SkyScalpel: Making & Breaking {"Policy": "Obf\u0075scA**Tion"} in the Cloud
No ratings
Presented at SecTor 2024 by
Cloud security professionals today must understand the role policies play in access management for all identities in their organizations – humans and machines alike. However, calculating an identity's effective permissions is complex due to policy inheritance (e.g. managed policies inherited from groups, roles and Service Control Principal, each with their own potential inline policies). But is a firm grasp on permissions calculation sufficient?Obfuscation of cloud policies, remote administration command scripts and various permissions parameters is an oft-overlooked attack vector with implications at several stages of the detection engineering pipeline. When "Allow" becomes "Al\u006Cow" and "iam:PassRole" becomes "iam:P*ole", are current detections evaded? Some obfuscation techniques are detectable in runtime events during creation but silently sanitized upon storage and/or later retrieval by corresponding APIs. Other techniques persist into the storage of created entities (e.g. IAM policies). These obfuscation scenarios can evade string-based detections, break policy rendering pages in Management Consoles, and even selectively overwrite policy contents of an attacker's choosing based on the defender's viewing method. Additionally, we identified subtle differences between official cloud provider tooling (CLI, SDKs, Management Console) that further facilitate and complicate the generation and detection of these obfuscation scenarios.In this presentation, we will highlight and publish our offensive and defensive findings from these obfuscation scenarios and will release SkyScalpel – a fully custom open-source JSON tokenizer and syntax tree parser complete with generic and cloud-specific obfuscation, deobfuscation and detection capabilities. SkyScalpel includes highly configurable randomized JSON-level obfuscation (Unicode encoding, insignificant whitespace packing and selective special characters like \b and ), policy-level obfuscation at the syntactical and functional levels (e.g. wildcard expansion of ActionNames) and deobfuscation and detection mechanisms for all aforementioned obfuscation capabilities.Come see how SkyScalpel empowers offense and defense with surgical precision in ready-to-use cloud obfuscation, deobfuscation and detection capabilities.