43
In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection Systems are aware that it's an authorised scan.
Both AWS and Azure have policies detailing the process and what's acceptable to test. The AWS one is here and the ...
10
I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script -
On monkeyoto's suggestion, I blocked all communication with the mining pool server - iptables -A INPUT -s xmr.crypto-pool.fr -j DROP and iptables -A OUTPUT -d xmr.crypto-pool....
8
Spectre is far harder to use than Meltdown. In a cloud hosting situation, an attacker needs to know:
What software the target is using
Where in memory that software is
Where in memory the target data is
The behavior of the host CPU's branch predictor
The behavior of the host CPU's speculative execution system
and possibly some other things I'm forgetting
...
7
You should also check with your ISP. Depending on government regulations and their own operating policies, they could be required to block your pentest actions if detected, or cancel your service completely. They may even be required to report you to law enforcement agencies.
7
Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of binaries. You minimizing SSH does little if you're running a vulnerable version of Wordpress, or Joomla, or something different. For example, there was a Nagios ...
7
You are asking yourselves the right questions but asking us the wrong one.
Security controls, like AV, are meant to address threats in order to reduce the impact to an acceptable level. You have identified the threats and the likely impact of those threats. Great! Now you need to see if signature-based AV addresses those threats and reduces impact to an ...
6
tl;dr Auditors
Many data security audits require data to be encrypted at rest. Often the threat model is an old hard drive ending up on eBay or picked out of the dump. If the data is unencrypted on these drives and they are not properly handled/destroyed there could definitely be data loss. There is also the classic "truck backing up into the datacenter" ...
6
First, a word of caution: AWS requires that you inform them of any security related test you plan on running to their infrastructure [link].
Second, Kali is not a vulnerable operating system, it is an operating system that comes with pre-installed tools so you can perform security tests on other machines.
And third, an AWS EC2 is already a virtual machine, ...
6
The Access Key ID is used for identifying the access key in logs, configuration, etc. It could in some environments be considered sensitive data if you're looking to not release who accesses which systems and when, but it is not secret.
6
I would not run antivirus on my servers, for a couple reasons:
They are massive pieces of software
The whole idea of a server is to execute one task, and only one, in the fastest way possible. There are some accessory tasks that you need to run, but the idea is the same. AV engines slows down your service.
They usually run with root permissions
Your ...
5
From the documentation [0][1], we see that you prove to AWS that you know the Secret Access Key using HMAC, not using Digital Signatures. This means that when verifying the authentication, AWS must be able to generate the exact Secret Access Key for your Access Key ID.
Thus, their promise to never show you the Secret Access Key again is a matter of policy, ...
5
Regarding the general managment of private/public keys, there are already other answered questions here on SE: What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts? and What's the common pragmatic strategy for managing key pairs?
Regarding AWS specific details: you can and should create your own key pairs outside of AWS ...
5
The problem is that the minerd is probably the payload of some (other) malware, so you can't really tell what else has been compromised on the system. Possibly there isn't anything else resident on the system, and you are just getting re-infected each time you kill the miner.
Alternatively there is some management/dropper process which has opened a back-...
5
First, it is perfectly normal for content delivery networks to have such certificates. And given the IP address this looks like Amazon AWS, possible their CloudFront service which serves as a TLS termination point and load balancer which then forwards the traffic to the appropriate system. This is actually typical behavior which you will also see at ...
5
An AWS Account ID can be shared, when required.
Like the documentation says, the main thing anyone can use your AWS Account Number for is to construct ARN's. For example, if I had an AWS Account which held an AWS Lambda function, and someone on another account, who I had explicitly granted permission to, wanted to manipulate it, they would use by account ...
4
Your intuition is correct in the most important way -- this is not, in any meaningful sense, "secure."
But the way it's defeated is not quite what you envision.
When you click a link on a web page, or your browser loads an image embedded in a page, your browser connects to the web server and sends a request. In the request are the HTTP headers, including ...
4
MFA is not designed to prevent any file deletion or change. It's only goal is to make stealing user's credentials much more difficult.
Also, you don't setup MFA for S3 bucket (or object), you setup it for a user. Permissions to that user are specified by ACL's and policies.
So in a way you can "enable MFA for S3". Create users, enable MFA, assign policies. ...
4
If your server resides in EC2, you can use IAM to create a role for that server and allow it access to KMS without needing to have the AWS access keys on the server.
http://docs.aws.amazon.com/kms/latest/developerguide/control-access.html
4
Other Places are:
TPM
CPU Register (implementation: Tresor)
HSM
Security Tokens
many other Hardware based storages
4
That is not the source IP of the request, it's the value of what the user agent set in the Host header.
When I make a HTTP request to StackExchange to fetch this question page, it looks like this:
GET /questions/169836/http-requests-from-server-itself HTTP/1.1
Host: security.stackexchange.com
...
The Host header indicates that I wish to load from the ...
4
Simply, the environment within which you are executing your commands is sandboxed and is unable to affect the host OS or other users' commands. Unless there's a vulnerability, of course. From https://aws.amazon.com/lambda/faqs/:
Q: Can I access the infrastructure that AWS Lambda runs on?
No. AWS Lambda operates the compute infrastructure on your ...
4
which is harder: finding the private key from the public key, or decrypting the 40 character string? How different would this be if the SSH key were 4096 bits?
I believe you are asking the wrong question. Mandatory XKCD:
For all practical purposes, hacks are the result of hackers getting root access to the server or data due to weak passwords or unpatched ...
4
Yes, you need authorisation for a penetration test of any service running on the AWS infrastructure, whether or not it’s a service directly managed by Amazon themselves. Source: personal experience and discussion with my AWS account manager. Remember, your pen test will be testing things like AWS security groups and network ACLs as well as your own service.
4
The EC2 findings refers to: AWS Security Group for your EC2 instances have an unknown or too permissive CIDR origin allowed for inbound/outbound traffic. This audit rule expects another Security Group reference as originator or destiny of the traffic that pass through it.
When an unknown CIDR is found, the Unknown CIDR caption is added to the report, which ...
4
Bottom line, the answer is No.
If your S3 bucket is public, and you make it a website, the bucket name will appear in certificate logs which are fully public. There are tools that sniff certificate logs just to find such S3 buckets.
Also if you make it a website -- it'll appear in the links you're presumably sharing out.
The way to secure an S3 bucket is ...
3
This is now possible with AWS S3. The following policy allows users from account one, two and three to put and delete objects with MFA.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"AWS": [
"ACCOUNT-ONE-ID",
"ACCOUNT-TWO-ID",
"ACCOUNT-THREE-ID"
]},
"Action": [
"s3:PutObject",
"...
3
Can I set up S3 to use some kind of 2 factor authentication?
No, because S3 doesn't have authentication of its own.
Does the Access ID count for 2 factor since it is random and not tied to a person's name or anything else?
No, the factors in "two-factor authentication" are different types of things; usually for 2FA it's something you know (a password, a ...
3
Indeed you're right, anyone with access to the server can get plain-text key.
Fundamentally your application needs to be able to get the plain-text key -- and hence any attack that fully compromises the application is also going to be able to get the plain-text key. But that's not what KMS is for.
KMS is for Key Management, and specifically the management, ...
3
Sometimes it's not about being able to prevent access to the keys, as much as it is creating an environment that's able to be audited (i.e., user/admin actions are tracked / reviewed periodically).
The problem you'll run into trying to encrypt, double encrypt, triple encrypt, etc, is that at some point, someone will need the ability to manage (read: decrypt)...
3
In general, if traffic between two servers is sent using http instead of https, then anyone with the ability to inspect traffic anywhere along the path could eavesdrop.
In this case, it sounds like that would probably be limited to you and Amazon network admins.
Only top voted, non community-wiki answers of a minimum length are eligible
