Exercise 16: Cloud Network Security Misconfiguration

Objective:

Understand how network misconfigurations in cloud environments, such as insecure VPC setups or overly permissive security groups, expose resources to potential attacks. Learn how to secure cloud networks using private subnets, firewalls, and traffic restrictions.

Scenario:

An organization has deployed an AWS Virtual Private Cloud (VPC) with public and private subnets. Due to misconfigured security groups, sensitive resources like databases are accessible over the internet. Your goal is to simulate an attacker exploiting these misconfigurations and recommend best practices to secure the network.

Lab Setup:

Prerequisites:

1. AWS account (free-tier works for this lab).
2. Installed tools:
   • nmap (Download).
   • aws-cli (Installation Guide).

Steps to Set Up the Lab:

Create a VPC with Subnets:

Log in to the AWS Management Console and navigate to VPC > Create VPC > VPC only.

Configure the VPC:

VPC name: insecure-vpc.

CIDR block: 10.0.0.0/16.

Create two subnets:

Public Subnet:

Name: public-subnet.

CIDR block: 10.0.1.0/24.

Enable auto-assign public IP addresses.

Private Subnet:

Name: private-subnet.

CIDR block: 10.0.2.0/24.

Set Up a Public EC2 Instance:

Launch an EC2 instance in the public subnet:

AMI: Amazon Linux 2 or Ubuntu.

Instance Type: t2.micro.

Security Group:

Allow SSH (port 22) and HTTP (port 80) from 0.0.0.0/0.

Assign the instance a public IP.

Set Up a Private EC2 Instance:

Launch another EC2 instance in the private subnet:

AMI: Amazon Linux 2 or Ubuntu.

Instance Type: t2.micro.

Security Group:

Allow MySQL/Aurora (port 3306) from the public subnet IP range (10.0.1.0/24).

Test Connectivity:

Connect to the public EC2 instance using SSH:

ssh -i <key-file>.pem ec2-user@<public-ip>

From the public EC2 instance, attempt to connect to the private EC2 instance:

mysql -h 10.0.2.<private-instance-ip> -u root -p

Exercise: Exploiting Misconfigured Network Settings

Objective:

Simulate an attacker exploiting network misconfigurations, such as open database ports or overly permissive rules.

Scan the Public EC2 Instance:

Use nmap to identify open ports on the public EC2 instance:

nmap -Pn -p 22,80 <public-ip>

Observe if ports like SSH (22) and HTTP (80) are accessible.

Probe the Private EC2 Instance:

From the public EC2 instance, scan the private subnet for open ports:

nmap -Pn -p 3306 10.0.2.<private-instance-ip>

Verify if the MySQL port is accessible from the public subnet.

Exploit Database Misconfiguration:

Use default or weak credentials to attempt access to the database:

mysql -h 10.0.2.<private-instance-ip> -u root -p

Document if access is granted.

Simulate Lateral Movement:

From the public EC2 instance, attempt to SSH into the private EC2 instance:

ssh ec2-user@10.0.2.<private-instance-ip>

Observe if overly permissive rules allow unauthorized access.

Tools Required:

1. AWS VPC: For creating the cloud network.
2. nmap: For scanning open ports and services.
3. MySQL Client: For accessing the private database.

Deliverables:

1. Exploit Report:
   • Evidence of accessing the private subnet or database from the public subnet.
   • Logs or screenshots showing open ports and unauthorized access attempts.
2. Recommendations for Securing Cloud Networks:
   • Best practices for configuring VPCs, subnets, and security groups.

Solution:

1. Identified Vulnerabilities:
   • Open Ports: Publicly accessible SSH and HTTP ports allowed unauthorized access.
   • Exposed Database: The database in the private subnet was accessible from the public subnet.
   • Lack of Network Segmentation: No proper isolation between public and private resources.
2. Consequences:
   • Unauthorized Access: Attackers can exploit open ports to gain access to the cloud network.
   • Data Breach: Exposed databases may lead to sensitive data theft.
   • Service Disruption: Unauthorized access to resources can lead to service outages or malicious activity.
3. Prevention Techniques:
   • Restrict Security Group Rules:
     • Limit inbound and outbound traffic to specific IP ranges or applications.
     • Example security group rule for MySQL:
       • Type: MySQL/Aurora
       • Protocol: TCP
       • Port Range: 3306
       • Source: 10.0.1.0/24 (trusted subnet).
   • Isolate Public and Private Resources:
     • Use a NAT gateway to allow private instances to access the internet without exposing them publicly.
   • Enable Network Monitoring:
     • Use AWS VPC Flow Logs to monitor network traffic and detect anomalies.
   • Implement Bastion Hosts:
     • Use a bastion host for secure SSH access to private resources.
   • Harden Database Security:
     • Require strong database credentials.
     • Enable encryption for data in transit and at rest.

Conclusion:

This exercise highlights how network misconfigurations, such as overly permissive security groups or open ports, can expose cloud resources to attackers. By isolating resources, restricting traffic, and monitoring network activity, organizations can secure their cloud environments and prevent exploitation.