Pen test / ethical hacking

[Baron015]

After some TDF advice: esp eg Ian_6301

I have an AWS account used for intermediary processing from a big customer to some service providers in the marketplace. We see about 10 million transactions a day, so a non-trivial workload.

Connectivity into and out of the AWS VPC is private using Direct Connect and some dedicated switches hosted at various PoPs, with redundant leased lines to the customers and to our own WAN with VRFs for end to end connectivity.

All AWS regions are in Europe and the architecture is active/active. AWS security features are applied according to best practice and common sense e.g. zoned subnets, security groups, routing tables, IAM roles, etc. All compute is using Dedicated Instances. The EC2 instances all have HIDS and FIM. Apps run in docker containers which are managed using kubernetes. All logs are shipped to a SIEM system in another VPC using VPC peering. Data is encrypted at rest and in transit. Master keys are in KMS.

We have a bastion host with internet access for VPN for admin users who might be located globally.

How would you start to do a pen test or ethical hacking on such a setup ? Is the VPN the only attack vector or how would I attempt to access the VPC in other ways ? Our internal pen-testing team are more accustomed to working on B2C systems which are Internet facing, not entirely private ecosystems with no apparent way in.

I do not want (and do not have permission for) them to be given privileged access and to mount attack from within.

They asked me where my PoPs are but I won't even tell them in which countries, apart from it's all EU based, if a hacker could find out then they can find out.

To demonstrate compliance but also start to win over the cloud non-believers ... some people in positions of authority still believe a lot of the old cloud myths and I want to use this application to help those individuals understand how cloud done right can be more secure than their own on-premise data centres.

Personally I believe the threats to corporates are from social engineering and from the web browser with internet access they put on everyone's desktops, not my kind of cloud hosted applications in a B2B SasS model. But one step at a time.


Sent from my iPhone using Tapatalk

[PeterL]

Pen test / ethical hacking

You need to start from the vector of the administrator and the consumer aka within the client network presuming they used some form of either Trojan or standard user access such as a borrowed Infrastructure and network access. Most of the interesting 0 day hacks surfacing all seem to provide device control so I would start them with an end user domain account in the network at a minimum and ask them to access or manipulate data or take control. Most pen testing is boring boring boring stuff where any form of positive gets blown out of proportion just because they find something not because it matters.


Sent from my iPad using Tapatalk Pro

[PeterL]

Btw, ask whitlow nicely


Sent from my iPad using Tapatalk Pro

[Ian_6301]

It kinda depends what you are trying to demonstrate by undertaking a pen test. Are you looking to prove something specific?

[Baron015]

Pen test / ethical hacking

You need to start from the vector of the administrator and the consumer aka within the client network presuming they used some form of either Trojan or standard user access such as a borrowed Infrastructure and network access. Most of the interesting 0 day hacks surfacing all seem to provide device control so I would start them with an end user domain account in the network at a minimum and ask them to access or manipulate data or take control. Most pen testing is boring boring boring stuff where any form of positive gets blown out of proportion just because they find something not because it matters.


Sent from my iPad using Tapatalk Pro

Specifically the client asked us not to do this i.e. test against attack from within the client network.

There are no end users though. This is b2b system to system interactions, no GUI stuff, it's all API stuff from within a "trusted zone" of the client network to the "trusted zone" of the marketplace providers. If a hacker has access to these zones, they already have the Crown Jewels and can cause total mayhem. My system will be an irrelevance in this context.

I agree the administrators are a concern. Approx 10 people only, in a follow the sun model 24x7, hence external access to a VPN server. This provides a way in, and although is needed for legitimate reasons, is definitely something I am concerned about. The pen test team will definitely attack the hell out of the VPN servers. Really I'd like to buy a secure VPN service rather than run my own, but not something AWS provides as a managed service over internet.

Luckily DDOS of the VPN service is not a massive issue for us, and in AWS we can relatively easily terminate the VPN servers and create new ones on new ip addresses in a couple of minutes, ad infinitum ...


Sent from my iPad using Tapatalk

[Baron015]

Pen test / ethical hacking

It kinda depends what you are trying to demonstrate by undertaking a pen test. Are you looking to prove something specific?

That their data isn't automatically leaked to the public by using cloud.

That this app hosted in the cloud can survive a concerted penetration attack originating externally by people who know what they are doing.

That public cloud can in fact be completely "private" i.e. no internet facing components or networking over internet (not even IPSec).

That my application in the cloud won't automatically allow any Tom dick and harry using the internet to attack and compromise the clients own production network.

If we have any mistakes or gaps in our security config, a chink in the external armour, that this testing might find and highlight them, so we can take mitigating action.

[Ian_6301]

That their data isn't automatically leaked to the public by using cloud.

That this app hosted in the cloud can survive a concerted penetration attack originating externally by people who know what they are doing.

That public cloud can in fact be completely "private" i.e. no internet facing components or networking over internet (not even IPSec).

That my application in the cloud won't automatically allow any Tom dick and harry using the internet to attack and compromise the clients own production network.

If we have any mistakes or gaps in our security config, a chink in the external armour, that this testing might find and highlight them, so we can take mitigating action.

Wow. Pretty comprehensive then!

It is very difficult to prove that something is completely watertight. and very costly. And you'd need to give the team privileged access to all of your network, firewalls, servers, etc to get anywhere near close.

In order to provide a meaningful level of assurance, you need a range of activities. Start with code review of your APIs. Check configuration on servers, network devices etc.

If I were trying to hack you, I'd go after your sysadmins through a social engineering approach. That would give me access to the inside of your network without having to hack anything. And that's the same way a real hacker would do it.

[Baron015]

Pen test / ethical hacking

Wow. Pretty comprehensive then!

It is very difficult to prove that something is completely watertight. and very costly. And you'd need to give the team privileged access to all of your network, firewalls, servers, etc to get anywhere near close.

In order to provide a meaningful level of assurance, you need a range of activities. Start with code review of your APIs. Check configuration on servers, network devices etc.

If I were trying to hack you, I'd go after your sysadmins through a social engineering approach. That would give me access to the inside of your network without having to hack anything. And that's the same way a real hacker would do it.

I totally agree. Convincing the CISO of a global investment bank is another thing entirely. Seems his team wants the assurance of a 1,000 page pen test report instead..... he reacted very favorably when I told him our pen test team was based in Prague, the code was written in Riga, the functional testing is done in India, and the architects are in London.

Kind of agree with the code review of APIs angle, but they're not publicly accessible, only via the client "trusted zone" where their main front office and back office systems back ends are running. So they told us not to worry about API security .... ha!! (We do have Oauth2 for basic AuthN/AuthZ and TLS and certs at both ends but that's about it).

Do I really need to give the team privileged access ? I was hoping to keep the attack vectors purely external, but still present that to client as perfectly reasonable and robust test.

Basically "yes it's in the cloud, but you can't find a way in, so nah nah nah etc .... "



Sent from my iPhone using Tapatalk

[PeterL]

You are except for the api's / vpn and administrator access dealing with a black box set up. I would take your CISO through the architecture and define the access paths they believe contain risk and work from there. Sounds like they don't trust AWS aka it's own encapsulation and isolation, that's where I suspect you will have to start from.


Sent from my iPhone using Tapatalk Pro

[Baron015]

You are except for the api's / vpn and administrator access dealing with a black box set up. I would take your CISO through the architecture and define the access paths they believe contain risk and work from there. Sounds like they don't trust AWS aka it's own encapsulation and isolation, that's where I suspect you will have to start from.


Sent from my iPhone using Tapatalk Pro

They don't trust anything with the word Cloud. Go out of their way to put up roadblocks.



Sent from my iPad using Tapatalk

[Ian_6301]

Coming in from the outside, you prove whether or not there is a crunchy perimeter. If there is, the inside could be as rotten as a 3 week old protein shake and no-one would be any the wiser...

In reality, the biggest problem you face is insider threat and an external based black box pen test will tell you nothing useful there.

Reading between the lines, it sounds like they have had their nose tweaked by the regulator and need a fight back plan, but have no real clue what they're up to...