Security and Forensic Discovery in Cloud Environments by Manu Zacharia

1. CLOUD 9: UNCOVERING SECURITY & FORENSICS DISCOVERY IN CLOUD byManu Zacharia MVP (Enterprise Security), C|EH, ISLA-2010 (ISC)², C|HFI, CCNA, MCP Certified ISO 27001:2005 Lead Auditor HackIT – Technology & Advisory Services “Aut viam inveniam aut faciam ” Hannibal Barca

3. For paying my bills – I do consulting - HackIT – Technology & Advisory Services – A startup.

4. Awards

5. Information Security Leadership Achievement Award from (ISC)² - 2010

6. Microsoft Most Valuable Professional (Enterprise Security) – 2009 and 2010

7. Co-Author of a Book

9. Founder c0c0n – International Security & Hacking Conference

11. Microsoft Tech-Ed 2010 (& 2011 upcoming)

12. IQPC - Enterprise Security 2010 - Singapore

13. Information Security Conference - Bangalore

14. ClubHack, etc

16. Indian Navy - Signal School , Centre for Defense Communication and Electronic and Information / Cyber Warfare and INS Valsura.

17. Centre for Police Research, Pune and Kerala Police

18. SCIT - Symbiosis Centre for Information Technology,Pune

19. Institute of Management Technology (IMT) – Ghaziabad

20. IGNOU M-Tech (Information Systems Security) – Expert Member – Curriculum Review Committee

22. Registered brands belong to their legitimate owners.

23. The information contained in this presentation does not break any intellectual property, nor does it provide detailed information that may be in conflict with any laws (hopefully...) :)6

25. AGENDA INTRO & CLOUD ARCHITECTURE CLOUD SECURITY & RISK ASSESSMENT FRAMEWORK EXPLOITING CLOUD & FORENSICS CONCLUSION 8

26. INTRODUCTION 9

28. Do you know what is EC2 and S3?

29. What is SPI Model?10

31. Headline stealer

32. Everybody is concerned about Cloud Security11

34. Simple – power of cloud12

37. Forget about those sleepless nights in your data centers14

39. A web service that provides resizable compute capacity in the cloud15

41. A user can boot an Amazon Machine Image (AMI) to create a virtual machine, which Amazon calls an "instance", containing any software desired.16

44. Provides unlimited storage through a simple web services interface18

46. 102 billion objects as of March 201019

48. NASDAQ uses Amazon S3 to deliver historical stock information.20

50. application and information resources from the underlying infrastructure, and

51. the mechanisms used to deliver them.21

53. applications,

54. information, and

55. infrastructure comprised of pools of compute, network, information, and storage resources. 22

57. rapidly orchestrated,

58. provisioned,

59. implemented & decommissioned, and

60. scaled up or down

61. Provide an on-demand utility-like model.23

63. How cloud is both similar to and different from existing models of computing? 24

65. organizational,

66. operational, and

67. technological approaches to network and information security practices. 25

68. CLOUD SECURITY – DIFFERENT? Marcus Ranum - Same old, Same old 26

69. CLOUD SECURITY – DIFFERENT? Same Client / Server paradigm from Mainframe days – Bruce Schneier 27

70. So what is this cloud? 28

71. CLOUD ARCHITECTURE 29

73. five essential characteristics,

74. three cloud service models, and

75. four cloud deployment models.30

77. On-demand self-service

78. Broad network access

79. Resource pooling

80. Rapid elasticity

81. Measured service31

83. Unilaterally provision computing capabilities as needed automatically, without requiring human interaction with a service provider.

84. Computing capabilities include server time and network storage 32

86. Available over the network and accessed through standard mechanisms33

89. The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model,

90. Different physical and virtual resources dynamically assigned and reassigned according to consumer demand.35

92. Customer may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). 36

94. storage,

95. processing,

96. memory,

97. network bandwidth, and

98. virtual machines.37

100. Capabilities can be

101. rapidly and elastically provisioned to quickly scale out ; and

102. rapidly released to quickly scale in.

103. In some cases this is done automatically.38

105. Metering capability at some level of abstraction appropriate to the type of service

106. Resource usage can be monitored, controlled, and reported — providing transparency for both the provider and consumer of the service.39

108. storage,

109. processing,

110. bandwidth,

111. active user accounts40

113. Virtualization is mandatory

114. Answer is No

115. Cloud services are often but not always utilized in conjunction with, and enabled by, virtualization technologies41

117. In many offerings virtualization by hypervisor or operating system container is not utilized.42

119. Multi-tenancy is not called out as an essential cloud characteristic by NIST but is often discussed as such.43

121. The three fundamental classifications are known as the SPI Model.

122. Various other derivative combinations are also available.44

124. Cloud Software as a Service (SaaS).

125. Cloud Platform as a Service (PaaS).

126. Cloud Infrastructure as a Service (IaaS).45

128. Accessed through thin client interface such as a browser.46

130. network,

131. servers,

132. operating systems,

133. storage, or

134. even individual application capabilities47

138. network,

139. servers,

140. operating systems, or

141. storage,50

144. processing,

145. storage,

146. networks, and

147. other fundamental computing resources52

149. The consumer does not manage or control the underlying cloud infrastructure53

151. operating systems,

152. storage,

153. deployed applications, and

154. possibly limited control of select networking components (e.g., host firewalls).54

156. Public Cloud

157. Private Cloud

158. Community Cloud

159. Hybrid Cloud55

162. The cloud infrastructure is made available to the general public or a large industry group

163. Owned by an organization providing cloud services.57

165. The cloud infrastructure is operated solely for a single organization.

166. It may be managed by the organization or a third party, and may exist on-premises or off-premises.58

168. The cloud infrastructure is shared by several organizations

169. Supports a specific community that has shared concerns59

171. mission,

172. security requirements,

173. policy, or

174. compliance considerations60

177. off-premises.61

179. Composition of two or more clouds (private, community, or public)

180. They remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability 62

182. Cloud bursting for load-balancing between clouds.63

184. Bursting into the cloud when necessary, or

185. using the cloud when additional compute resources are required temporarily64

187. How it is done?

188. Basic application functionality could be provided from within the cloud65

191. Traditionally been applied to resource allocation and automated provisioning / de-provisioning of resources

192. Historically focused on bandwidth.67

194. servers,

195. application servers,

196. application delivery systems, and

197. other infrastructure…68

200. We generally call it - automation

201. But is automation sufficient for cloud? or is it the right thing for cloud?70

203. coordination, and

204. management of complex computer systems, middleware, and services. 71

206. Service Oriented Architecture,

207. virtualization,

208. provisioning, and

209. dynamic datacenter topics.72

211. Example

212. Virtual Private Clouds73

214. By interconnecting these resources to the internal resources of a consumers’ datacenter, usually via virtual private network (VPN) connectivity.74

216. They also negotiate relationships between various cloud providers and consumers.75

218. Acts as proxy (middle man)76

220. management,

221. security and

222. inter-operatibilityfor cloud. 77

224. Amazon EC2 API,

225. VMware’s DMTF-submitted vCloud API,

226. Sun’s Open Cloud API,

227. Rackspace API, and

228. GoGrid’s API,78

230. DMTF - Distributed Management Task Force 79

232. Generally identified as an important element of cloud.80

234. policy-driven enforcement,

235. segmentation,

236. isolation,

237. governance,

238. service levels, and

239. chargeback/billing models for different consumers. 81

240. CLOUD 82

241. CLOUD CUBE 83

244. CLOUD SECURITY 87

246. The boxes,

247. Storage,

248. Applications88

250. New vectors - that we need to be aware of

251. Confusion exists - how cloud is both similar to and different from existing models of computing89

254. Different cloud service providers use different API – not compatible with each other for migrating the data 91

256. Procedures,

257. Standard data formats, and

258. Interfaces,can considerably delay or prevent a successful migration. 92

261. Confiscation of resources as part of an investigation - the availability is in question.94

264. Sudden take over can result in a deviation from the agreed Terms of Use & SLA which may also lead to a Lock-In situation.96

266. Bankruptcy and catastrophes does not come with an early warning.97

270. ToU prohibits VA/PT

271. This may introduce security vulnerabilities and gaps

272. Result – Loose your certification.100

274. Major downfall in performance and quality metrics may affect your certifications.101

276. Lack of could based security standards and non-adherence to procedures may affect the CIA of customer data. 102

278. Insecure and inefficient deletion of data, true data wiping not happening, exposing the sensitive information to other cloud users.103

280. May be due to security reasons.

281. But end user is finally in the dark.104

283. how the data is backed up,

284. who back up the data,

285. whether the cloud service provider does it or has they outsourced to some third party, 105

287. is it encrypted and send,

288. is the backup properly destroyed after the specified retention period or106

290. what kind of data wiping technologies are used.

291. The lists of questions are big and the cloud users are in dark107

293. Permission

294. How do you get permission to test your application running on Amazon EC2 when the results of your testing could show you data from another client completely?108

296. "In networking, black holes refer to places in the network where incoming traffic is silently discarded (or "dropped"), without informing the source that the data did not reach its intended recipient." - From Wikipedia109

298. How do you do regression testing?

299. How do you know what version of the search engine google is currently running on?110

301. THEN WHY WE MOVE? If its not good, safe or not even new, then why cloud adoption happening? 112

303. Management version – something new and promising – let’s try it out

304. Geek version – It’s really cool

305. There is nobody to put a break when these two people join together.113

307. Economical factors

308. Multi-tenancy means cost sharing114

310. Cloud computing allows you to move from CAPEX to OPEX.

311. Save 30% of IT Operational Cost115

313. Go Green or Green IT also influenced many.

314. Powerful - A 64 node Linux cluster can be online in just five minutes - forget about those sleepless nights in your data centers116

315. ADDRESSING SECURITY ISSUES IN CLOUD – RISK ASSESSMENT FRAMEWORK FOR CLOUD 117

317. Evaluate your tolerance for moving an asset to cloud

318. Have a framework to evaluate cloud risks.118

320. Evaluate the asset

321. Map the asset to cloud deployment models

322. Evaluate cloud service models & providers

323. Sketch the potential data flow119

325. Data

326. Applications/Functions/Processes

327. Either partial functions or full applications120

329. We can shift parts of functions to the cloud.121

331. Host the main application and data in our own data-centre.

332. Outsource a portion of its functionality to the cloud through Platform as a Service (PaaS).122

334. Include potential use of the asset once it moves to the cloud123

336. Data and transaction volumes are often higher than expected.124

338. Also known as

339. focus creep,

340. requirement creep,

341. feature creep,

342. function creep125

344. Can occur when the scope of a project is not properly defined, documented, or controlled.126

346. A detailed valuation is recommended only if the organization has an existing process for that. 127

348. how sensitive an asset is, and

349. how important an application / function / process is.128

351. For each asset, ask the following questions:

352. How would we be harmed if the asset became widely public and widely distributed?129

354. How would we be harmed if the process or function were manipulated by an outsider?130

356. How would we be harmed if the information/data were unexpectedly changed?131

359. Assessing confidentiality, integrity, and availability requirements for the asset; and

360. how those are affected if all or part of the asset is handled in the cloud.133

362. Determine which deployment model is good for the organizational requirement.134

365. Public.

366. Private, internal/on-premises.

367. Private, external (including dedicated or shared infrastructure).

368. Community

369. Hybrid136

371. Deployment models and locations that fits your security and risk requirements.137

374. your organization,

375. the cloud service, and

376. any customers/other nodes.139

378. Absolutely essential to understand whether, and how, data can move in and out of the cloud before finalizing.140

380. the importance of what you are considering moving to the cloud,

381. risk tolerance,141

383. potential exposure points for sensitive information and operations.142

385. Can skip most of the recommendations — such as on-site inspections, discoverability, and complex encryption schemes.

386. A high-value regulated asset might entail audit and data retention requirements.143

387. EXPLOITING CLOUD for iw / attacks 144

388. DO YOU KNOW THIS? 145

390. Kendo (kumdo in korean)146

391. INFORMATION WARFARE 風 - Swift as the wind 林 - Quiet as the forest 火 - Conquer like the fire 山 - Steady as the mountain 147

393. Twenty-Four Generals - famous groupings of battle commanders

394. (Takeda Nijūshi-shō )武田二十四将148

396. A sort of abbreviation to remind officers and troops how to conduct battle149

399. Break PGP passphrases

400. Solution

401. Brute forcing PGP passphrases151

403. Two elements - EDPR Managers & EDPR Agents152

405. Not acceptable – too long

406. Lets exploit the cloud.153

408. Install Amazon EC2 API Tools on your linux box.sudo apt-get install ec2-api-tools 154

410. Example - use a 32 bit Windows AMI - ami-df20c3b6-g155

414. Extract the admin password for the instanceec2-get-password -k ssh-keypair.pem $instanceID 158

417. RDP into the instance & configure EDPR160

420. Configure the Agent to connect to the Manager.

421. 3 points to configure mainly162

425. EDPR creates a pair of registry values which are used to uniquely identify the agent when connecting to the manager.

426. We need to scrub these values – why?165

428. Output = The job handling will be totally corrupted.166

431. Remember in cloud, bundle is similar to creating a ‘template’ in VMware terminology.168

433. Command:ec2-bundle-instance $instance_id -b $bucket_name -p $bundle_name -o $access_key_id -w $secret_access_key 169

438. Used to spawn instances of the EDPR agent. Example:IMAGE ami-54f3103d 173

440. to brute an password composed of uppercase letters, lowercase letters, and the numbers 0-9, with a length of between 1 to 8 characters against a PGP ZIP file.174

441. ACTION TIME  175

445. EC2 “small” instance

446. Trying 500K keys per second

447. How long will it take?178

451. c1.medium instance = “High CPU" instance181

452. ACTION TIME  182

454. 2+M keys/second

455. So what's the time required now???183

460. Request to instance amazon EC2 Instance Limit - http://aws.amazon.com/contact-us/ec2-request/187

462. Amazon spot instances - allows us to bid on unused Amazon EC2 capacity and run those instances.188

464. Create custom python script to bypass this limitation189

466. A successful cloud based distributed cracking system.190

467. CLOUD FORENSICS 191

469. Bad guys have started using cloud based services and infrastructure for launching attacks

470. Cloud do provide a good platform for incidence response and forensics investigations192

473. Not the case with the traditional infrastructure where the equipments are seized.

474. Cloud Example – Amazon EBS194

476. Enables the user to launch an instance with an Amazon EBS volume that will serve as the root device.195

478. Since the forensic investigators will be working with another instance of the environment, the regular operations is not affected in any way.196

480. Forensic evidences are invalid if they are not cryptographically hashed.

481. This can be easily achieved using the on-demand feature of cloud.197

483. Forensic evidences are invalid if they are not cryptographically hashed.

484. This can be easily achieved using the on-demand feature of cloud.198

486. Amazon Web Services is already providing a good forensic feature where it can provide a MD5 hash of every file that is on the cloud system.199

489. Virtualization of various entities like the applications and host systems, which once used to be in-house is now scattered on the cloud.201

491. Since we are acquiring data from a virtual environment, the forensic investigator should have a clear and precise understanding of how they work and what files are interesting and required to acquire.202

493. multiple data owners on the same disk,

494. remote geographical location,

495. jurisdictional difficulties,

496. RAID configurations etc203

498. A collaborative and collective effort is required to address what we discussed.204

499. conclusion 205

501. future flexibility,

502. security,

503. collaborative capabilities, and

504. mobilityof the resultant solution. 206

506. GOOD SECURITY PROFESSIONAL A good security professional is someone who always looks both ways before crossing a one-way street. 208

507. 209 QUESTIONS?? Manu Zacharia m@matriux.com or m@HackIT.co or

508. THANK YOU !