This year’s Capital One breach, in which a former Amazon employee stole 100 million consumer credit applications, illustrates just how critical it is for organizations to ensure their cloud instances are properly configured. In this case, the attacker reportedly exploited a misconfigured firewall to launch a server-side forgery attack and compromise AWS instance metadata.
Our CEO, Peter Smith breaks down how this kind of attack works and how to prevent it with the crew from Security Weekly on Paul’s Security Weekly. It’s a great program. Peter goes into a lot of technical detail, so I encourage you to watch the entire show, but I’ll give you a high-level overview here.
First, we need to understand how the AWS instance metadata service works. AWS aggregates metadata attributes such as your security group, hostname, mac address, IP address and even security tokens. And if you’re on an EC2 instance and make an HTTP request to 169.254.169.254 port 80, you’ll get a URL structure that enumerates all the attributes associated with that specific instance. There’s no additional authorization required, and it’s not encrypted. So long as you are making a request from the instance, you’ve got access. It’s a simple way to look up metadata without requiring an API or a developer key.
As Peter points out, AWS’ documentation states: “Although you can only access instance metadata and user data from within the instance itself, the data is not protected by cryptographic methods. Anyone who can access the instance can view its metadata. Therefore, you should take suitable precautions to protect sensitive data (such as long-lived encryption keys). You should not store sensitive data, such as passwords, as user data.”
So, you definitely need to secure your AWS instance metadata. Unfortunately, figuring out how to do so is no simple task.
Anatomy of a server side forgery attack
Here’s a simplified version of Peter’s hypothetical example in the Security Weekly program to illustrate the attack.
Let’s say a company has a proxy function on their server that fetches data from specific URLs and then presents that data in a combined view. The proxy should be configured so that it is internal and private. But if it’s not, and it can be told to visit any URL, that’s dangerous. Because then, any user can ask the proxy to make requests to 169.254.169.254 port 80 and get the metadata listing. And once this remote user has access to the metadata directory, malicious actors have access to a wealth of information — possibly including keys — they can use to compromise the instance or access data in an S3 bucket.
As I said, this is a simple example. But the point it illustrates is that if there’s a misconfiguration in your instance that can be exploited to launch a server side forgery, your AWS instance metadata is completely vulnerable.
So how can organizations protect their AWS metadata? Of course, you need to ensure everything is properly configured and there are no vulnerabilities to exploit, but that doesn’t get to the heart of the problem. Any software that’s on the instance can make this request. You can’t apply a security group to control access. And sure, the software on your instance may be safe now, but can you guarantee it will always be safe and never compromised?
One might be tempted to firewall 169.254.169.254 to stop all access, but that will break a lot of services that use it, such as SSM agent and EC2 config. So what’s the solution?
Applying Edgewise to secure AWS metadata
Here’s how Edgewise enables security teams to lock down AWS metadata without breaking the services that use it.
First, Edgewise’s machine learning-powered platform inventories all software and devices on the instance that use the AWS metadata instance service. Once that’s complete, Edgewise creates a segment and blocks all but those software and services that need to use it from accessing the URL. This is not a firewall, because it’s not based on network addresses. Instead, Edgewise creates a unique, immutable identity for each binary or script. This identity cannot be spoofed, because it includes dozens of attributes, many of which are cryptographic in nature. Any other user, software or device that not on the approved list and tries to access the AWS metadata instance service will be denied.
Even better? It takes no more than five minutes to complete the process and stop all unauthorized access to AWS metadata services.
Best of all? If you go request a demo and, in the comment or question section, write, “I want to protect my AWS metadata services,” we’ll send you a package for AWS at a fraction of the price for the full microsegmentation platform.
Security doesn’t have to be hard. Edgewise makes it impossibly simple.