start	end	text
0	7300	I'm going to start with the reason why we have went ahead and open sourced this project.
7420	16200	So before that, welcome to DEF CON SAFEMODE. And about myself, I'm Setu Parimi. I'm a cloud
16200	22560	security architect working at Grumman-Foster. And my full-time job is designing and deploying
22560	27940	enterprise security solutions as a security consultant. And in my free time, I just work
27940	32600	as an independent security researcher with my interests completely towards the cloud
32600	40180	native technologies. I'm a cloud member at CloudVillage and coming to the storyline which
40180	49120	I was mentioning earlier. So a few years back, the ACME Corp is my friend and all his applications
49120	57920	are on-premise. And then he started using AWS. And after that, the cyber team gets notified
57920	64500	about it. So when the cyber team gets notified about it, what happens is the cyber team is
64500	72500	just wrapped up all the enterprise security controls for the organization. And then the
72500	77240	dev folks will come to the cyber team and then they notify like, hey guys, we are just moving
77240	85660	all our apps from a data center to the cloud. And a few months later, what happens is there
85660	91120	is another business unit like an infrastructure team who are interested in Office 365 and Azure
91120	97080	AD, all this other stuff. They want to move to Azure. So now it is on-premise data center and
97080	104240	then we have an AWS environment and now the third one is Azure. So again, the cyber security team
104240	112100	will be late to the party as usual. So they get notified at the end of signing the NDAs and all
112100	117580	the other stuff. Once the cyber security team gets notified, the cyber security team would be in a
117580	123080	situation like they have worked so hard in the past few months to go ahead and implement several
123080	128220	security controls in cloud. There will be a huge learning curve and all other things. And they just
128220	135520	wrapped it up and then the infra team says like, we want to go ahead and move our
135520	141800	on-premise exchange boxes to Office 365. We want to move from Skype to Microsoft Teams.
141800	147880	We are going to Microsoft Azure. You guys have to secure it. And then the cyber security team
147880	154260	has again a learning curve. They go ahead and secure it. So it keeps again. The third team
154260	159020	is something like a business intelligence team. They say like artificial intelligence modules
159020	165600	services are good in GCP. So they start using GCP and every business unit has their own reason
165600	175360	to use their own preferred cloud provider. And the situation gets in a way like an organization
175360	183500	with like 50 to 60 applications will be having like four to five public cloud providers. And
183500	190680	it's a nightmare for a security team to go ahead and manage the security for all these public
190680	197640	cloud providers and also maintain the shadow risk and all the other stuff. To make the scenario a
197640	204960	bit more complex, what happens is the dev folks, the DevOps folks, they go ahead and follow
204960	213160	something called an environment-based hierarchy. So the resource hierarchy in AWS is something like
213160	220080	you can go ahead and have one account for dev, one for prod, one for staging. Again, one for
220080	225340	UAT. So they have like for a single application, they have three accounts. And when you think
225340	232280	about like an enterprise scale, you grow from three to five AWS accounts to 100 to 150 AWS
232280	240120	accounts very quickly. It's same with Google Cloud or Azure. So the resource hierarchy makes the
240120	247020	security monitoring a bit more complex and it increases the shadow risk of an organization.
248440	255000	So to explain a small problem, it's like we use a lot of open source tools to go ahead and identify
255000	261860	the security vulnerabilities across multiple cloud environments. The first issue is like we have
262480	266540	multiple accounts, not one account. So we need to go ahead and run the scripts, the open source
266540	274040	tools in multiple accounts. And an example is like the tool identifies a security group, which
274400	280180	is indicating that all the ports are open to the internet and it's in the DMZ environment.
280520	288580	So the cyber team goes ahead and identifies what are the instances behind that security group and
288580	295460	they come to know that this is a dead security group. It's an idle security group, which is
295460	302240	some developer or someone else forgot to delete it. So there are a lot of challenges like this.
303080	309640	And always my dev friends always love to go ahead and make all the admin services open to
309640	319060	the internet. So that's another challenge as well. So this is just one service. How big can it get?
319060	324300	Like how many services are there which can be open to the internet and which can act as a shadow
324300	330580	IT services or shadow IT resources in an enterprise environment? There are a lot. And just for a
330580	337960	high-level example, there are several services, popular services, which are being used and the
337960	344640	resources in these environments can be easily made public. And there is a huge gap in terms
344640	353000	of security monitoring, whether this resource is public to the internet or not. This resource has
353000	358800	authentication or not. Is this an API endpoint, which doesn't have any API key or any authorization
359360	367260	requirement? So there are like so many other factors. And then to map all these internet
367840	375160	resources, what I used a lot is to go ahead and use a few tools like Perimeterate and
375160	381360	SmogCloud, CloudMapper, my favorite one. And for Google Cloud environment, we started using Force
382000	389260	So the first one is, it goes ahead and periodically scans all the AWS internet services
389920	394540	and it identifies the resources which are public to the internet, which are exposed to the internet
394540	405440	and it gives a very beautiful JSON format data at the end. So I just, what I do is like,
405440	411160	I just collect the data and then upload it to our tools like Shodan Monitor, where we always
411160	417440	monitor for vulnerable ports or admin ports being exposed to the internet. And we get email
417440	423540	alerts and the SOC team or the incident response team follows up. So the other tool is SmogCloud
423540	430120	and Perimeterate and CloudMapper. These three are for AWS. And the fourth security is for Google
430120	438380	Cloud. And it's a bit more complex to use. And it's really huge as well. Setting up is easy,
438380	448240	maintaining is a bit tough. So the coverage is just, there are open source tools available
448240	455800	for a few AWS, I mean, few cloud providers. And there are, these open source tools are
455800	463200	offering, I mean, supporting only limited number of resources. So these are the primary challenges
463200	468800	that we have faced. Like, if we want to use an open source tool, the open source tool should be
468800	475320	going ahead and scanning all the environments, like multiple environments on a periodic basis,
475320	481480	without we going ahead and manually running those scripts on every account by switching the roles.
481480	486730	It's a complex work, right? And a single tool should be able to monitor multiple clouds.
486730	494850	And the third one is the IP addresses collected from all the public cloud environments should
494850	500510	be easily ingested into a security monitoring tool, the internet attack surface tool,
500510	506170	like short end monitor or something like that, to make sure none of the admin services are exposed.
506190	516710	And it drastically reduces the shadow ID actually. So for that, what we did is like,
516710	525670	build a security tool, which was initially called as Nightwatch, because my friends,
525670	529930	the developer friends, a lot of guys are like, fans of Game of Thrones. So we went ahead and
529930	535650	renamed it Nightwatch. And later, when we go ahead and try to create a repo and make it public,
535650	542990	we saw that there are already 10 or 15 Nightwatch tools on the GitHub. So we decided like,
542990	548010	we need a name change. And then we changed the name from Nightwatch to the Cloud Frontier.
548010	554810	So that's how we went ahead and we built the Nightwatch. Nightwatch is a small project to
554810	559550	monitor the internet attack surface of public cloud environments. And currently, the cloud
559550	564650	providers that are being supported are AWS, Azure, Oracle, DigitalOcean, and Google Cloud.
565290	570870	So to give a quick demo of the application,
573030	578390	you just click on Get Started. And then you'll be able to see the most commonly used ports,
578390	582690	and the administrative ports, and the vulnerabilities, and the total number of
582690	586250	ports that are exposed to the internet that belongs to your organization, and the number
586250	593530	of IP addresses. And when you click on the Internet Asset tab, you'll be able to see
593530	602110	IP addresses, domains, object storages, data storages, API endpoints, content delivery networks.
602190	609790	So the Cloud Frontier goes into each and every account, irrespective of the cloud provider,
609790	614710	and then grabs all these internet facing assets. First of all, it checks for the internet facing
614710	623090	assets, it grabs them, and then it populates it over here. So for each and every IP address,
623090	631190	the score is provided, and a tagging, which helps to understand which environment this
631730	635710	IP belongs to, and what are the port numbers that are already open.
636230	644270	Then going to the domain section, we go ahead and we collect all the public domains of EC2 servers,
644270	652790	or else Route 53 subdomains, Google Cloud DNS. And we go ahead and monitor all those domains for
653090	658710	that. Let me just go back. Yeah, we just monitor those domains for security
659650	663970	posture using Mozilla Observatory and Verisource as well.
664310	671910	So the next one is the famous object storages. So the object storages helps us to go
673530	681190	collect all the buckets, blobs, spaces, so from multiple cloud providers, and then
681750	687810	provide a website URL if there is one available, and indicate whether this resource is public or
687810	694830	not. So based on this, a security engineer will be able to go ahead and take some quick actions
695790	703450	than drilling down the JSON logs or JSON data from other open source tools.
703810	709910	And there are also, we have a lot of snapshots and custom-made images in the enterprise, I mean,
709910	720970	our organization. So we decide to go ahead and have an asset collecting metric for the data
720970	728050	storages, like if there is any RDS instance or any AMI, we go ahead and collect it, and then
728050	733730	we indicate whether it is public or private. It's the same with the API endpoints as well.
733730	738550	So we provide what is the endpoint, whether the API key is required or not for this endpoint,
738550	743570	and what is the authorization, is it a Cognito authentication or it is anything, something else,
743570	748490	Google Cloud Identity or anything else. So that kind of information will be provided for the API
748490	759530	endpoints. And last is the content delivery network. It provides the CDNs, and it makes
759530	765010	sure whether the CDN is enabled or not, and what the custom domain to which the CDN is being pointed
765010	774950	to, and what cloud provider it is. So not everyone likes the light background, so there is a huge
774950	781310	fan base for the dark theme. So you can just quickly switch from light mode to the dark mode,
781310	787710	and then use the same features in the dark mode as well. My personal preference was dark mode, and
788410	797370	yeah, it's pretty much that's it. So let me go to the next slide. I would like to go ahead and
797370	805490	quickly explain the components of this tool. It has collectors, analyzers, and outputs. So the
805490	812390	collectors are the lambda functions which go ahead and collect the public or internet-facing assets
812390	820770	from multiple cloud providers. And the analyzers are the ones which go ahead and check whether
821430	827810	the bucket is public or not, or the blob is public or not, or else it goes ahead and identifies
827810	834170	whether there's an authorization key or API key enabled for an API endpoint. So all these
834170	839270	kind of things will be analyzed. And then if there are like so many IP addresses, what happens is
839710	843730	we go ahead and collect all those IP addresses and scan them against
844390	853190	Shodan and the virus total. And if it is a domain, a Mozilla Observatory score will be provided.
853990	858970	And it says we have an environment file which is pretty much like an
860330	866870	input file where you go ahead and input the credentials of your cloud environment. So
866870	872810	every cloud has its own environment file. You just have to go ahead and insert the access
872810	877370	keys or else the JSON file, I mean the service account JSON file from Google Cloud,
877370	881310	just insert it and then you should be able to go ahead and run this
884050	890970	service. And currently there are quite a few supported services. And these are the services
890970	898410	which have potential internet-facing assets. So all these services are currently monitored
898410	904610	and analyzed on a regular basis. So you can always set cron jobs, like it's a CloudWatch
904610	909050	rule. You just have to go ahead and simply trigger the CloudWatch rule as per your convenience.
909090	913430	If you want to go ahead and make the CloudFrontier to run on a six-hour interval,
913430	917670	you just have to go ahead and edit the CloudWatch rule to run it in a six-hour interval.
917670	927490	So and these are my friends. So I just moved back to India and then I met new friends.
927490	932190	I created the tool and then they are like very good developers who are interested in
932590	938290	contributing to the open source community. So we all, I mean not just, we all
938990	945750	didn't just have Biryani, but we also had built this tool for the open source community.
947190	954030	And you can, yeah, you can access, the documentation is here. And if you see here,
954030	959010	we just, yeah, as Jiren has mentioned like 30 minutes back, it has been published.
959050	968870	And you can go ahead and review the documentation and have the access keys. I mean, you can go ahead
968870	973990	and start using it. And in case if you have any issues or if you have any feedback or
973990	978690	place for improvement, feel free to throw out the issues and looking forward for the
978690	986210	contribution from the open source community. Yeah, we'll be available for any questions.
988530	999710	Hey, just a quick question for me. What kind of, you know, access to the cloud
999710	1006070	environments does this tool require? So it's just the service accounts and the security audit
1006070	1014170	view only access. Got it. Yeah. And it is documented here where for the Azure,
1014170	1019030	just create an application in AD and then get the subscription ID, get the tenant ID,
1019030	1024090	client ID, secret. And just once you get all these things added to the environment file,
1024090	1029170	same with the solution, Oracle Cloud, Shodan and other API keys from where you can get
1029630	1036390	the information. Seems pretty straightforward. If we wanted to disable certain lookups like
1036390	1042890	VirusTotal or the Firefox one or Mozilla one, are we able to do that?
1044370	1050010	I think there is a flexibility just like you have to just stop that analyzer from running.
1050010	1053930	We have created multiple analyzers for multiple functions.
1053950	1059470	We have an analyzer for Shodan, one for Mozilla Observatory. So you just need to go ahead and
1059470	1064890	disable it. And once you disable that analyzer, I mean, it's not available in the front end,
1064890	1070130	you need to just tweak it in the back end. And once this, because the entire stack is deployed
1070130	1075370	to AWS, so it's not very tightly coupled and it's very loosely coupled. So the tweaks are pretty
1075370	1075790	easy.