Ransomware attacks have become increasingly sophisticated in targeting various cloud services, including AWS S3 buckets. One emerging threat involves the use of AWS S3's Server-Side Encryption with Customer Provided Keys (SSE-C).
Understanding how ransomware exploits AWS S3 with SSE-C encryption is crucial not only to protect sensitive data but also to address the alarming rise of sophisticated attacks like Codefinger, which expose gaps in cloud security practices. The stakes are high—without action, organizations risk losing access to critical data and paying steep ransoms.
This blog will delve into how ransomware attacks exploit SSE-C encryption, the technical details behind these attacks, insights from the recent Codefinger ransomware attack, and how Varonis can help secure your sensitive data from these threats.
How ransomware exploits AWS S3 with SSE-C
Ransomware attacks on AWS S3 buckets typically begin with attackers gaining access to compromised AWS credentials. Once inside, they leverage SSE-C encryption to encrypt the data stored in S3 buckets.
SSE-C allows users to manage their own encryption keys, providing an additional layer of security. However, this feature can be exploited by attackers who use their own encryption keys to lock the data, making it inaccessible to the legitimate owners.
Here's a step-by-step breakdown of how these attacks unfold:
- Credential compromise: Attackers obtain AWS credentials through phishing, brute force attacks, or exploiting vulnerabilities in applications.
- Access to S3 Buckets: With the compromised credentials, attackers gain access to the target's S3 buckets.
- Encryption with SSE-C: Attackers use SSE-C to encrypt the data with their own AES-256 keys. Since these keys are not stored in AWS, only the attackers can decrypt the data.
- Ransom demand: The attackers then demand a ransom from the victim in exchange for the decryption keys.
Codefinger: A new era of ransomware
The Codefinger ransomware attack targeted key credentials for storage buckets on Amazon S3, exploiting poor key management practices. It represents a new stage in the evolution of ransomware. Attackers used compromised AWS keys to encrypt data stored in S3 buckets and demanded a ransom for the decryption keys.
Several aspects of the Codefinger attack make it stand out:
- Attack vector: Unlike traditional ransomware attacks that involve planting malicious code, Codefinger leveraged access credentials to encrypt data.
- Changing role of backups: Off-site backups might not protect organizations if the backups are based on S3 buckets that have already been encrypted.
Read our full breakdown on the Codefinger attack on our blog.
The technical lowdown: Unpacking SSE-C Encryption
To understand the functionality and risks associated with SSE-C encryption, it’s important to examine its key processes and how they contribute to both security and potential vulnerabilities:
- Client-side key management: Users generate and manage their own encryption keys. This means that the keys are not stored in AWS, but rather managed by the user. This provides an additional layer of security, as the keys are not accessible through AWS's infrastructure.
- Data encryption process: When data is uploaded to an S3 bucket, AWS uses the provided key to encrypt the data using AES-256 encryption. AES-256 is a symmetric encryption algorithm that is widely regarded for its security and efficiency. The encryption process involves converting plaintext data into ciphertext using the encryption key, ensuring that the data cannot be read without the corresponding decryption key.
- Data decryption process: To retrieve the data, the same key must be provided to decrypt it. The decryption process involves converting the ciphertext back into plaintext using the decryption key. Since the keys are managed by the user, AWS does not store or manage these keys, making it crucial for users to securely manage and store their encryption keys.
While SSE-C provides robust security by allowing users to control their encryption keys, it also introduces risks if those keys fall into the wrong hands.
If an attacker gains access to the encryption keys, they can encrypt the data with their own keys, effectively locking out the legitimate owners and making the data inaccessible without the attacker's decryption keys.
Shielding your S3: Best practices for security
In addition to leveraging Varonis, here are some best practices to secure your AWS S3 buckets:
- Use multifactor authentication (MFA): Enable MFA for all AWS accounts to add an extra layer of security
- Implement least privilege access: Grant the minimum permissions necessary for users to perform the tasks needed for their role
- Regularly rotate keys: Regularly rotate encryption keys and AWS credentials to minimize the risk of compromise
- Audit and monitor: Continuously audit and monitor S3 bucket activities to detect and respond to suspicious behavior
For more tips on securing your AWS environment, read our blog on preventing S3 bucket namesquatting.
Defending against ransomware
Varonis offers a comprehensive solution to detect and prevent ransomware attacks on AWS S3 buckets. With complex identity management, permissions, and access controls, it’s extremely difficult to secure AWS resources at scale.
Varonis gives you a comprehensive solution to protect AWS identity, storage, databases, warehouses, compute resources, and data from insider threats, cyberattacks, and exposure. Here’s how we can help:
- Monitoring and alerting: Varonis continuously monitors AWS S3 bucket activities to identify unusual access patterns and potential threats. If an unfamiliar IP address attempts to access your S3 buckets, Varonis alerts you immediately
- Behavioral analytics: By analyzing user behavior, Varonis can detect anomalies that may indicate a ransomware attack. This includes unusual file access patterns, such as a sudden spike in read/write operations
- Automated response: Varonis can automatically respond to detected threats by blocking suspicious activities and isolating affected resources to prevent further damage
- Detailed forensics: In the event of an attack, Varonis provides detailed forensic analysis to help you understand the scope of the breach and take corrective actions If your organization has suffered a breach, please contact the Varonis IR Team for immediate assistance.
Stay ahead of the threat
Ransomware attacks on AWS S3 buckets using SSE-C encryption are a growing threat.
By understanding the mechanics of these attacks and implementing robust security measures, you can protect your data from being held hostage. Varonis provides the tools and expertise needed to detect, prevent, and respond to these threats, ensuring your cloud environment remains secure.
Find the Varonis Data Security Platform on the AWS Marketplace today.
