Researchers spot 22 AWS APIs that can be abused to leak info

According to researchers from Unit 42, a Palo Alto Networks threat intelligence team, this class of AWS APIs can be abused to leak the AWS Identity and Access Management (IAM) users and roles in arbitrary accounts across all three AWS partitions (aws, aws-us-gov or aws-cn).

"AWS services that can be potentially abused by attackers include Amazon Simple Storage Service (S3), Amazon Key Management Service (KMS) and Amazon Simple Queue Service (SQS).

"A malicious actor may obtain the roster of an account, learn the organization's internal structure and launch targeted attacks against individuals," Palo Alto Networks researchers claimed in a blog post.

In a recent Red Team exercise, Unit 42 researchers compromised a customer's cloud account with thousands of workloads using a misconfigured IAM role identified by this technique.

The "stealthy" property of the exploit makes detection and prevention difficult.

"Attackers can have unrestricted time to perform reconnaissance on random or targeted AWS accounts without worrying about being noticed," they noted.

AWS which is Amazon's Cloud arm, was yet to react to the report.

AWS is the world's most comprehensive and broadly adopted cloud platform, offering over 175 fully featured services from data centres globally.

According to the researchers, the root cause of the issue is that the AWS backend proactively validates all the resource-based policies attached to resources such as Amazon Simple Storage Service (S3) buckets and customer-managed keys.

"Resource-based policies usually include a Principal field that specifies the identities (users or roles) allowed to access the resource. If the policy contains a nonexistent identity, the API call that creates or updates the policy will fail with an error message," they wrote.

This convenient feature, however, can be abused to check whether an identity exists in an AWS account.

Policy validation is a feature from AWS that facilitates the user experience.

While most users benefit from the feature, adversaries may also find the feature useful for performing reconnaissance in another account.

"Adversaries can repeatedly invoke these APIs with different principals to enumerate the users and roles in a targeted account. Attackers can have unrestricted time to perform reconnaissance on random or targeted AWS accounts without worrying about being noticed," said the researchers.

The Unit 42 team said that detecting and preventing identity reconnaissance using this technique is difficult as there are no observable logs in the targeted accounts.

"However, good IAM security hygiene can still effectively mitigate the threats from this type of attack," they said.