It is great that it is Public because as it will create some sense of urgency. Similar to how you expose a Bug on Aurora like following, every such finding will directly/indirectly help a user in making good decisions and understand how to be careful.
Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
21–30 of 101 posts
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#22@kmcquade ur awesome ! we are users of https://github.com/salesforce/policy_sentry and definitely definitely https://github.com/salesforce/cloudsplaining . If I could give you guys money, I would. You should totally build a startup around it.
Aw, thank you. I really appreciate that.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#23Earlier quoted context omitted.
Author here :) Endgame exploits/abuses features. If it was a bug, I'd work with AWS to solve the problem, but with abusing features - that would result in years of unsatisfied feature requests. This should push the issue along. >...and it's not even a hacking tool! It can be used to backdoor resources to rogue accounts, so I'd say it's a hacking tool and can/should be used on penetration tests. I'd certainly use it o…
I'm impressed you were able to get your employer (Salesforce) to actually let you publish this under their organization. Kudos to that.
Salesforce also runs Heroku, which is one of the biggest AWS wrappers around. I'm really glad they're active in security auditing here, it's a real value add to customers of Heroku / Salesforce services to see evidence of their work to analyze security.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#24lol you're about to get a giant offer from Amazon. Tell them you want 10x whatever they first offer and they'll say yes.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#25Earlier quoted context omitted.
Author here :) Endgame exploits/abuses features. If it was a bug, I'd work with AWS to solve the problem, but with abusing features - that would result in years of unsatisfied feature requests. This should push the issue along. >...and it's not even a hacking tool! It can be used to backdoor resources to rogue accounts, so I'd say it's a hacking tool and can/should be used on penetration tests. I'd certainly use it o…
I'm impressed you were able to get your employer (Salesforce) to actually let you publish this under their organization. Kudos to that.
Yes, surprised also, given past stories around Defcon.
I think it's great to have audit tools like this. It makes people realize how vulnerable their accounts are.
Does a similar tool exist for Salesforce and Heroku?
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#26Note that as far as I could tell, this is a tool to check which unexpected AWS modifications can be done from API keys that you do make public in the first place. It doesn't "hack" an account per se.
So for example if you've created some IAM API keys and embedded in an app for example, and you (incorrectly) believe the permissions only grant the app to fetch some static media files from an S3 bucket, the tool can discover incorrect configurations that would allow someone who extracted the key to change permissions of the bucket.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#27Can someone explain why you'd ever want to run this in the non-dryrun mode?
I understand that if you have these problems you've already effectively granted those permissions anyway but actually executing them before someone finds them lowers the bar quite a bit for other baddies to attack.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#28Note that as far as I could tell, this is a tool to check which unexpected AWS modifications can be done from API keys that you do make public in the first place. It doesn't "hack" an account per se. So for example if you've created some IAM API keys and embedded in an app for example, and you (incorrectly) believe the permissions only grant the app to fetch some static media files from an S3 bucket, the tool can dis…
Yes, you'd have to leverage compromised credentials. That could be obtained via SSRF, RCE on a privileged box, leakage of user access keys, or other means. In the context of a penetration test, it's more of a post-exploitation tool.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#29Note that as far as I could tell, this is a tool to check which unexpected AWS modifications can be done from API keys that you do make public in the first place. It doesn't "hack" an account per se. So for example if you've created some IAM API keys and embedded in an app for example, and you (incorrectly) believe the permissions only grant the app to fetch some static media files from an S3 bucket, the tool can dis…
> the tool can discover incorrect configurations that would allow someone who extracted the key to change permissions of the bucket.
Nit: The tool can discover and abuse excessive permissions.
Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources
#30I work with AWS a lot every day and lead a team responsible for building workloads on AWS for some customers with very high security requirements. This tool terrifies me.
The sheer amount of potential for misconfiguration of resources that this tool can exploit with no effort whatsoever is absolutely insane. I feel like every AWS environment I've ever seen is suddenly at risk of some angry employee compromising everything very very quickly.
I'm betting over at AWS they're almost as terrified by this as I am.