1 of 34

Thunder CTF�Learning Cloud Security on a Dime

Nicholas Springer, Wu-chang Feng

https://thunder-ctf.cloud

​

​

​

​

​

​

Supported by NSF award #1821841

2 of 34

Race to the cloud...

3 of 34

… going faster due to COVID

4 of 34

What are the biggest challenges for organizations engaged with public cloud?

Source: Forbes

5 of 34

Justified?

  • Take one complicated problem, we're struggling with...
    • Operating system security
    • Router and firewall configuration
    • User management and authentication
    • Access control management
    • Asset and data inventory
    • Software updates and patching
  • … and add an entirely new set of problems
    • IAM access control and policy management
    • Account access key and token management
    • Credential rotation
    • Cloud platform service configuration
    • Federated identity providers, zero-trust networks
    • Container, serverless, and API security
  • Leads to ...

6 of 34

Misconfigured storage buckets

Misconfigured snapshots

7 of 34

Misconfigured databases

Over-provisioned privileges

8 of 34

Exposed login credentials

9 of 34

Exposed API, account, OAuth, ssh keys

  • ~1793 unique keys daily
  • ~20 seconds before discovery

10 of 34

Exposed metadata

  • Via a security product!

11 of 34

All of the above?

  • Open vulnerable server (Ruby deserialization RCE via cookie)
  • Hard-coded tokens in code
  • Weak passwords ('changeme', 'password', 'instagram', <username>)
  • Database credentials stored in a file
  • AWS access keys stored in a file
  • Unprotected application backups containing key material
  • Overprovisioned key
  • Results in access to all content (source code, site assets, SSL certificates and private keys, API/OAuth keys, etc.)

12 of 34

Criminals and nation-states racing to take advantage

13 of 34

Are we prepared?

  • Oregon's CyberSeek numbers

14 of 34

CS 495: Web and Cloud Security https://codelabs.cs.pdx.edu/cs495

15 of 34

Cloud security labs available

(AWS)

(AWS)

(AWS)

16 of 34

Thunder CTF

  • A Cloud Security CTF for Google Cloud Platform

17 of 34

Design

  • Scenario-based to allow students to role-play actual exploits
  • Scaffolded to support differentiated instruction across novices and experienced practitioners
  • Extensible to enable developers to add, remove, and customize levels based on current vectors of exploitation
  • Frictionless setup, low cost, polymorphism for easy deployment in classrooms

18 of 34

Scenario-based

  • Informed by Mitre Att&ck framework
    • Comprehensive, industry-standard enumeration of attacker behavior
      • "GitHub" for adversary behaviors (A living framework!)
    • Derived from incident response and threat intelligence communities
      • What are attackers actually using?
    • Organized by tactics, techniques, and procedures different APTs and hacking groups actually use
      • "TTP"s

19 of 34

TTPs

  • Tactics
    • Generalized approaches
  • Techniques
    • Specific approaches to perform a particular tactic
  • Procedures
    • Playbook of tactics and techniques used by adversaries to accomplish objective
  • Best shown in a matrix

​

20 of 34

21 of 34

12 Tactics

  • Initial access
  • Execution
  • Persistence
  • Privilege escalation
  • Defense evasion
  • Credential access
  • Discovery
  • Lateral movement
  • Collection
  • Command & Control
  • Exfiltration
  • Impact

​

22 of 34

  • Adapted to GCP (Mitre Att&ck Framework for GCP)
  • Scenarios follow procedures used throughout entire attack lifetime (not just app exploitation)
    • Overprovisioned permissions, weak IAM policies, IAM privilege escalation
    • Keys in code, access token compromise
    • Backdoors via metadata, metadata access via SSRF, exposed container images and git information
    • Filtered log exfiltration, unsanitized error messages

23 of 34

  • Example scenario modeled after Capital One breach (a6container)
  • Obtain a compromised account key
  • List the project’s instances
  • View VM metadata to see container image being run
  • Pull container image to find code implementing a proxy
  • Perform SSRF attack
  • Obtain credentials of the VM via Metadata service
  • Use credentials to access secret file in storage bucket

24 of 34

Scaffolded

  • CTFs often evaluative, targeting experts
    • Esoteric levels that discourage novices
  • Differentiated instruction approach of Thunder CTF
    • Scenarios with gently increasing difficulties
    • Hint-system
      • Support direct instruction for novices that treats CTF as a walk-through/codelab
      • True CTF for advanced practitioners by ignoring hints
    • Balance challenge and struggle to target flow

25 of 34

26 of 34

Extensible

  • Shifting threat models/counter-measures in the cloud
    • e.g. Metadata service SSRF soon a dead bug class
    • Requires continuous change in content
  • Framework to support
    • New levels
    • New CTF sequences via namespaces (least-privileges)

27 of 34

  • CTF framework
    • Levels specified via Python Cloud Deployment Manager scripts and YAML configuration files
    • HTML template file for hints

28 of 34

  • Level module development guide
  • Python CTF Framework documentation

​

29 of 34

Deployable

  • Requires only a Google Cloud account to play
  • Consumes minimal amount of resources
    • Serverless design
    • Resource usage within free-tier offerings
    • Levels can be played for under a dime!
  • Code freely available for use
  • Simple level launch via Cloud Shell
    • python3 thunder.py create thunder/a1openbucket
    • python3 thunder.py destroy
  • Polymorphic flags to support courses and certifications

30 of 34

Results

  • CS 495/595 Web and Cloud Security (Winter 2020)
  • CS 430P/530 Internet, Web, and Cloud Systems (Fall 2019)
  • CTF rating (1 = very unhelpful, 5 = very helpful)
    • 36 out of 48 students responding

Question

Average rating

Rate the CTF exercises for understanding security issues in the cloud.

3.94

Rate the CTF exercises for developing skills in navigating the cloud.

3.94

Rate the hint system as a mechanism for providing help as needed in solving CTF exercises.

4.56

31 of 34

Demo

(spoiler alert)

32 of 34

thunder/a2finance

3. Storage access

4. Git exfiltration

5. Exposed ssh key in repo history

2. Service discovery (compute/storage)

1. Initial permissions

6. Compute account discovery

7. Elevated access to logging

8. Unsanitized error log exfiltrated

33 of 34

Future work

  • Additional levels
  • Additional play modes
  • Additional CTFs
  • Continued use in courses

34 of 34

Questions?

​

Code walkthrough?