To succeed, attackers sometimes search for S3 buckets which have: versioning disabled ( so outdated variations can’t be restored), object-lock disabled ( so recordsdata might be overwritten or deleted), huge write permissions (through mis-configured IAM insurance policies or leaked credentials), and maintain high-value information (backup recordsdata, manufacturing config dumps).
As soon as inside, the attackers attempt to impose a “full and irreversible lockout” of knowledge, which can contain encryption objects with keys inaccessible to the sufferer, deleting backups, and scheduling key deletion so AWS and the shopper can’t recuperate the info.
“This analysis is a scientific and theoretical menace modelling train on how an attacker may encrypt and ransom an AWS surroundings inside an account boundary–one thing we’ve talked about during the last 10 years,” mentioned Trey Ford, chief technique and belief officer at Bugcrowd.
Weaponizing cloud encryption and key administration
Development Micro has identified 5 S3 ransomware variants that more and more exploit AWS’s built-in encryption paths. One abuses default AWS-managed KMS keys (SSE-KMS) by encrypting information with an attacker-created key and scheduling that key for deletion. One other makes use of customer-provided keys (SSE-C), the place AWS has no copy, making restoration unimaginable. The third one exfiltrates S3 bucket information (with no versioning) and deletes the originals.
The ultimate two variants go deeper into key administration infrastructure. One depends on imported key materials (BYOK), letting attackers encrypt information after which destroy or expire the imported keys. The opposite abuses AWS’s Exterior Key Retailer (XKS), the place key operations occur exterior AWS, which signifies that if attackers management the exterior key supply, neither the shopper nor AWS can restore entry. Collectively, the strategies reveal that attackers are utilizing AWS itself because the encryption mechanism.
“I can’t recall having seen this executed within the wild,” Ford added. “This particularly targets using exterior or customer-provided keys (SSE-C or XKS, respectively) to say management over key administration for the cryptography utilized in storage.”
