Obfuscating AWS IAM Policies to Bypass CSPM Security Rules

URL: https://permiso.io/blog/introducing-sky-scalpel-open-source-tool

You Should Know:

Obfuscating AWS IAM (Identity and Access Management) policies can be a technique used to bypass Cloud Security Posture Management (CSPM) security rules and detection. This can be achieved through various methods such as Unicode encoding, wildcards, random casing, insignificant whitespace, and reordering of JSON documents. To prevent such techniques, it’s crucial to implement robust detection mechanisms and tools.

Practice Verified Codes and Commands:

1. Unicode Encoding Detection:

• Use Python to detect Unicode encoding in IAM policies:

  import json</li>
  </ul>
  
  def detect_unicode_encoding(policy):
  try:
  json.loads(policy)
  return False
  except json.JSONDecodeError:
  return True
  
  policy = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:<em>","Resource":"</em>"}]}'
  print(detect_unicode_encoding(policy))
  

  2. Wildcard Usage Detection:

  • Use AWS CLI to list IAM policies and check for wildcards:

    aws iam list-policies --query "Policies[?contains(PolicyDocument, '*')].[PolicyName, PolicyDocument]"
    

  3. Random Casing Detection:

  • Use Python to detect random casing in IAM policies:

    import re</li>
    </ul>
    
    def detect_random_casing(policy):
    return bool(re.search(r'[A-Z][a-z]*[A-Z]', policy))
    
    policy = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:<em>","Resource":"</em>"}]}'
    print(detect_random_casing(policy))
    

    4. Insignificant Whitespace Detection:

    • Use Python to detect insignificant whitespace in IAM policies:

      def detect_insignificant_whitespace(policy):
      return bool(re.search(r'\s{2,}', policy))</li>
      </ul>
      
      policy = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:<em>","Resource":"</em>"}]}'
      print(detect_insignificant_whitespace(policy))
      

      5. Reordering Detection:

      • Use Python to detect reordering in IAM policies:

        def detect_reordering(policy):
        standard_policy = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:<em>","Resource":"</em>"}]}'
        return policy != standard_policy</li>
        </ul>
        
        policy = '{"Statement":[{"Effect":"Allow","Action":"s3:<em>","Resource":"</em>"}],"Version":"2012-10-17"}'
        print(detect_reordering(policy))
        

        What Undercode Say:

        Obfuscating AWS IAM policies can pose significant security risks by bypassing CSPM rules. It’s essential to implement detection mechanisms for Unicode encoding, wildcards, random casing, insignificant whitespace, and reordering. Tools like Sky Scalpel by Permiso Security can help in detecting and deobfuscating such JSON documents. Always ensure your cloud security practices are up-to-date and regularly audit your IAM policies to prevent potential security breaches.

        Additional Linux and Windows Commands:

        • Linux:
        • Use `grep` to search for specific patterns in IAM policies:

          grep -i 's3:*' iam_policy.json
          

        • Use `jq` to parse and manipulate JSON documents:

          jq '.Statement[] | select(.Effect == "Allow")' iam_policy.json
          

        • Windows:

        • Use PowerShell to parse JSON and detect anomalies:

          $policy = Get-Content -Path .\iam_policy.json | ConvertFrom-Json
          $policy.Statement | Where-Object { $_.Effect -eq "Allow" }
          

        By following these steps and using these commands, you can enhance your cloud security posture and mitigate the risks associated with obfuscated IAM policies.

        References:

        Reported By: Grenuv Did – Hackers Feeds
        Extra Hub: Undercode MoN
        Basic Verification: Pass ✅

        Join Our Cyber World:

        💬 Whatsapp | 💬 Telegram

        Share this:

        • Reddit
        • LinkedIn
        • Threads
        • Pinterest
        • Bluesky
        • WhatsApp
        • X
        • Telegram
        • Facebook
        • Email
        • Tumblr
        • Mastodon
        • Print