Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Unit 42 Cloud Threat Report: Misconfigured IAM Roles Lead to Thousands of Compromised Cloud Workloads

Summary: In a spring 2020 Red Team exercise against a customer's AWS environment of thousands of workloads, hundreds of S3 buckets and nearly 1,000 roles across four accounts, Unit 42 researchers gained privileged access to two AWS accounts through two separate IAM misconfigurations. One was a risky policy combination letting a developer role chain permissions to AdministratorAccess, the other an overly permissive IAM trust policy allowing anonymous access; GitHub reconnaissance then found similarly misconfigured accounts at a U.S. pharmaceutical company and a Brazil-based financial company.

Key Takeaway: The researchers reached certificate private keys, database credentials and repository source code, and note that hundreds of developers used the exploitable role daily, so a single phished developer token could have handed an attacker AdministratorAccess to the entire cloud. The 2019 Capital One breach, cited here at $80 million, shows what an overly permissive IAM configuration costs when it is actually used.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related