Associated Blog: RansomWhen??? I never even notice it…
Research Blog: Encrypting buckets for compliance and ransom - How Attackers Can Use KMS to Ransomware S3 Buckets
RansomWhen is a tool to enumerate identities that can lock S3 Buckets using KMS, resulting in ransomwares, as well as detect occurances of S3 Ransomwares using KMS
-----------------------------------------------------------------------------------------------------------------------------------------------------
,,,,,,
;?S######S*:
%S@@@@@@@@S?
,SS@@@@@@@@S%
;S*SS@@@@@@@@S%?%:
,#@?%##########?%@S
*@@%?SSSSSSSSSS*S@@;
,#@@S%;:,,::,,:+SS@@S
,%@?: , ,, ;%@?,
:##*, ;, ,*@S,
,S@:,, :S, ,,;@%
;@? ?#:,,,,,,,,, %@?*:
+@*: ;##**+;;::,,;?@S#;
;@% ,, S@+;,
%@;,, ,,*@?
,%@?, ,%@?,
?@S+,: ,:,+S@+
,#@@#S*;::;;::+*S#@@%
+@@%*SSSSSSSSSS+S@@;
,S@?%##########?%@%
:?+SS@@@@@@@@S%*?,
SS@@@@@@@@S%
%S@@@@@@@@S?
:+%SSSSSS%+:
.______ ___ .__ __. _______. ______ .___ ___. ____ __ ____ __ __ _______ .__ __. ______ ______ ______
| _ \ / \ | \ | | / | / __ \ | \/ | \ \ / \ / / | | | | | ____|| \ | | | \ | \ | \
| |_) | / ^ \ | \| | | (----`| | | | | \ / | \ \/ \/ / | |__| | | |__ | \| | `----) | `----) | `----) |
| / / /_\ \ | . ` | \ \ | | | | | |\/| | \ / | __ | | __| | . ` | / / / / / /
| |\ \----. / _____ \ | |\ | .----) | | `--' | | | | | \ /\ / | | | | | |____ | |\ | |__| |__| |__|
|__| `._____|/__/ \__\ |__| \__| |_______/ \______/ |__| |__| \__/ \__/ |__| |__| |_______||__| \__| __ __ __
(__) (__) (__)
-----------------------------------------------------------------------------------------------------------------------------------------------------
by Permiso Security
-----------------------------------------------------------------------------------------------------------------------------------------------------
To install, the only thing needed, is to install the required libraries.
python3 -m venv ./venv
source venv/bin/activate
python3 -m pip install -r requirements.txt
Then, just run the tool by running ransomwhen.py:
usage: ransomwhen.py [-h] {IDENTITIES,EVENTS} ...
RansomWhen???
positional arguments:
{IDENTITIES,EVENTS} Select the check on the account (the choices are IDENTITIES, EVENTS)
IDENTITIES IDENTITIES specific arguments
EVENTS EVENTS specific arguments
options:
-h, --help show this help message and exit
A Dockerfile is placed inside the main directory of the project. To build the image, inside the main directory of the project run:
docker build -t ransomwhen .
Then run the container with directory ~/.aws mounted to host:
usage: ransomwhen.py [-h] {IDENTITIES,EVENTS} ...
RansomWhen???
positional arguments:
{IDENTITIES,EVENTS} Select the check on the account (the choices are IDENTITIES, EVENTS)
IDENTITIES IDENTITIES specific arguments
EVENTS EVENTS specific arguments
options:
-h, --help show this help message and exit
The tool has 2 nested Argument Parsers, IDENTITIES and EVENTS. IDENTITIES will list all identities with privileges to any of the ransomware scenarios and EVENTS will list malicious events related to ransomware per each identity.
To enumerate the identities, the tool will use the JSON Blob on path scenarios/scenarios.json containing the privileges needed for different attacks. That JSON is configurable with the below format. Each scenario will have a name and a list of events to check.
{
"Create Locked Key and Encrypt Bucket using CopyObject": [
"kms:CreateKey",
"s3:PutBucketEncryptionConfiguration",
"s3:CopyObject"
]
}Each scenario will be listed as:
- allowed, for cases when all the events in a scenario are allowed
- partially, for cases when at least 1 event in the scenario is allowed
- denied, for cases when no event on the scenario is allowed
Attach Custom KMS Key Store
Create Locked Key and Encrypt Bucket using CopyObject
Create Locked Key and Encrypt Bucket using Get/Put Object
Create Role, Add Inline Policy and Delete
Create Role, Attach Inline Policy and Delete
Create User, Add Inline Policy and Delete
Create User, Attach Inline Policy and Delete
Delete CloudTrail Trail
Stop Logging
Stop Logging using KMS
Update Current Custom KMS Key Store
Update Key Policy to Lock Key and Encrypt Bucket using CopyObject
Update Key Policy to Lock Key and Encrypt Bucket using Get/Put Object
As far as finding identities with malicious events, the tool will look into the JSON Blob scenarios/events.json. That file can also be configured, with a format as below, where each event will have its information set to either null or a value, just as it is supposed to be saved on the CloudTrail Logs.
{
"CreateKey": {
"UserAgent": null,
"Identity": null,
"RequestParameters": null,
"ResponseElements": null,
"ErrorCode": null,
"ErrorMessage": null,
"EventSource": "kms.amazonaws.com"
}
}The events below are the ones that will get checked on CloudTrail. And as seen before, each event can be configured to check for specific indicators.
kms:CreateKey
kms:PutKeyPolicy
kms:ReEncrypt
kms:CreateCustomKeyStore
kms:UpdateCustomKeyStore
kms:ConnectCustomKeyStore
kms:DisconnectCustomKeyStore
kms:DeleteCustomKeyStore
s3:PutBucketEncryptionConfiguration
s3:CopyObject
s3:PutObject
s3:GetObject
iam:CreateUser
iam:DeleteUser
iam:CreateRole
iam:DeleteRole
iam:AttachUserPolicy
iam:PutUserPolicy
iam:AttachRolePolicy
iam:PutRolePolicy
cloudtrail:StopLogging
cloudtrail:DeleteTrail
cloudtrail:UpdateTrail
Then, running the tool, would list all the identities (IAM Users and Roles) and the events they have ran over the last 90 days.
The outputs will be dumped on the output directory. Each AWS Account will have its own directory and the CSV files of each identity will be saved there:
ls output/ -R
output/:
012345678912
output/012345678912:
adminUser-predefined-scenarios.csv adminUser-events.csv
The tool will test for attacks provided on ./scenarios/scenarios.json:
cat ./scenarios/scenarios.json
[
"Create Locked Key and Encrypt Bucket using CopyObject": [
"kms:CreateKey",
"s3:PutBucketEncryptionConfiguration",
"s3:CopyObject"
],
...
]
Each attack has a name and a list of privileges. New scenarios can be added or existing ones can be modified on the JSON and they will be automatically executed by the tool.
The malicious events are stored on ./scenarios/events.json and each have their options to filter:
[
"CreateKey": {
"UserAgent": null,
"Identity": null,
"RequestParameters": null,
"ResponseElements": null,
"ErrorCode": null,
"ErrorMessage": null,
"EventSource": "kms.amazonaws.com"
}
...
]