I'm going to start with the reason why we have went ahead and open sourced this project.
So before that, welcome to DEF CON SAFEMODE. And about myself, I'm Setu Parimi. I'm a cloud
security architect working at Grumman-Foster. And my full-time job is designing and deploying
enterprise security solutions as a security consultant. And in my free time, I just work
as an independent security researcher with my interests completely towards the cloud
native technologies. I'm a cloud member at CloudVillage and coming to the storyline which
I was mentioning earlier. So a few years back, the ACME Corp is my friend and all his applications
are on-premise. And then he started using AWS. And after that, the cyber team gets notified
about it. So when the cyber team gets notified about it, what happens is the cyber team is
just wrapped up all the enterprise security controls for the organization. And then the
dev folks will come to the cyber team and then they notify like, hey guys, we are just moving
all our apps from a data center to the cloud. And a few months later, what happens is there
is another business unit like an infrastructure team who are interested in Office 365 and Azure
AD, all this other stuff. They want to move to Azure. So now it is on-premise data center and
then we have an AWS environment and now the third one is Azure. So again, the cyber security team
will be late to the party as usual. So they get notified at the end of signing the NDAs and all
the other stuff. Once the cyber security team gets notified, the cyber security team would be in a
situation like they have worked so hard in the past few months to go ahead and implement several
security controls in cloud. There will be a huge learning curve and all other things. And they just
wrapped it up and then the infra team says like, we want to go ahead and move our
on-premise exchange boxes to Office 365. We want to move from Skype to Microsoft Teams.
We are going to Microsoft Azure. You guys have to secure it. And then the cyber security team
has again a learning curve. They go ahead and secure it. So it keeps again. The third team
is something like a business intelligence team. They say like artificial intelligence modules
services are good in GCP. So they start using GCP and every business unit has their own reason
to use their own preferred cloud provider. And the situation gets in a way like an organization
with like 50 to 60 applications will be having like four to five public cloud providers. And
it's a nightmare for a security team to go ahead and manage the security for all these public
cloud providers and also maintain the shadow risk and all the other stuff. To make the scenario a
bit more complex, what happens is the dev folks, the DevOps folks, they go ahead and follow
something called an environment-based hierarchy. So the resource hierarchy in AWS is something like
you can go ahead and have one account for dev, one for prod, one for staging. Again, one for
UAT. So they have like for a single application, they have three accounts. And when you think
about like an enterprise scale, you grow from three to five AWS accounts to 100 to 150 AWS
accounts very quickly. It's same with Google Cloud or Azure. So the resource hierarchy makes the
security monitoring a bit more complex and it increases the shadow risk of an organization.
So to explain a small problem, it's like we use a lot of open source tools to go ahead and identify
the security vulnerabilities across multiple cloud environments. The first issue is like we have
multiple accounts, not one account. So we need to go ahead and run the scripts, the open source
tools in multiple accounts. And an example is like the tool identifies a security group, which
is indicating that all the ports are open to the internet and it's in the DMZ environment.
So the cyber team goes ahead and identifies what are the instances behind that security group and
they come to know that this is a dead security group. It's an idle security group, which is
some developer or someone else forgot to delete it. So there are a lot of challenges like this.
And always my dev friends always love to go ahead and make all the admin services open to
the internet. So that's another challenge as well. So this is just one service. How big can it get?
Like how many services are there which can be open to the internet and which can act as a shadow
IT services or shadow IT resources in an enterprise environment? There are a lot. And just for a
high-level example, there are several services, popular services, which are being used and the
resources in these environments can be easily made public. And there is a huge gap in terms
of security monitoring, whether this resource is public to the internet or not. This resource has
authentication or not. Is this an API endpoint, which doesn't have any API key or any authorization
requirement? So there are like so many other factors. And then to map all these internet
resources, what I used a lot is to go ahead and use a few tools like Perimeterate and
SmogCloud, CloudMapper, my favorite one. And for Google Cloud environment, we started using Force
So the first one is, it goes ahead and periodically scans all the AWS internet services
and it identifies the resources which are public to the internet, which are exposed to the internet
and it gives a very beautiful JSON format data at the end. So I just, what I do is like,
I just collect the data and then upload it to our tools like Shodan Monitor, where we always
monitor for vulnerable ports or admin ports being exposed to the internet. And we get email
alerts and the SOC team or the incident response team follows up. So the other tool is SmogCloud
and Perimeterate and CloudMapper. These three are for AWS. And the fourth security is for Google
Cloud. And it's a bit more complex to use. And it's really huge as well. Setting up is easy,
maintaining is a bit tough. So the coverage is just, there are open source tools available
for a few AWS, I mean, few cloud providers. And there are, these open source tools are
offering, I mean, supporting only limited number of resources. So these are the primary challenges
that we have faced. Like, if we want to use an open source tool, the open source tool should be
going ahead and scanning all the environments, like multiple environments on a periodic basis,
without we going ahead and manually running those scripts on every account by switching the roles.
It's a complex work, right? And a single tool should be able to monitor multiple clouds.
And the third one is the IP addresses collected from all the public cloud environments should
be easily ingested into a security monitoring tool, the internet attack surface tool,
like short end monitor or something like that, to make sure none of the admin services are exposed.
And it drastically reduces the shadow ID actually. So for that, what we did is like,
build a security tool, which was initially called as Nightwatch, because my friends,
the developer friends, a lot of guys are like, fans of Game of Thrones. So we went ahead and
renamed it Nightwatch. And later, when we go ahead and try to create a repo and make it public,
we saw that there are already 10 or 15 Nightwatch tools on the GitHub. So we decided like,
we need a name change. And then we changed the name from Nightwatch to the Cloud Frontier.
So that's how we went ahead and we built the Nightwatch. Nightwatch is a small project to
monitor the internet attack surface of public cloud environments. And currently, the cloud
providers that are being supported are AWS, Azure, Oracle, DigitalOcean, and Google Cloud.
So to give a quick demo of the application,
you just click on Get Started. And then you'll be able to see the most commonly used ports,
and the administrative ports, and the vulnerabilities, and the total number of
ports that are exposed to the internet that belongs to your organization, and the number
of IP addresses. And when you click on the Internet Asset tab, you'll be able to see
IP addresses, domains, object storages, data storages, API endpoints, content delivery networks.
So the Cloud Frontier goes into each and every account, irrespective of the cloud provider,
and then grabs all these internet facing assets. First of all, it checks for the internet facing
assets, it grabs them, and then it populates it over here. So for each and every IP address,
the score is provided, and a tagging, which helps to understand which environment this
IP belongs to, and what are the port numbers that are already open.
Then going to the domain section, we go ahead and we collect all the public domains of EC2 servers,
or else Route 53 subdomains, Google Cloud DNS. And we go ahead and monitor all those domains for
that. Let me just go back. Yeah, we just monitor those domains for security
posture using Mozilla Observatory and Verisource as well.
So the next one is the famous object storages. So the object storages helps us to go
collect all the buckets, blobs, spaces, so from multiple cloud providers, and then
provide a website URL if there is one available, and indicate whether this resource is public or
not. So based on this, a security engineer will be able to go ahead and take some quick actions
than drilling down the JSON logs or JSON data from other open source tools.
And there are also, we have a lot of snapshots and custom-made images in the enterprise, I mean,
our organization. So we decide to go ahead and have an asset collecting metric for the data
storages, like if there is any RDS instance or any AMI, we go ahead and collect it, and then
we indicate whether it is public or private. It's the same with the API endpoints as well.
So we provide what is the endpoint, whether the API key is required or not for this endpoint,
and what is the authorization, is it a Cognito authentication or it is anything, something else,
Google Cloud Identity or anything else. So that kind of information will be provided for the API
endpoints. And last is the content delivery network. It provides the CDNs, and it makes
sure whether the CDN is enabled or not, and what the custom domain to which the CDN is being pointed
to, and what cloud provider it is. So not everyone likes the light background, so there is a huge
fan base for the dark theme. So you can just quickly switch from light mode to the dark mode,
and then use the same features in the dark mode as well. My personal preference was dark mode, and
yeah, it's pretty much that's it. So let me go to the next slide. I would like to go ahead and
quickly explain the components of this tool. It has collectors, analyzers, and outputs. So the
collectors are the lambda functions which go ahead and collect the public or internet-facing assets
from multiple cloud providers. And the analyzers are the ones which go ahead and check whether
the bucket is public or not, or the blob is public or not, or else it goes ahead and identifies
whether there's an authorization key or API key enabled for an API endpoint. So all these
kind of things will be analyzed. And then if there are like so many IP addresses, what happens is
we go ahead and collect all those IP addresses and scan them against
Shodan and the virus total. And if it is a domain, a Mozilla Observatory score will be provided.
And it says we have an environment file which is pretty much like an
input file where you go ahead and input the credentials of your cloud environment. So
every cloud has its own environment file. You just have to go ahead and insert the access
keys or else the JSON file, I mean the service account JSON file from Google Cloud,
just insert it and then you should be able to go ahead and run this
service. And currently there are quite a few supported services. And these are the services
which have potential internet-facing assets. So all these services are currently monitored
and analyzed on a regular basis. So you can always set cron jobs, like it's a CloudWatch
rule. You just have to go ahead and simply trigger the CloudWatch rule as per your convenience.
If you want to go ahead and make the CloudFrontier to run on a six-hour interval,
you just have to go ahead and edit the CloudWatch rule to run it in a six-hour interval.
So and these are my friends. So I just moved back to India and then I met new friends.
I created the tool and then they are like very good developers who are interested in
contributing to the open source community. So we all, I mean not just, we all
didn't just have Biryani, but we also had built this tool for the open source community.
And you can, yeah, you can access, the documentation is here. And if you see here,
we just, yeah, as Jiren has mentioned like 30 minutes back, it has been published.
And you can go ahead and review the documentation and have the access keys. I mean, you can go ahead
and start using it. And in case if you have any issues or if you have any feedback or
place for improvement, feel free to throw out the issues and looking forward for the
contribution from the open source community. Yeah, we'll be available for any questions.
Hey, just a quick question for me. What kind of, you know, access to the cloud
environments does this tool require? So it's just the service accounts and the security audit
view only access. Got it. Yeah. And it is documented here where for the Azure,
just create an application in AD and then get the subscription ID, get the tenant ID,
client ID, secret. And just once you get all these things added to the environment file,
same with the solution, Oracle Cloud, Shodan and other API keys from where you can get
the information. Seems pretty straightforward. If we wanted to disable certain lookups like
VirusTotal or the Firefox one or Mozilla one, are we able to do that?
I think there is a flexibility just like you have to just stop that analyzer from running.
We have created multiple analyzers for multiple functions.
We have an analyzer for Shodan, one for Mozilla Observatory. So you just need to go ahead and
disable it. And once you disable that analyzer, I mean, it's not available in the front end,
you need to just tweak it in the back end. And once this, because the entire stack is deployed
to AWS, so it's not very tightly coupled and it's very loosely coupled. So the tweaks are pretty
easy.