CMU6XX

Ethical Hacking

Session 10: Cloud & IoT Security

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Deconstruct the Cloud Shared Responsibility Model.
  • Exploit misconfigured AWS S3 buckets and IAM policies.
  • Analyze the unique threat landscape of Internet of Things (IoT) devices.
  • Extract and reverse engineer IoT firmware binaries using Binwalk.
  • Understand the implications of default credentials in embedded systems.

Seminar Structure (3 Hours)

Part 1: Cloud Exploitation (AWS) (1.5 hrs)
  • The Shared Responsibility Model
  • S3 Buckets and IAM Misconfigurations
  • Task 1: S3 Bucket Exploitation
Part 2: IoT Device Hacking (1.5 hrs)
  • The IoT Threat Landscape (Mirai)
  • Firmware Extraction and Analysis
  • Task 2: Firmware Reverse Engineering

Part 1: Cloud Exploitation (AWS)

Duration: 1.5 Hours

The Shared Responsibility Model

When migrating to the cloud, you do not outsource your security responsibility.

  • Security OF the Cloud: Amazon/Microsoft is responsible for physical security, hypervisor patching, and global infrastructure.
  • Security IN the Cloud: The customer is responsible for configuring firewalls (Security Groups), managing IAM permissions, and encrypting data.
  • 99% of cloud breaches are a result of customer misconfiguration, not AWS being "hacked."

S3 Bucket Misconfigurations

Amazon Simple Storage Service (S3) is the backbone of cloud storage.

  • Buckets are private by default.
  • However, developers often explicitly set permissions to "Public Read" to easily host images for a website, but accidentally apply that policy to the entire bucket containing database backups.
  • If the bucket name is guessable (e.g., acme-corp-backups), an attacker can simply browse to the URL and download gigabytes of sensitive data without any authentication.

Identity and Access Management (IAM)

IAM controls who can do what in the cloud. It replaces traditional network firewalls as the primary security boundary.

  • Over-permissive Policies: Giving a developer s3:* (full access to all buckets) instead of s3:GetObject on a specific bucket.
  • Privilege Escalation: If a low-level user has the iam:PassRole permission, they can attach an Administrator role to a new EC2 instance they create, log into that instance, and effectively become a cloud administrator.

Introduction to Task 1

Attacking cloud infrastructure often requires no specialized hacking tools. The official AWS Command Line Interface (CLI) is the attacker's best friend.

We will simulate the enumeration and exploitation of an unsecured S3 bucket.

Task 1: S3 Bucket Exploitation

Timing: 45 minutes

You have discovered a potential S3 bucket named startup-client-data via OSINT.

  1. Write the exact awscli command used to list the contents of this bucket anonymously (without providing your own AWS credentials).
  2. Assume the list command succeeds and reveals a file named prod-db-dump.sql. Write the command to download this file to your local machine.
  3. Explain the principle of "Least Privilege" as it applies to fixing this specific IAM misconfiguration.
Practical Resource: AWS Command Line Interface

15 Minute Break

Please return promptly for Part 2.

Part 2: IoT Device Hacking

Duration: 1.5 Hours

The IoT Threat Landscape

The "S" in IoT stands for Security.

  • Smart cameras, thermostats, and industrial sensors are essentially tiny Linux computers connected to the internet.
  • The Mirai Botnet (2016): Scanned the internet for IoT devices using a hardcoded list of 60 default factory passwords (e.g., admin/admin). It compromised 600,000 devices and launched the largest DDoS attack in history.
  • IoT devices often lack a mechanism for remote patching, meaning vulnerabilities remain forever.

IoT Firmware

Firmware is the operating system for embedded devices, usually distributed as a single `.bin` file.

  • If an attacker can download a firmware update file from the manufacturer's website, they can reverse engineer the entire device offline.
  • Firmware images often contain embedded Linux filesystems (SquashFS).
  • Inside that filesystem, attackers hunt for hidden backdoor accounts, hardcoded private SSL keys, and compiled CGI scripts containing buffer overflows.

Extracting Firmware: Binwalk

Binwalk is the industry standard tool for analyzing embedded filesystems.

  • It scans the binary file for known file signatures (e.g., the magic bytes for a ZIP archive or a SquashFS filesystem).
  • Running binwalk -e firmware.bin will automatically carve out the embedded filesystem and unpack it into a readable directory structure on your Linux machine.
  • You can then explore the router's /etc/shadow file or /var/www/ directory just like a normal computer.

Introduction to Task 2

Hardware hacking often doesn't require touching the physical hardware at all. Firmware reverse engineering allows us to find zero-day vulnerabilities from the comfort of our own terminal.

We will simulate the extraction and analysis of a home router's firmware.

Task 2: Firmware Reverse Engineering

Timing: 50 minutes

You downloaded router_update_v2.bin from a vendor website. You run binwalk -e router_update_v2.bin and successfully extract a Linux filesystem.

  1. Which specific file inside the extracted /etc/ directory should you target first to find local user passwords?
  2. If you find a password hash in that file, how would you attempt to crack it offline? (Specify the tool).
  3. Assume you find a hardcoded RSA private key (server.key) inside the firmware. Describe the devastating MITM attack this enables against every customer using this router model.
Practical Resource: Binwalk GitHub Repository

Summary & Next Steps

  • The cloud is secure by default, but complex to configure safely. Misconfigurations are the new zero-days.
  • IoT devices represent a massive, largely unpatched attack surface relying heavily on "Security through Obscurity" (which always fails).
Next Week: Cryptography for Professionals (Applied Encryption)