Researchers Sound Alarm Over Malicious AWS Community AMIs (Amazon Machine Images)

guest · Aug 22, 2020

Researchers Sound Alarm Over Malicious AWS Community AMIs
Malicious Community Amazon Machine Images are a ripe target for hackers, say researchers
August 21, 2020
https://threatpost.com/malicious-aws-community-amis/158555/

Researchers are sounding the alarm over what they say is a growing threat vector tied to Amazon Web Services and its marketplace of pre-configured virtual servers. The danger, according to researchers with Mitiga, is that threat actors can easily build malware-laced Community Amazon Machine Images (AMI) and make them available to unsuspecting AWS customers.

The threat is not theoretical. On Friday, Mitiga released details of a malicious AMI found in the wild running an infected instance of Windows Server 2008. Researchers said the AMI was removed from a customer’s Amazon Elastic Compute Cloud (EC2) instance earlier this month but is still available within Amazon’s Community AMI marketplace.

The AMI in question was harboring a crypto miner generating Monero coins for unknown hackers on a financial institution’s EC2 for the past five years.

“Vulnerabilities of this sort pose significant risk, as embedded code can potentially include malware, ransomware or other type of attack tools,” said Ofer Maor, chief technology officer and co-founder of Israel-based Mitiga.
Click to expand...

These pre-baked AMI instances can be a godsend for developers looking to save time and money when building out EC2 instances.
For Amazon’s part it does clearly spell out the risks involved with the Community AMIs available on its platform: [...]
Researchers at Mitiga contend Amazon doesn’t go far enough in creating safeguards.

Malicious AMIs are not an entirely new phenomena. In 2018, Summit Route investigated claims of a Community AMI that allegedly also contained the Monero miner malware. The instance was flagged on GitHub by a user.
Click to expand...

Mitiga recommends, “out of an abundance of caution, companies utilizing Community AMIs are recommend to verify, terminate, or seek AMIs from trusted sources for their EC2 instances.”
Click to expand...

Mitiga: Security Advisory: Mitiga Recommends All AWS Customers Running Community AMIs to Verify Them for Malicious Code

In our further assessment, AMIs provided by trusted vendors on the AWS Marketplace do not present any such risk.

True, some Community AMIs can often be cost-conscious solutions, but those savings need to be counter-weighed with the risks posed by binaries whose origin and contents are murky at best, or completely unknown, at worst.
The ease of making malicious AMIs available for public use, in our opinion, warrants the rather dramatic advisory warning we are issuing.
Click to expand...

Log in or Sign up

Researchers Sound Alarm Over Malicious AWS Community AMIs (Amazon Machine Images)

guest Guest

Log in or Sign up

Researchers Sound Alarm Over Malicious AWS Community AMIs (Amazon Machine Images)

guest Guest

Useful Searches