“Let’s say somebody is utilizing these suppliers they usually occur to have a standard id platform, perhaps SailPoint. If SailPoint is passing an information stream to AWS and Microsoft and perhaps others, it may allow entry to all that shopper’s info in a kind of hyperscaler environments. It’d enable restricted knowledge entry within the cloud. Now let’s say someway an attacker is concentrating on that AWS API. If that shopper was utilizing the identical credentials throughout these cloud platforms,” it may present intensive entry, he says.
IMDSv2: What you don’t know may kill your cloud
In March 2024, Amazon quietly rolled out an replace to a important piece of the AWS platform: the Occasion Metadata Service (IMDS). Some SOCs “won’t even understand that they’re utilizing [IMDS]” and subsequently they’re exposing their operation to a critical “safety menace associated to metadata publicity,” says Pluralsight’s Firment.
“AWS makes use of IMDS to retailer safety credentials utilized by different purposes and providers, and makes that info accessible utilizing a REST API. Attackers can use a Server-Facet Request Forgery [SSRF] to steal credentials from IMDS, which permits them to authenticate because the occasion position for lateral motion or knowledge theft,” Firment explains. “AWS launched a more recent model of IMDS, model 2, to enhance the safety of unauthorized metadata, though many organizations are nonetheless utilizing the unique IMDSv1 because the default. To assist CISOs shut this potential safety gap, AWS just lately introduced the power to set all newly launched Amazon EC2 situations to the safer IMDSv2 by default.”
IMDSv2 “was launched by AWS in November 2019 however the capacity to set the default to the brand new model was not launched till March 2024. In consequence, many organizations continued to make use of the unique weak IMDSv1. Fascinating to notice that the default solely applies to new situations launched, so current situations with IMDSv1 nonetheless have to be reconfigured,” Firment says.
