Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Information Leakage in AWS Resource-Based Policy APIs

Summary: Unit 42 researchers found that 22 APIs across 16 AWS services can be abused to enumerate the IAM users and roles in arbitrary accounts, and the technique works across all three AWS partitions (aws, aws-us-gov, aws-cn). The flaw is in AWS's policy validator, which returns an error when a resource-based policy names a nonexistent principal, letting an attacker test identities one by one with no logs appearing in the targeted account.

What's compelling: The victim account sees nothing: CloudTrail logs and error messages land only in the attacker's account, so an adversary can map your internal structure and pick targets at leisure with no observable trace. Unit 42 used a misconfigured IAM role found this way to compromise a customer's cloud account with thousands of workloads.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related