아마존 웹 서비스(Amazon Web Service) Cloudtrail 해킹 과금 결제 분석

아마존(Amazon Web Service) Cloudtail 해킹 과금 결제 분석

 

Amazon Elastic Container Service 보면 테스크 정의 (task-definitions) 과 클러스터(cluster)가 엄청 많이 생겨서

리소스 자원을 미친듯이 잡아먹는 것을 볼 수 있음

 

노가다 해서 지우기 엄청 힘들다..

 

Reddit 검색 내용

 

Technically root access is not the only vector of having bad guys spawn cryptomining instances. Access keys present in github code in public repositories was a common way of deploying ec2s without root account access.

기술적으로 루트 액세스는 악당이 암호화폐 채굴 인스턴스를 생성하는 유일한 벡터가 아닙니다. 공개 저장소의 github 코드에 있는 액세스 키는 루트 계정 액세스 없이 ec2를 배포하는 일반적인 방법이었습니다.

 

2차 해킹 당함

 

125.160.59.140 으로 해킹 들어옴

 

userAgent 정보 보면 모바일?????

 

rds-monitoring-role 도 삭제

 

특히 ECS(Elastic Container Service) 이거 노가다로 지우면 하루 종일 걸림

(진짜 사람 할짓 못됨, 매크로 만들어서 겨우 지웠는데 너무 힘들다)

 

AWS 회신 내용

 

Thank you for getting back to us.

Please note that we can’t view the exact root cause. However, the following are common patterns of suspicious activity:

- An unpatched Amazon Elastic Compute Cloud (EC2) instance is infected and became a botnet agent.
- Credentials or access keys have been exposed.
- An overly aggressive web crawler might be classified as a denial-of-service attack by some internet sites.
- An end user posted malware files on a public Amazon S3 bucket.
- Sometimes internet users mistakenly report legitimate activities as abuse.

It is a best practice to monitor your account and its resources for any unusual activity or unauthorized access.
AWS CloudTrail and Amazon GuardDuty provide additional insight into the reasons for unauthorized activity.
For more information about AWS CloudTrail, see the following documentation:

 

GuardDuty가 유료인게 함정

 

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-insights-events-with-cloudtrail.html

Important: To secure and restore your account, complete the below steps, this process leads to account reinstatement and billing review for the unauthorized charges.

Step 1: Terminate IAM Roles and Policies
. Access the IAM roles console here: https://us-east-1.console.aws.amazon.com/iamv2/home?region=us-east-1#/roles
. Select the check box next to the role name that you want to delete.
. At the top of the page, choose Delete.
. In the confirmation dialog box, review the last accessed information, which shows when each of the selected roles last accessed an AWS service. This to confirm if the role is currently active.
. If you want to proceed, enter the name of the role in the text input field and choose Delete.

Step 2: If you haven't created the Organization, please proceed with the following instructions to delete the Role.

We need to go through these 3 Documents
-> Delete your IAM Identity Center configuration https://docs.aws.amazon.com/singlesignon/latest/userguide/regions.html
-> Delete permission sets https://docs.aws.amazon.com/singlesignon/latest/userguide/howtoremovepermissionset.html
-> Deleting a service-linked role for IAM Identity Center https://docs.aws.amazon.com/singlesignon/latest/userguide/using-service-linked-roles.html#delete-slr

-> To Delete the organization by removing the management account follow this guide:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_delete.html

I will add better instruction here (Step by Step) So It will be easier to follow:
- Go to the Settings in the Organization Console direct link here: https://us-east-1.console.aws.amazon.com/organizations/v2/home/settings
In the Settings page, choose Delete organization.

In the Delete organization confirmation dialog box, enter the organization's ID which is displayed in the line above the text box. Then, choose Delete organization.
- The roles should be deleted automatically. If not please go here: https://us-east-1.console.aws.amazon.com/iamv2/home?region=us-east-1#/roles
Select and delete the SSO and Organization Roles.

If you need assistance with the steps, choose "Phone" or "Chat" option from the Support Center: https://console.aws.amazon.com/support/home

Thank you for your cooperation on this.

We value your feedback. Please share your experience by rating this and other correspondences in the AWS Support Center. You can rate a correspondence by selecting the stars in the top right corner of the correspondence.

Best regards,
Dayanna
Amazon Web Services

===============================================================

To share your experience or contact us again about this case, please return to the AWS Support Center using the following URL: https://console.aws.amazon.com/support/home#/case/?displayId=172961648100490&language=en

Note, this e-mail was sent from an address that cannot accept incoming e-mails. To respond to this case, please follow the link above to respond from your AWS Support Center.

===============================================================

Don’t miss messages from AWS Support when you need help! Update your contact information:
https://console.aws.amazon.com/billing/home#/account

If you receive an error message when visiting the contact information page, visit:
https://repost.aws/knowledge-center/iam-billing-access/

AWS Support:
https://repost.aws/knowledge-center/

AWS Documentation:
https://docs.aws.amazon.com/

AWS Cost Management:
https://aws.amazon.com/aws-cost-management/

AWS Training:
http://aws.amazon.com/training/

AWS Managed Services:
https://aws.amazon.com/managed-services/

Amazon Web Services, Inc. is a subsidiary of Amazon.com, Inc. Amazon.com is a registered trademark of Amazon.com.

This message was produced and distributed by Amazon Web Services, Inc. or its affiliates 410 Terry Ave. North, Seattle, WA 98109.

© [2024], Amazon Web Services, Inc. or its affiliates. All rights reserved. Read our Privacy Notice.