in an enterprise environment? 51 00:05:28,480 --> 00:05:29,640 There are a lot. 52 00:05:29,660 --> 00:05:41,400 And just for a high-level example, there are several services, popular services, which are being used and the resources in these environments can be easily made public. 53 00:05:41,720 --> 00:05:52,360 And there is a huge gap in terms of security monitoring, whether this resource is public to the internet or not. 54 00:05:52,360 --> 00:05:54,420 This resource has authentication or not. 55 00:05:54,420 --> 00:06:00,380 Is this an API endpoint, which doesn't have any API key or any authorization requirement? 56 00:06:00,380 --> 00:06:02,520 So there are like so many other factors. 57 00:06:02,520 --> 00:06:19,180 And then to map all these internet resources, what I used a lot is to go ahead and use a few tools like Perimeterate and SmogCloud, CloudMapper, my favorite one. 58 00:06:19,180 --> 00:06:43,540 And for Google Cloud environment, we started using Force So the first one is, it goes ahead and periodically scans all the AWS internet services and it identifies the resources which are public to the internet, which are exposed to the internet and it gives a very beautiful JSON format data at the end. 59 00:06:43,700 --> 00:06:56,720 So I just, what I do is like, I just collect the data and then upload it to our tools like Shodan Monitor, where we always monitor for vulnerable ports or admin ports being exposed to the internet. 60 00:06:56,740 --> 00:07:01,180 And we get email alerts and the SOC team or the incident response team follows up. 61 00:07:01,300 --> 00:07:05,860 So the other tool is SmogCloud and Perimeterate and CloudMapper. 62 00:07:05,860 --> 00:07:07,660 These three are for AWS. 63 00:07:07,940 --> 00:07:10,720 And the fourth security is for Google Cloud. 64 00:07:10,720 --> 00:07:14,540 And it's a bit more complex to use. 65 00:07:14,540 --> 00:07:16,740 And it's really huge as well. 66 00:07:17,040 --> 00:07:22,920 Setting up is easy, maintaining is a bit tough. 67 00:07:23,260 --> 00:07:32,560 So the coverage is just, there are open source tools available for a few AWS, I mean, few cloud providers. 68 00:07:32,620 --> 00:07:40,200 And there are, these open source tools are offering, I mean, supporting only limited number of resources. 69 00:07:40,300 --> 00:07:44,380 So these are the primary challenges that we have faced. 70 00:07:44,380 --> 00:08:01,480 Like, if we want to use an open source tool, the open source tool should be going ahead and scanning all the environments, like multiple environments on a periodic basis, without we going ahead and manually running those scripts on every account by switching the roles. 71 00:08:01,480 --> 00:08:03,040 It's a complex work, right? 72 00:08:03,120 --> 00:08:06,730 And a single tool should be able to monitor multiple clouds. 73 00:08:06,730 --> 00:08:26,170 And the third one is the IP addresses collected from all the public cloud environments should be easily ingested into a security monitoring tool, the internet attack surface tool, like short end monitor or something like that, to make sure none of the admin services are exposed. 74 00:08:26,190 --> 00:08:30,330 And it drastically reduces the shadow ID actually. 75 00:08:30,830 --> 00:08:49,010 So for that, what we did is like, build a security tool, which was initially called as Nightwatch, because my friends, the developer friends, a lot of guys are like, fans of Game of Thrones. 76 00:08:49,010 --> 00:08:51,210 So we went ahead and renamed it Nightwatch. 77 00:08:51,210 --> 00:09:01,830 And later, when we go ahead and try to create a repo and make it public, we saw that there are already 10 or 15 Nightwatch tools on the GitHub. 78 00:09:01,830 --> 00:09:04,130 So we decided like, we need a name change. 79 00:09:04,130 --> 00:09:08,010 And then we changed the name from Nightwatch to the Cloud Frontier. 80 00:09:08,010 --> 00:09:12,270 So that's how we went ahead and we built the Nightwatch. 81 00:09:12,810 --> 00:09:17,950 Nightwatch is a small project to monitor the internet attack surface of public cloud environments. 82 00:09:17,950 --> 00:09:24,650 And currently, the cloud providers that are being supported are AWS, Azure, Oracle, DigitalOcean, and Google Cloud. 83 00:09:25,290 --> 00:09:35,350 So to give a quick demo of the application, you just click on Get Started. 84 00:09:35,350 --> 00:09:47,490 And then you'll be able to see the most commonly used ports, and the administrative ports, and the vulnerabilities, and the total number of ports that are exposed to the internet that belongs to your organization, and the number of IP addresses. 85 00:09:47,850 --> 00:10:02,110 And when you click on the Internet Asset tab, you'll be able to see IP addresses, domains, object storages, data storages, API endpoints, content delivery networks. 86 00:10:02,190 --> 00:10:12,590 So the Cloud Frontier goes into each and every account, irrespective of the cloud provider, and then grabs all these internet facing assets. 87 00:10:12,590 --> 00:10:20,350 First of all, it checks for the internet facing assets, it grabs them, and then it populates it over here. 88 00:10:20,350 --> 00:10:35,710 So for each and every IP address, the score is provided, and a tagging, which helps to understand which environment this IP belongs to, and what are the port numbers that are already open. 89 00:10:36,230 --> 00:10:48,670 Then going to the domain section, we go ahead and we collect all the public domains of EC2 servers, or else Route 53 subdomains, Google Cloud DNS. 90 00:10:48,830 --> 00:10:53,750 And we go ahead and monitor all those domains for that. 91 00:10:53,750 --> 00:10:55,110 Let me just go back. 92 00:10:55,110 --> 00:11:03,970 Yeah, we just monitor those domains for security posture using Mozilla Observatory and Verisource as well. 93 00:11:04,310 --> 00:11:09,130 So the next one is the famous object storages. 94 00:11:09,130 --> 00:11:28,630 So the object storages helps us to go collect all the buckets, blobs, spaces, so from multiple cloud providers, and then provide a website URL if there is one available, and indicate whether this resource is public or not. 95 00:11:28,690 --> 00:11:43,450 So based on this, a security engineer will be able to go ahead and take some quick actions than drilling down the JSON logs or JSON data from other open source tools. 96 00:11:43,810 --> 00:11:51,150 And there are also, we have a lot of snapshots and custom-made images in the enterprise, I mean, our organization. 97 00:11:51,210 --> 00:12:11,450 So we decide to go ahead and have an asset collecting metric for the data storages, like if there is any RDS instance or any AMI, we go ahead and collect it, and then we indicate whether it is public or private. 98 00:12:11,610 --> 00:12:13,730 It's the same with the API endpoints as well. 99 00:12:13,730 --> 00:12:25,590 So we provide what is the endpoint, whether the API key is required or not for this endpoint, and what is the authorization, is it a Cognito authentication or it is anything, something else, Google Cloud Identity or anything else. 100 00:12:25,590 --> 00:12:29,450 So that kind of information will be provided for the API endpoints. 101 00:12:29,910 --> 00:12:34,290 And last is the content delivery network. 102 00:12:35,070 --> 00:12:48,410 It provides the CDNs, and it makes sure whether the CDN is enabled or not, and what the custom domain to which the CDN is being pointed to, and what cloud provider it is. 103 00:12:49,190 --> 00:12:57,110 So not everyone likes the light background, so there is a huge fan base for the dark theme. 104 00:12:57,310 --> 00:13:05,510 So you can just quickly switch from light mode to the dark mode, and then use the same features in the dark mode as well. 105 00:13:05,510 --> 00:13:13,230 My personal preference was dark mode, and yeah, it's pretty much that's it. 106 00:13:13,230 --> 00:13:16,310 So let me go to the next slide. 107 00:13:16,310 --> 00:13:21,130 I would like to go ahead and quickly explain the components of this tool. 108 00:13:21,130 --> 00:13:25,150 It has collectors, analyzers, and outputs. 109 00:13:25,150 --> 00:13:35,310 So the collectors are the lambda functions which go ahead and collect the public or internet-facing assets from multiple cloud providers. 110 00:13:35,670 --> 00:13:53,670 And the analyzers are the ones which go ahead and check whether the bucket is public or not, or the blob is public or not, or else it goes ahead and identifies whether there's an authorization key or API key enabled for an API endpoint. 111 00:13:53,670 --> 00:13:55,550 So all these kind of things will be analyzed. 112 00:13:55,570 --> 00:14:07,210 And then if there are like so many IP addresses, what happens is we go ahead and collect all those IP addresses and scan them against Shodan and the virus total. 113 00:14:08,190 --> 00:14:13,190 And if it is a domain, a Mozilla Observatory score will be provided. 114 00:14:13,990 --> 00:14:26,590 And it says we have an environment file which is pretty much like an input file where you go ahead and input the credentials of your cloud environment. 115 00:14:26,590 --> 00:14:30,830 So every cloud has its own environment file. 116 00:14:30,890 --> 00:14:45,010 You just have to go ahead and insert the access keys or else the JSON file, I mean the service account JSON file from Google Cloud, just insert it and then you should be able to go ahead and run this service. 117 00:14:45,530 --> 00:14:49,830 And currently there are quite a few supported services. 118 00:14:49,890 --> 00:14:54,730 And these are the services which have potential internet-facing assets. 119 00:14:54,930 --> 00:15:01,230 So all these services are currently monitored and analyzed on a regular basis. 120 00:15:01,290 --> 00:15:04,990 So you can always set cron jobs, like it's a CloudWatch rule. 121 00:15:04,990 --> 00:15:09,050 You just have to go ahead and simply trigger the CloudWatch rule as per your convenience. 122 00:15:09,090 --> 00:15:17,670 If you want to go ahead and make the CloudFrontier to run on a six-hour interval, you just have to go ahead and edit the CloudWatch rule to run it in a six-hour interval. 123 00:15:17,670 --> 00:15:22,170 So and these are my friends. 124 00:15:22,170 --> 00:15:27,490 So I just moved back to India and then I met new friends. 125 00:15:27,490 --> 00:15:34,850 I created the tool and then they are like very good developers who are interested in contributing to the open source community. 126 00:15:34,910 --> 00:15:45,750 So we all, I mean not just, we all didn't just have Biryani, but we also had built this tool for the open source community. 127 00:15:47,190 --> 00:15:52,850 And you can, yeah, you can access, the documentation is here. 128 00:15:52,930 --> 00:15:59,010 And if you see here, we just, yeah, as Jiren has mentioned like 30 minutes back, it has been published. 129 00:15:59,050 --> 00:16:08,210 And you can go ahead and review the documentation and have the access keys. 130 00:16:08,210 --> 00:16:10,010 I mean, you can go ahead and start using it. 131 00:16:10,010 --> 00:16:21,150 And in case if you have any issues or if you have any feedback or place for improvement, feel free to throw out the issues and looking forward for the contribution from the open source community. 132 00:16:22,070 --> 00:16:26,210 Yeah, we'll be available for any questions. 133 00:16:28,530 --> 00:16:35,910 Hey, just a quick question for me. 134 00:16:35,910 --> 00:16:42,730 What kind of, you know, access to the cloud environments does this tool require? 135 00:16:43,050 --> 00:16:47,290 So it's just the service accounts and the security audit view only access. 136 00:16:48,350 --> 00:16:49,770 Got it. 137 00:16:49,770 --> 00:16:50,030 Yeah. 138 00:16:50,030 --> 00:17:00,190 And it is documented here where for the Azure, just create an application in AD and then get the subscription ID, get the tenant ID, client ID, secret. 139 00:17:00,190 --> 00:17:11,070 And just once you get all these things added to the environment file, same with the solution, Oracle Cloud, Shodan and other API keys from where you can get the information. 140 00:17:12,170 --> 00:17:13,750 Seems pretty straightforward. 141 00:17:13,750 --> 00:17:22,890 If we wanted to disable certain lookups like VirusTotal or the Firefox one or Mozilla one, are we able to do that? 142 00:17:24,370 --> 00:17:30,010 I think there is a flexibility just like you have to just stop that analyzer from running. 143 00:17:30,010 --> 00:17:33,930 We have created multiple analyzers for multiple functions. 144 00:17:33,950 --> 00:17:38,170 We have an analyzer for Shodan, one for Mozilla Observatory. 145 00:17:38,190 --> 00:17:40,790 So you just need to go ahead and disable it. 146 00:17:41,030 --> 00:17:47,690 And once you disable that analyzer, I mean, it's not available in the front end, you need to just tweak it in the back end. 147 00:17:47,690 --> 00:17:54,530 And once this, because the entire stack is deployed to AWS, so it's not very tightly coupled and it's very loosely coupled. 148 00:17:54,530 --> 00:17:55,790 So the tweaks are pretty easy.