►
From YouTube: Do This, Not That – Lessons from 7 Headline Grabbing Security Breaches - Maya Levine, Sysdig
Description
Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Do This, Not That – Lessons from 7 Headline Grabbing Security Breaches - Maya Levine, Sysdig
What leads to a cloud security breach? Misconfigurations, exposed APIs, cryptojacking, and more. Attacker motivations haven’t changed much, but their methods have adapted to new technologies. As a defender, you must adapt too. In this talk, we walk through 7 examples of real cloud breaches, discuss what went wrong, why it was interesting, and what you can do to avoid ending up on such a list. Learn about the differences between cloud vs on-premise threats and breaches. What has changed? Are certain attack methods more prevalent, attractive, or easy to execute in the cloud? Why? What are the high-level cloud attack trends (and defenses) and how to cope? Each of the 7 breaches we discuss involve cloud infrastructure. We will highlight a particular attack pattern, response pattern, or other interesting element that can give insight into how to better protect ourselves in cloud environments. You won’t hear general, “lock your stuff down” guidance; each scenario will have a specific takeaway so you avoid a similar pitfall.
A
My
name
is
Maya
Levine
I'm,
a
product
manager
at
systic,
and
the
goal
for
me
for
today's
session
is
for
all
of
you
to
walk
out
with
really
clear
takeaways
on
how
to
avoid
becoming
a
headline
grabbing
security
breach.
So
I'm
going
to
talk
about
actual
breaches
that
occurred
in
the
cloud
and
real
takeaways
for
you
to
learn
from
them.
A
And
do
you
want
to
apologize
if
your
company
is
mentioned
in
this
presentation,
if
I
bring
back
any
PTSD
moments
for
you,
I
do
think
that
there's
no
shame
in
being
the
victim
of
a
security
breach.
More
and
more
people
are
realizing
that
it
happens
and
I
think
that
as
a
community,
we
can
only
grow
from
being
open
about
how
and
why
it
happened.
A
So,
given
that
before
I
go
ahead
and
talk
about
the
specific
examples,
I
want
to
take
a
step
back
and
compare
the
differences
between
cloud
and
on-premise
threats
using
different
types
of
breaches
and
the
first
one
is
ransomware
on
premise.
The
typical
ransomware
execution
begins
with
a
phishing
email
sent
to
a
user.
They
either
click
on
an
attachment
or
on
a
URL
link.
Malware
gets
downloaded
to
their
endpoint
and
then
it
spreads
throughout
the
nor
an
organization
system.
A
In
the
cloud
it's
a
little
bit
different.
The
goal
is
less
about
these
endpoints
and
user
identity
kind
of
directories
and
much
more
about
storage
databases.
Things
like
S3
buckets
and
there's
way
more
paths
to
get
to
these
in
the
cloud
you
could
have
an
S3
bucket
be
completely
tight
down
in
terms
of
security
and
permissions,
but
you
have
a
compute
resource
somewhere,
that's
overly
permissioned,
to
allow
access
to
the
S3
bucket
and
that's
an
entry
point
into
there.
A
A
But
when
it
comes
to
crypto,
mining
cloud
is
really
just
the
perfect
breeding
ground
for
these
types
of
attacks
because
of
the
infinite
amount
of
elastic
compute
resources
that
users
have
access
to.
So
attackers
can
piggyback
on
an
organization's
compute
resources
and
basically
generate
money
for
themselves,
never
having
to
foot
the
bill,
and
this
trend
is
actually
increasing
yearly
and
largely
through
targeting
container-based
Cloud
resources.
A
Unsuspecting
developers
can
use
images
from
these
public
sources
that
they
think
are
totally
fine
but
end
up
drawing
real
problems
for
them,
and
so
this
attack
happened
in
2020
and
it
started
with
an
attacker
utilizing
an
Amazon
machine
image
or
Ami.
An
Ami
is
basically
a
pre-packaged
ec2
instance.
In
this
case
it
was
a
Windows
2008
server
instance
and
the
attacker
took
the
Ami
and
put
it
into
the
AWS
Marketplace,
which
is
a
very
public
well
indeed,
and
anytime,
somebody
happened
to
use
this
image.
A
A
script
would
run
in
the
background
that
would
execute
crypto
miners.
Now,
let's
talk
about
mining.
Why
are
we
seeing
this
trending?
Oh
wait!
This
is
the
wrong
kind
of
minors,
we're
talking
about
crypto
miners.
Crypto
miners
are
a
low
risk,
High
reward
way
for
attackers
to
make
a
profit.
They
basically
generate
passive
income
if
anyone
happens
to
use
this
instance,
they'll
be
making
money
on
their
behalf
and
it's
much
easier
to
it's
very
easy
to
change
cryptocurrency
into
other
forms
of
currency.
A
In
addition,
it's
not
considered
as
much
of
a
damaging
attack
like
ransomware,
so
it's
less
likely
to
gain
unwanted
attention
and
the
most
important
thing
for
crypto
minor
attacks
is
scale.
The
more
miners
are
executing
the
more
money
the
attackers
are
making
the
impact
on
the
victim
in
this
attack
is
that
they're
unknowingly
running
a
crypto
Miner,
possibly
multiple,
if
they're
running
more
than
one
instance
at
a
time-
and
this
is
pretty
simple
as
your
CPU
usage
goes
up-
so
does
that
AWS
bill
which
you
are
responsible
for
most
of
the
time?
A
So
the
main
takeaways
for
this
attack
is.
You
should
really
use
images
from
only
trusted
sources,
and
even
if
you
are
using
a
trusted
Source,
you
should
also
have
static
and
runtime
security
tools
on
those
instances
to
make
sure
that
there's
no
malicious
activity
occurring
now.
Attack
number
two
focuses
on
compromise
credentials
and
when
I
was
looking
at
the
internet
for
a
real
life
example
of
a
compromise
credential.
A
Unfortunately,
it
did
not
take
me
very
long
to
find
that
many
people
think
it's
a
great
idea
to
post
their
credit
cards
on
their
social
media
with
the
security
code
as
a
given
gift
to
people
who
want
to
use
these
now,
I'm,
not
saying
that
many
developers
would
do
something
like
this,
but
there
have
been
known
cases
of
developers
accidentally
putting
access,
keys
or
credentials
in
code
that
is
posted
publicly
and
not
encrypted.
So
keep
that
in
mind
there's
many
different
ways
that
credentials
can
be
leaked
for
this
attack.
A
The
MDR
expel
discovered
an
attack
on
one
of
their
customers
that
all
centered
around
a
you
use
root
user's
access
key
that
was
leaked.
It
was
never
determined
how,
but,
as
I
mentioned,
there's
many
ways
that
that
could
happen.
The
attackers
got
their
hands
on
this
access
key
and,
as
far
as
compromise
credentials
go
a
root.
User's
access
key
is
about
as
bad
as
it
can
get.
A
They
were
able
to
use
it
to
generate
ec2,
SSH
access
keys
and
they
would
spin
up
ec2
instances
with
the
Run
instances
API
and
alter
the
security
groups
to
allow
inbound
access
from
the
internet.
So
one
leaked
key
made
it
so
that
attackers
could
set
up
SSH
keys
and
install
crypto
miners
remotely
on
these
instances.
A
Now
why
why
attackers
execute
this
type
of
attack
and
the
impact
on
the
victims
is
largely
the
same
as
the
first
example.
However,
I
do
want
to
emphasize
that
a
leaked
access
key
can
allow
an
attacker
to
create
a
very
large
amount
of
instances
likely
many
more
than
the
victim
would
have
done
on
their
own,
and
this
makes
the
potential
loss
even
greater
think
of
the
the
type
of
AWS
bill.
That
would
be
the
stuff
of
nightmares
for
most
people
in
this
room.
A
A
In
this
specific
attack,
the
expel
was
able
to
pick
up
on
a
few
things
in
their
real-time
monitoring.
They
picked
up
on
the
fact
that
SSH
keys
were
being
generated
from
a
suspicious
IP
address,
one
that
had
never
been
used
in
the
environment
before
and
they
picked
up
on
the
fact
that
these
instances
were
communicating
with
a
known
cryptocurrency
server.
So
that's
just
examples
of
the
kinds
of
monitoring
that
you
should
be
having
in
your
environment.
A
The
attackers
were
able
to
take
advantage
of
a
log
4J
vulnerability
on
one
of
their
cycle
servers,
it's
a
payment
software
that
they
use,
and
so
they
got
in
and
they
installed
back
doors,
naming
them
K
worker
in
order
to
disguise
themselves
as
the
Linux
operating
systems
K
worker
service
now
I
do
want
to
mention
that
onus
patch,
their
cyclo
servers
as
soon
as
a
patch
was
released
by
them
for
log4j.
But
by
this
point
it
was
already
too
late.
A
The
next
day
they
got
a
ransomware
request
for
5
million
US
dollars
from
the
attackers
via
Telegram.
Now
onus
declined
this
request,
and
so
they
had
to
both
tell
their
customers
about
this
leak
and
go
through
all
of
their
cycle.
Servers
looking
and
deleting
backdoors
yeah
now
ransomware
attacks
have
been
around
for
a
while.
Now,
why
are
they
still
being
talked
about?
Why
are
they
still
relevant?
Mainly
cyber
criminals
know
that
companies
hate
to
see
their
operations
grind
to
a
halt.
A
In
fact,
sometimes
it
makes
more
fiscal
sense
to
actually
pay
the
ransom
than
to
deal
with
the
financial
implications
of
downtime
and
recovery.
So
attackers
know
this
and
there
are
multiple
failures
which
allowed
this
specific
attack
to
happen.
The
first
is
that
the
system
was
not
patched
for
log4j.
That's
what
allowed
the
initial
access,
but
like
I
mentioned,
this
wasn't
really
onus
fault.
They
patched
it
as
soon
as
a
patch
was
available,
but
it
just
wasn't
out
in
time.
A
So
I
think.
The
point
that
is
really
important
here
is
that
they
had
very
overly
permissive
access,
keys
and
credentials.
This
was
the
key,
the
literal
key
that
gave
attackers
the
ability
to
easily
access
overwrite,
delete,
S3
buckets,
and
the
impact
here
is
that
over
2
million
onus
users,
information
was
leaked,
including
their
government,
IDs
other
personal
information
and
password
hashes,
and
if
we
think
of
something
like
gdpr
companies,
don't
just
have
to
worry
about
the
pr
Fallout
and
all
of
that
there's
actual
fines
being
implemented.
A
Now
this
is
showing
you
a
chart
over
the
past
few
years
of
the
gdpr
fines,
and
we
can
see
that
these
are
increasing
at
what
looks
to
be
an
exponential
level.
So,
in
addition
to
all
your
other
worries,
you
now
also
have
to
worry
about
potentially
being
fined
for
allowing
these
leaks
to
happen
in
the
first
place.
A
If
you
have
overly
permissive
throughout
your
roles,
your
groups,
your
resources
that
is
just
enabling
them
to
move
laterally
very
easily
within
your
systems
and
in
a
in
a
report
that
systic
just
released
on
container
and
security
usage,
we
found
that
ninety
percent
of
granted
permissions
are
not
used.
Ninety
percent-
that
is
something
that's
a
bit
excessive
right,
something
that
is
a
very
easy
way
that
we
can
tackle
something
that
happens
in
almost
every
cloud
breach
that
we
see,
which
is
lateral
movement
now
for
attack.
A
A
A
These
files
contain
transcripts
between
Pfizer
customer
support
and
customers
of
various
Pfizer
drugs.
The
kinds
of
transcripts
with
very
sensitive
information,
including
home,
address
phone
number,
email
and
medical
and
Health
Data,
especially
that
pertained
to
these
Pfizer
drugs
that
they
were
using
so
VPN
Mentor
found
the
exposed
files
and
reached
out
to
Pfizer,
who
then
secured
the
bucket,
and
the
impact
here
is
that
this
is
the
kind
of
information
that
if
criminal
hackers
were
able
to
access
this
data,
they
could
very
easily
use
to
conduct
phishing
campaigns.
Think
about
it.
A
If
I
was
trying
to
pretend
to
be
Pfizer.
Customer
support
and
I
knew
your
personal
information
as
well.
As
you
know,
your
medical
health,
history
and
a
history
of
all
these
conversations
you
had
with
us.
How
hard
is
it
for
me
to
just
pretend
to
be
Pfizer
and
follow
up
on
the
next
kind
of
thing
in
this
customer
support
chain?
A
Also,
this
is
the
kind
of
information
that
can
be
utilized
for
identity
theft,
campaigns
for
credit
cards
or
for
other
things.
So
basically,
this
is
kind
of
thing
that
you
don't
want
to
be
on
the
wrong
side
of
when
it
comes
to
data
privacy
loss,
and
one
thing
you
should
definitely
do
is
never
leave
a
system
that
doesn't
require
authentication
open
to
the
Internet.
So
in
this
case
the
gcp
bucket
had
incorrect
permissions
that
allowed
the
data
to
be
publicly
readable.
A
Now,
for
attack
number
five,
we're
going
to
talk
about
attacker,
who
is
able
to
Pivot
from
a
cloud
environment
to
an
on-premise
resource,
and
this
is
surprisingly
easier
than
you
would
think
much
easier
in
fact-
than
carrying
a
normal
couch
up,
a
flight
of
stairs
of
an
average
Manhattan
apartment,
and
this
attack
all
began
with
a
russian-speaking
cyber
criminal
group
called
Circus
spider
back
in
2019.
They
released
a
ransomware
variant
called
netwalker,
and
they
did
what
many
cyber
criminal
groups
have
begun
to
do,
which
is
sell
it
in
an
as
a
service
model.
A
So
people
can
rent
or
use
this
malware
for
a
fee
or
for
a
percentage
of
the
profits,
and
this
kind
of
as
a
service
model
is
becoming
more
and
more
popular.
Now,
what
networker
actually
does?
Is
it
encrypts
the
files
on
the
local
system
and
then
Maps
Network,
shares
and
enumerates
this
the
network
for
any
additional
shares,
attempting
to
access
them
using
the
tokens
of
the
victims
that
are
already
logged
into
this
system?
So
in
this
way
it
can
basically
spread
and
infect
as
much
of
the
system
as
it
possibly
can
now.
A
Equinix
suffered
an
attack
that
utilized
this
ransomware
variant.
Officially,
they
had
a
configuration
management
deviation
which,
in
one
of
their
Cloud
environments
now
what
this
most
likely
means
is
that
somebody
in
the
company,
maybe
a
developer,
spun
up
a
cloud
environment
that
was
completely
outside
of
the
normal
security
policies
and
monitoring,
and
so
it
was
not
configured
correctly,
and
this
allowed
an
attacker
to
access
this
environment
via
RDP.
A
A
Now,
once
they
made
it
onto
the
on-premise
system,
the
security
policies
picked
up
on
their
presence
and
equinix
was
actually
able
to
contain
this
attack.
Additionally,
they
had
really
good
backups,
so
they
were
able
to
restore
all
of
this
data
from
their
own
backups
and
not
have
to
pay
a
ransom
or
kind
of
deal
with
it
in
any
other
way.
So
nobody
wants
this
kind
of
attack
to
happen
to
them.
A
And
I
really
just
want
to
emphasize
that
you
can't
protect
what
you
can't
see.
If
you
don't
know
it's
there,
how
are
you
able?
How
are
you
going
to
be
able
to
make
sure
that
it
is
secure
and
the
cloud
makes
it
really
easy
for
us
to
spin
up
new
resources
and
entire
environments?
That's
part
of
why
we
really
love
it,
but
it
does
present
Real
security
challenges.
If
it
happens
in
the
cloud,
is
it
invisible
to
your
security
operations,
visibility
in
a
lot
of
organizations?
A
Cloud
environments
are
managed
by
devops
or
by
a
different
group.
That's
not
I.T,
and
that
makes
getting
it
integrated
with
these
security
policies
and
a
sock
pretty
difficult,
and
so
in
this
case
this
instance
that
allowed
the
access
to
the
on-premise
environment
was
unknown
to
security.
It
wasn't
monitored
or
configured
correctly,
and
the
impact
here
is
that
approximately
1800
systems
in
Equinox
ended
up
having
ransomware
installed
on
them,
but
again
they
had
good
backups,
so
they
didn't
lose
any
data
and
there
wasn't
any
customer
data
leaked.
So
that's
all
pretty
good.
A
A
Now,
attack
number
six
really
focuses
on
access
without
Authentication
and
when
we
think
of
how
we
authenticate
into
somebody's
home,
we
usually
use
a
key
right.
We
open
a
door
with
a
key,
or
maybe
we'll
ring
a
doorbell
and
wait
for
somebody
to
let
us
in
but
Leslie
here
completely
circumvented.
All
of
that
and
found
a
different
way
into
this
house
that
didn't
require
any
authentication
at
all
and
that's
something
that
we
want
to
avoid.
A
Now,
once
this
was
reported
to
them,
they
got
rid
of
that
unauthenticated
part
and
made
it
so
that
any
authenticated
user
could
then
access
this
API
endpoint,
but
that
wasn't
a
real
fix
because
it's
free
to
create
an
account
and
become
an
authenticated
user.
As
of
today,
there
are
over
three
million
Peloton
authenticated
users,
so
it
was
reported
again
kind
of
like
this
was
not
you
know,
actually
fixing
the
problem
and
then
Peloton
fixed
the
actual
vulnerability
here
now.
A
The
impact
here
is
that
information
could
have
been
leaked,
but
because
this
was
found
by
researchers
who
properly
reported
it,
it
doesn't
seem
like
there
was
any
public
leaks
of
this
data.
However,
this
doesn't
mean
that
somebody
didn't
collect
this
information
for
their
own
private
use.
This
is
the
kind
of
information
that
again
could
be
useful
for
phishing
campaigns
or
fraud
campaigns
in
the
future.
A
So
a
takeaway
here
is
that
you
should
have
secure
coding
practices
built
into
the
development
process.
This
kind
of
vulnerability
could
probably
have
been
discovered
by
an
application
penetration
test
by
a
third
party,
or
you
can
also
consider
API
security
tools
in
order
to
detect
an
attacker
abusing
the
calls
or
trying
to
pull
down
large
amounts
of
data
through
them.
A
And
if
this
base
the
recipe
itself
is
incorrect,
you'll
end
up
making
a
monstrosity
that
will
make
it
so
that
you
never
get
asked
to
cook
ever
again
and
maybe
won't
even
get
an
invite
back
to
a
Thanksgiving
meal.
But
when
we
think
about
that
in
terms
of
security,
I
really
think
that
it
relates
to
supply
chain
compromises
of
Open
Source
software,
because
similarly
open
source
software
is
like
the
base
that
you
are
building
your
applications
off
of
and
if
there's
something
wrong
with
it,
that
can
kind
of
trickle
down
and
cause
problems
down.
A
A
A
So
blind
trust,
maybe
not
the
best,
and
the
impact
here
was
that
this
malicious
version
of
pytorch
was
downloaded
over
2
300
times
in
this
five-day
period.
That
is
not
an
insignificant
number
and
we
have
yet
to
know
what
the
true
implications
of
this
was
because
some
of
the
data
that
was
exfiltrated
included,
compromised
included
credentials
and
access
keys
and,
as
I
previously
mentioned,
those
are
great
starting
points
for
further
attacks.
A
So
takeaways
any
code
that
isn't
totally
under
your
Project's
control
runs
some
kind
of
risk,
and
this
isn't
just
limited
to
open
source
software.
Commercial
close
software
is
also
vulnerable
to
this
think
of
solarwinds
again,
so
you
should
trust
the
package
enough
to
use
it
only
if
you
can
verify
that
it's
behaving
how
it
should
be,
and
in
order
to
do
this,
you
need
stringent
security
testing.
A
A
In
this
case,
we
could
have
detected
the
communication
to
the
command
and
control
server
and
the
best
way
of
doing
this
verification
or
where
you
want
to
put
in
the
security
testing
is
as
close
to
the
developer,
push
as
possible.
This
is
because
the
earlier
you
discover
an
issue
the
easier
it
is
for
you
to
fix
it.
A
So
to
wrap
all
of
this
up
some
high
level
trends
that
we
can
expect.
Crypto
mining
will
continue
to
rise
in
popularity.
This
might
seem
counterintuitive.
Lots
of
cryptocurrencies
are
decreasing
in
value
as
we
speak
right,
but
it
doesn't
change
the
fact
that
these
attacks
are
very
low
effort
to
execute
and
can
reap
really
high
rewards.
Again.
It's
a
passive
income
kind
of
structure
and
I
know
that
those
are
buzzwords
now
everyone's
trying
to
find
some
way
of
making
passive
income,
but
attackers
have
found
it.
A
And
I
kind
of
wanted
to
just
touch
on
again
how
the
fact
that
these
cyber
criminal
groups
are
able
to
do
this
as
a
service
model
for
the
malware
that
they
create.
It
makes
Advanced
attacks
accessible
to
even
those
who
aren't
that
technically
savvy,
and
this
is
part
of
that
kind
of
scale.
That
I
was
mentioning.
So
we
can
expect
that
these
attacks
are
going
to
become
more
and
more
commonplace.
A
Log4J
went
from
announcement
to
being
weaponized
in
less
than
a
few
hours,
and
that
kind
of
turnaround
time
is
just
way
faster
than
most
vendors
can
provide
a
patch
for,
and
so
I
think
that
that's
kind
of
really
worth
noting
and
all
of
this
to
say.
Instead
of
being
all
doom
and
gloom,
there
are
ways
to
cope,
and
one
really
important
way
that
I've
hammered
on
a
lot
is
having
real-time
visibility
and
the
reason
why
this
is
so
important
is
because
you
can't
always
detect
the
compromise
itself.
A
A
And
another
thing
I'm
trying
to
hammer
on
especially
is
least
permissive
for
too
long
we
have
been
like
Oprah
to
developers.
You
get
a
wild
card,
you
get
a
wild
card,
you
get
a
wild
card.
That
is
not
a
sustainable
security
model.
You
are
sacrificing
security
for
operational
speed
and
that
kind
of
compromise
that
you're
making
might
come
back
to
haunt
you
in
the
future.
I
really
urge
you
to
reconsider
your
organization's
security
priorities
and
see
if
you
can
make
least
permissive
one
of
your
top
goals
for
your
organization.
A
Because
again,
if
you
don't,
if
attackers
are
able
to
enter
your
system
through
various
compromising
methods,
if
you
have
least
permissive,
then
you've,
basically
given
them
just
a
key
to
access
whatever
they
want
foreign
and
then
this
is
kind
of
self-explanatory,
but
prepare
for
the
worst
case
scenario.
Part
of
that
includes
backups.
It
includes
phishing
training
for
all
of
your
employees.