by Jeff Parr, ThreatResponse Learn how to use ThreatResponse's open source incident response toolkit https://www.threatresponse.cloud/.

1. ThreatResponse
https://threatresponse.cloud

2. Be a free open source incident
response toolkit for
Amazon Web Services.

3. Agenda
● A Look at Cloud Incidents
● Resilient Security
● Standard incidents and response
● Incident Handling Challenges in AWS
● Tool Demos

4. How ready are you to
respond to an incident
at your place of business?

6. Cloud Incidents are High Risk

8. WHOLISTIC
SECURITY

9. Attackers are automating.
Why aren’t you?

10. Shamelessly borrowed from Dino Dai Zovi https://www.youtube.com/watch?v=86oTJjEnNEI
Corollary Corollary Corollary
Overly focused
OS-Level protection
misses avenues for cloud
level priv-esc attacks.
Overly focused
security of one service /
product misses avenues
for cloud level
compromise.
Overly focused
Devops and cattle class
environments miss
avenues for persistence.
Attackers exploit new frontiers
...defenders are still fighting the last war.

11. RESILIENT
SECURITY

12. 12
The Red Pill
of
Resilience
@swagitda_ aka Kelly Shortridge, Security ScoreCard
https://www.youtube.com/watch?v=ux--pHFpeac

13. Resilience is
systemic
Infosec resilience means
a flexible system that can
absorb an attack and
reorganize around a
threat. -- Kelly Shortridge

14. https://www.youtube.com/watch?v=ux--pHFpeac
Robustness
How can you withstand an
attack?
Adaptability
How can you reduce your
losses?
Transformability
How can you challenge
your assumptions?
Who will attack you?
What will you do?

15. Incident Response
is a
resilience tactic

16. Resilience
makes
response
EASIER

17. Resilience by
design...
Everything fails all the time

18. We are
all
security engineers
https://www.youtube.com/watch?v=nFKVzEAm-ts

19. EVALUATE THE RISK
Assess the Risk Form a plan Test the plan
Repeat
Regularly and Randomly

20. Credit: Toni de la Fuente blyx.com

21. Common Incident Types
● Instance / Application
● IAM / Credentials
● S3

22. Common EC2 Incidents
● Cryptojacking
● Information Disclosure via
Vulnerability
● Pivot via Vulnerability
● AMI Poisoning
● Account Jumping

23. Common IAM Incidents
● Credential Leak - Access Keys
● Temporary Session Token Attacks
● Role Attacks (unintended access)
● Backdooring Roles for Persisting via
STSToken
● Persistance via Typo Squatting

24. Common S3 Incidents
● Data leaks
● Website defacement
● Subdomain Takeovers
● Hosting malicious files

25. ● Create Internal Case File
● Create Support Case with AWS
○ Need to suppress AUP?
● Tag Resources under investigation
● Internal Disclosure
● Check Logging / Adjust
● Trigger Network Capture - VPC Logs
Incident Response
Basic first steps

26. Instance Compromises

28. Additional Evaluation
Lateral Movement Potential
● Assess other systems running in the
same VPC
● Was the instance running in a role?
● Were there keys on the box?

29. Additional Evaluation
Evidence Preservation
● Do we have flow logs we can grab and
archive for the incident?
● Do we need to do live response?
● Do we need to preserve a snapshot
for offline forensics?

30. Access Key Compromises

31. … they happen
● Vim swap files
● Tools that generate key files ( Packer )
● Mobile app distribution
● Slack bots
Key Compromise

34. Key Compromises
are Scary
Persistence
● New users - typosquatting
● Creating new access keys
● STS Tokens

35. S3 Compromises
What besides configuration?
Code Corruption Attacks
● Malicious Code in Pipeline
● Replacing Signatures Hosted in S3
Web Hosting Attacks
● Defacement
● Subdomain takeovers
● Malicious Download Hosting
Logs
● Attacks on CloudTrail Buckets via
lifecycle manipulation

36. Having a tough day in the cloud
Soft-Issues
● Cease and desist goes to account owner
● No response role
● Gaining necessary access
● Lack of uniformity
● Lack of familiarity on side of responder
● What is normal?
Technical Issues
● Failed containment
● Destruction / Mishandling of evidence
● Involves lots of instances ( Maybe )
● No auditd
● No syslogs

37. Tools
You wanted to see some, right?

38. Product Portfolio - Primary Offerings
● Margarita Shotgun
○ Remote Memory Acquisition
● AWS_IR
○ Command line Tool

39. Product Portfolio - Secondary Offerings
● Lime Compiler - Kernel Module Builder
○ Leveraged by Margarita Shotgun
● Aws-ir-plugins
○ Expandable architecture

40. Product Portfolio - Paid Offerings
● Ephemeral Systems Incident Pony
○ Automation Hub and Case Management
○ See: ephemeralsystems.com

41. Margarita Shotgun:
Remote Memory Acquisition
In Parallel

42. How does it work?
● SSH into target
● Interrogates system
● Fetches kernel module from
repository
● Inserts that into system
● Delivers memory to
○ s3
○ local disk

43. What’s new?
10x Faster with compression support at
endpoint.
Jump Box Support
Auto module resolution with Lime
Compiler
Props to @joelferrier!

44. Margarita Shotgun Demo
ASCIINEMA :
https://asciinema.org/a/130403

45. LiME Compiler:
Precompiled LiME Modules
for common AWS hosts
https://github.com/ThreatResponse/lime-compiler

46. Builds LiME Kernel modules for:
● Amazon Linux
● Centos 6
● Centos 7
● Debian 7
● Debian 8
● Ubuntu 12.04
● Ubuntu 14.04
● Ubuntu 15.10
● Ubuntu 16.04
● Ubuntu 16.10
● Other? ...
Hosted by Mozilla!
● You can byom ( run it yourself )
● GPG Signing
● Standard yum XML repo format
● Docker Driver
● Currently builds every 4-hours

47. AWS_IR CLI:
Response Automation
for instance and key compromise

48. AWS_IR CLI:
● Parallel host acquisition
● IP or instance id for targeting
● Custom incident plans
● Plugin System
● GPG key installation

49. AWS_IR Setup:
Responder Roles:
https://github.com/ThreatResponse/aws_ir/bl
ob/master/cloudformation/responder-role.yml

50. AWS_IR
ASCIINEMA :
https://asciinema.org/a/130418
Plugins:
● Gather Host
● Isolate Host
● Tag Host
● Snapshot disks
● Examiner ACL
● Get Memory
● Stop Host
Targets.txt: One instance_id / IP per line

51. AWS_IR Key Compromise Plugins

52. Key Compromise
$ aws_ir key-compromise --access-key-id AKIAINLHPIG64YJXPK5A
2017-07-20T21:04:01 - aws_ir.cli - INFO - Initialization successful proceeding to incident plan.
2017-07-20T21:04:01 - aws_ir.plans.key - INFO - Attempting key disable.
2017-07-20T21:04:03 - aws_ir.plans.key - INFO - STS Tokens revoked issued prior to NOW.
2017-07-20T21:04:03 - aws_ir.plans.key - INFO - Disable complete. Uploading results.
Processing complete for cr-17-072104-7d5f
Artifacts stored in s3://cloud-response-9cabd252416b4e5a893395c533f340b7

53. AWS_IR : What is happening?
$ aws_ir --examiner-cidr-range '4.4.4.4/32' instance-compromise --target 52.40.162.126 --user ec2-user --ssh-key
~/Downloads/testing-041.pem
2017-07-20T21:10:50 - aws_ir.cli - INFO - Initialization successful proceeding to incident plan.
2017-07-20T21:10:50 - aws_ir.libs.case - INFO - Initial connection to AmazonWebServices made.
2017-07-20T21:11:03 - aws_ir.libs.case - INFO - Inventory AWS Regions Complete 14 found.
2017-07-20T21:11:03 - aws_ir.libs.case - INFO - Inventory Availability Zones Complete 37 found.
2017-07-20T21:11:03 - aws_ir.libs.case - INFO - Beginning inventory of resources world wide. This might take a minute...
2017-07-20T21:11:03 - aws_ir.libs.inventory - INFO - Searching ap-south-1 for instance.
2017-07-20T21:11:05 - aws_ir.libs.inventory - INFO - Searching eu-west-2 for instance.
2017-07-20T21:11:05 - aws_ir.libs.inventory - INFO - Searching eu-west-1 for instance.
2017-07-20T21:11:06 - aws_ir.libs.inventory - INFO - Searching ap-northeast-2 for instance.
2017-07-20T21:11:07 - aws_ir.libs.inventory - INFO - Searching ap-northeast-1 for instance.
2017-07-20T21:11:08 - aws_ir.libs.inventory - INFO - Searching sa-east-1 for instance.
2017-07-20T21:11:09 - aws_ir.libs.inventory - INFO - Searching ca-central-1 for instance.
2017-07-20T21:11:09 - aws_ir.libs.inventory - INFO - Searching ap-southeast-1 for instance.
2017-07-20T21:11:10 - aws_ir.libs.inventory - INFO - Searching ap-southeast-2 for instance.
2017-07-20T21:11:11 - aws_ir.libs.inventory - INFO - Searching eu-central-1 for instance.
2017-07-20T21:11:12 - aws_ir.libs.inventory - INFO - Searching us-east-1 for instance.
2017-07-20T21:11:13 - aws_ir.libs.inventory - INFO - Searching us-east-2 for instance.
2017-07-20T21:11:13 - aws_ir.libs.inventory - INFO - Searching us-west-1 for instance.
2017-07-20T21:11:13 - aws_ir.libs.inventory - INFO - Searching us-west-2 for instance.
2017-07-20T21:11:14 - aws_ir.libs.case - INFO - Inventory complete. Proceeding to resource identification.

54. Lock step execution
2017-07-20T21:11:14 - aws_ir.plans.host - INFO - Proceeding with incident plan steps included are ['gather_host', 'isolate_host',
'tag_host', 'snapshotdisks_host', 'examineracl_host', 'get_memory', 'stop_host']
2017-07-20T21:11:14 - aws_ir.plans.host - INFO - Executing step gather_host.
2017-07-20T21:11:15 - aws_ir.plans.host - INFO - Executing step isolate_host.
2017-07-20T21:11:16 - aws_ir.plans.host - INFO - Executing step tag_host.
2017-07-20T21:11:17 - aws_ir.plans.host - INFO - Executing step snapshotdisks_host.
2017-07-20T21:11:17 - aws_ir.plans.host - INFO - Executing step examineracl_host.
2017-07-20T21:11:19 - aws_ir.plans.host - INFO - Executing step get_memory.
2017-07-20T21:11:19 - aws_ir.plans.host - INFO - attempting memory run
2017-07-20T21:11:19 - aws_ir.plans.host - INFO - Attempting run margarita shotgun for ec2-user on 52.40.162.126 with
/Users/akrug/Downloads/testing-041.pem
2017-07-20T21:11:21 - margaritashotgun.repository - INFO - downloading
https://threatresponse-lime-modules.s3.amazonaws.com/modules/lime-4.9.32-15.41.amzn1.x86_64.ko as
lime-2017-07-21T04:11:21-4.9.32-15.41.amzn1.x86_64.ko
2017-07-20T21:11:25 - margaritashotgun.memory - INFO - 52.40.162.126: dumping memory to
s3://cloud-response-a0f2d7e68ef44c36a79ccfe4dcef205a/52.40.162.126-2017-07-21T04:11:19-mem.lime
2017-07-20T21:15:43 - margaritashotgun.memory - INFO - 52.40.162.126: capture 10% complete
2017-07-20T21:19:37 - margaritashotgun.memory - INFO - 52.40.162.126: capture 20% complete
2017-07-20T21:23:41 - margaritashotgun.memory - INFO - 52.40.162.126: capture 30% complete
2017-07-20T21:28:17 - margaritashotgun.memory - INFO - 52.40.162.126: capture 40% complete
2017-07-20T21:32:42 - margaritashotgun.memory - INFO - 52.40.162.126: capture 50% complete
2017-07-20T21:37:18 - margaritashotgun.memory - INFO - 52.40.162.126: capture 60% complete
2017-07-20T21:39:18 - margaritashotgun.memory - INFO - 52.40.162.126: capture 70% complete
2017-07-20T22:00:13 - margaritashotgun.memory - INFO - 52.40.162.126: capture 80% complete
2017-07-20T22:04:19 - margaritashotgun.memory - INFO - 52.40.162.126: capture 90% complete
2017-07-20T22:17:32 - margaritashotgun.memory - INFO - 52.40.162.126: capture 100% complete
2017-07-20T21:41:52 - aws_ir.plans.host - INFO - memory capture completed for: ['52.40.162.126'], failed for: []
2017-07-20T21:41:52 - aws_ir.plans.host - INFO - Executing step stop_host.
Processing complete for cr-17-072104-7d5f
Artifacts stored in s3://cloud-response-a0f2d7e68ef44c36a79ccfe4dcef205a

56. Demo
ThreatResponse workstation:
https://github.com/EphemeralSystems/threatresponse-ws
Find Demo Videos here:
https://vimeo.com/user27700454

57. Incident Pony
● Automation & Preparedness
● Cross Account Wizardry
● Pub / Sub for SEIM, GuardDuty,
Alert Pipelines, Etc
● Team Handoffs with Access Control
● Case File Management
● Chain of Custody
● Logging, logging, logging
● Change Tracking
● Security Guardrails

58. Future
Will you be a contributor?

59. Alex McCormack
Joel Ferrier
Graham Jones
Toni de la Fuente
Jeff Parr
Jeff Bryner
Daniel Hartnell
Kevin Hock
Julien Vehent
Gene Wood
Henrik Johansson
Beetle Bailey
Rich Jones
Greg Guthe
Vegard Vaage
Contributors: