Are your encrypted AWS S3 buckets secure from threat actors?

 

You take proactive steps to secure your valuable business data by encrypting it at rest using private keys you manage and keep separate and off network. Yet the cybersecurity landscape constantly evolves, with threat actors developing new techniques to compromise systems, hold your data hostage, extort money from you and potentially put you out of business.

The Threat to Encrypted Cloud Storage

Until recently ransomware thieves encrypted local storage volumes or mounted file shares. Now hackers have discovered a novel threat to encrypted cloud storage. A new report from cyber resilience firm Halcyon identified a new campaign targeting Amazon Web Service’s (AWS) S3 cloud storage encrypted by Amazon’s Server-Side Encryption with Customer-Provided Keys (SSE-C).

This attack poses a significant recovery challenge as the attacker generates another set of SSE-C encryption keys. Because AWS doesn't store these customer-provided keys, recovering the data without the attacker's cooperation becomes virtually impossible.

How the Attack Works

1. Credential Compromise: The attacker first gains valid AWS credentials with permissions to encrypt S3 buckets using SSE-C. This could be achieved through phishing scams, compromised systems, or exposed keys in code repositories.
2. Access to Your Environment: The attacker leverages the stolen credentials to access your enterprise networks to discover the location of the existing S3 encryption keys.
3. Unauthorized Key Rotation: The attacker decrypts the storage with your keys which they found on your network, then encrypt the storage with the keys they generated.
4. Ransom Demand: A ransom note is left within the affected buckets, outlining the payment demands and threatening data deletion if the ransom is unpaid or the data is tampered with.
5. Data Deletion Threat: To pressure victims, attackers may configure a lifecycle policy to automatically delete the encrypted data after a set timeframe, typically seven days.

Risk Assessment: Potential Impacts on Your Businesses

• Data Loss: If the ransom is not paid, the encrypted data becomes permanently inaccessible.
• Business Disruption: Critical data loss can cripple business operations, impacting productivity, customer service, and revenue.
• Reputational Damage: Ransomware attacks can severely damage a company's reputation and erode customer trust.
• Financial Losses: Businesses may incur financial losses from ransom payments, incident response, data recovery attempts, and legal/regulatory issues.
• Operational Disruption: Loss of access to critical data can halt operations, leading to delays, missed deadlines, and contractual breaches.

Mitigation Strategies: Protecting Your S3 Buckets

• Enforce Least Privilege: Grant AWS users and roles only the minimum permissions required for their tasks. Regularly review and audit IAM policies to ensure adherence to least privilege.
• Employee Training: Train employees to identify and avoid phishing attempts and other social engineering tactics used to steal credentials, and best in class information security procedures on encryption key management.
• Enable Multi-Factor Authentication (MFA): Enforce MFA for all AWS users, especially those with administrative privileges, to add an extra layer of security against compromised credentials.
• Data Replication: Implement cross-region replication or backups to a separate AWS account for added data protection.
• Use Short-Term Credentials: Avoid using long-term access keys. Instead, leverage IAM roles and AWS Security Token Service (STS) to generate temporary credentials for applications and services.
• Restrict SSE-C Usage: If your applications don't require SSE-C, consider blocking its use through bucket policies or resource control policies (RCPs) within AWS Organizations.
• Rotate Credentials Regularly: If using SSE-C, implement a regular rotation schedule for access keys and other credentials.
• Monitor AWS Resources: Implement robust monitoring and logging using AWS CloudTrail and S3 server access logs. Set up alerts for suspicious activity, such as unusual API calls or bulk encryption operations.

How ThreatSciences.com Can Help

At ThreatSciences.com, we specialize in assessing and mitigating security risks. Our team of experts offers:

• Comprehensive risk assessments of your on-premise data centers and cloud tenants.
• Implementation of best-in-class security techniques and processes to protect your valuable business data.
• Training your staff to be aware of phishing attacks and to sensitize them to information security best practices.

Ransomware attacks are devastating to your business. You do not want to be held hostage by bad actors.

Partner with ThreatSciences.com today to secure your future.