Early Warning Detectors Using AWS Access Keys as Honeytokens

#1

Post by StabbyCutyou » Wed, Nov 30, 2016, 4:34 PM UTC

Early Warning Detectors Using AWS Access Keys as Honeytokens
blog.komand.com

Re: Early Warning Detectors Using AWS Access Keys as Honeytokens

#2

Post by cddotdotslash » Wed, Nov 30, 2016, 4:59 PM UTC

This should also be called "how to get your account locked by AWS in 15 minutes or less."

AWS is not fond of finding AWS keys laying around (limited permissions or otherwise). I once committed a key to a GitHub repo and AWS called me within 15 minutes. I've seen cases where they will then lock your account (preventing it from creating new EC2 resources) until the key is deleted.

Seriously, don't do this.

EDIT: as others have mentioned, private repos would be fine (and a good idea).

Re: Early Warning Detectors Using AWS Access Keys as Honeytokens

#3

Post by theamk » Wed, Nov 30, 2016, 5:05 PM UTC

cddotdotslash wrote: post #2

This should also be called "how to get your account locked by AWS in 15 minutes or less." AWS is not fond of finding AWS keys laying around (limited permissions or otherwise). I once committed a key to a GitHub repo and AWS called me within 15 minutes. I've seen cases where they will then lock your account (preventing it from creating new EC2 resources) until the key is deleted. Seriously, don't do this. EDIT: as oth…

The whole point is that AWS (nor any other outside party) would not find the keys. The article explicitly mentions:

  On servers in a text file in ~/.aws/credentials (where a lot of tooling saves AWS credentials)
  On your developer laptop in the same locations
  In application or systemd environment variable configuration files
  In files named ’credentials’ or in application configuration files in private, sensitive Github repos

Unless amazon somehow has access to private github repos, they should not see the keys

Re: Early Warning Detectors Using AWS Access Keys as Honeytokens

#4

Post by tobz » Wed, Nov 30, 2016, 5:10 PM UTC

cddotdotslash wrote: post #2

This should also be called "how to get your account locked by AWS in 15 minutes or less." AWS is not fond of finding AWS keys laying around (limited permissions or otherwise). I once committed a key to a GitHub repo and AWS called me within 15 minutes. I've seen cases where they will then lock your account (preventing it from creating new EC2 resources) until the key is deleted. Seriously, don't do this. EDIT: as oth…

Yeah, putting the keys on Github seems pointless and contrived: there's no remediation to putting a known-bad key out in the open. What are you going to do: block their IP? Oh boy.

I see value in the other examples, though, because they are dead simple tripwires, and, unless AWS is scanning your instances, they should never see this and it shouldn't be a problem.

Re: Early Warning Detectors Using AWS Access Keys as Honeytokens

#5

Post by jenandre » Wed, Nov 30, 2016, 5:15 PM UTC

tobz wrote: post #4

cddotdotslash wrote: post #2

This should also be called "how to get your account locked by AWS in 15 minutes or less." AWS is not fond of finding AWS keys laying around (limited permissions or otherwise). I once committed a key to a GitHub repo and AWS called me within 15 minutes. I've seen cases where they will then lock your account (preventing it from creating new EC2 resources) until the key is deleted. Seriously, don't do this. EDIT: as oth…

Yeah, putting the keys on Github seems pointless and contrived: there's no remediation to putting a known-bad key out in the open. What are you going to do: block their IP? Oh boy. I see value in the other examples, though, because they are dead simple tripwires, and, unless AWS is scanning your instances, they should never see this and it shouldn't be a problem.

The idea is to use private repos on Github, not public ones, which just tell you that yes, someone can read a public repo and misuse a key. Not that your private repos have potentialyl been compromised.

Re: Early Warning Detectors Using AWS Access Keys as Honeytokens

#6

Post by c4urself » Wed, Nov 30, 2016, 5:28 PM UTC

Great idea, we had part of a private repo accidentally made public at some point and these kind of honeypot keys would've been triggered pretty quickly and let us know. Would definitely be a cool way to know if something has been leaked.

Re: Early Warning Detectors Using AWS Access Keys as Honeytokens

#7

Post by jakobdabo » Wed, Nov 30, 2016, 7:27 PM UTC

cddotdotslash wrote: post #2

This should also be called "how to get your account locked by AWS in 15 minutes or less." AWS is not fond of finding AWS keys laying around (limited permissions or otherwise). I once committed a key to a GitHub repo and AWS called me within 15 minutes. I've seen cases where they will then lock your account (preventing it from creating new EC2 resources) until the key is deleted. Seriously, don't do this. EDIT: as oth…

Recently Github crippled (unfortunately) the Search function so that you can't search something in all the repositories at once (if you try it says that you "Must include at least one user, organization, or repository").

I used to use it to find out how other people use different library functions in the wild and it helped me to find good code examples many times in the past (especially when there were no documentation on the API). I wonder if there is any other code searching service with comparable coverage and quality.

Re: Early Warning Detectors Using AWS Access Keys as Honeytokens

#8

Post by bjoernw » Wed, Nov 30, 2016, 7:32 PM UTC

cddotdotslash wrote: post #2

This should also be called "how to get your account locked by AWS in 15 minutes or less." AWS is not fond of finding AWS keys laying around (limited permissions or otherwise). I once committed a key to a GitHub repo and AWS called me within 15 minutes. I've seen cases where they will then lock your account (preventing it from creating new EC2 resources) until the key is deleted. Seriously, don't do this. EDIT: as oth…

I think you misunderstood the post. What are you testing when you post your aws honey token to a public repo? This is meant for intrusion detection.

Re: Early Warning Detectors Using AWS Access Keys as Honeytokens

#9

Post by osi » Wed, Nov 30, 2016, 8:32 PM UTC

cddotdotslash wrote: post #2

This should also be called "how to get your account locked by AWS in 15 minutes or less." AWS is not fond of finding AWS keys laying around (limited permissions or otherwise). I once committed a key to a GitHub repo and AWS called me within 15 minutes. I've seen cases where they will then lock your account (preventing it from creating new EC2 resources) until the key is deleted. Seriously, don't do this. EDIT: as oth…

I don't think you read the article. They only mention putting them in private places, as a honeypot to alert about an intrusion.

Re: Early Warning Detectors Using AWS Access Keys as Honeytokens

#10

Post by merb » Wed, Nov 30, 2016, 8:54 PM UTC

> On servers in a text file in ~/.aws/credentials (where a lot of tooling saves AWS credentials)

well that sounds clever.