Intruder.io, a London, England-based cybersecurity firm, conducted a self-hack using a DNS rebinding attack, enabling them to extract low-privileged AWS credentials.
Cybersecurity firm Intruder has published blog posts explaining how they got hacked by successfully exploiting a DNS rebinding vulnerability that allowed them to extract low-privileged AWS credentials.
They discovered a DNS rebinding vulnerability in their platform after hacking themselves.
DNS rebinding exploitation is a persistent threat.
In 2018, Hackread.com reported cybersecurity firm Armis' research, which revealed that over half a billion IoT devices were found vulnerable to DNS rebinding, most used by enterprises.
Intruder's penetration tester Daniel Thatcher noted that while the vulnerability's impact was limited due to the prevailing security measures, the exploit indicates the feasibility of DNS rebinding attacks in time-constrained scenarios like penetration testing.
Further probing helped him achieve reliable split-second DNS rebinding in Chrome, Edge, and Safari browsers, which was surprising, specifically when IPv6 was available.
The vulnerability was discovered in Intruder's screenshot workers, which capture snapshots of customer websites.
Since these follow HTTP redirects before taking screenshots and lack restrictions on accessing the internal EC2 metadata service, it became possible to expose AWS credentials for available roles.
Leveraging this vulnerability, a public web server was set up to redirect to the EC2 metadata service endpoint.
That's when it occurred to him that DNS rebinding could potentially enable them to bypass restrictions on major browsers and private network requests.
In browsers, traditional DNS rebinding allows attackers to access internal network services by tricking victims into loading a malicious website.
The attack relies on the browser first communicating with the public server and loading the attacker's page.
The attacker's server then blocks traffic, forcing the browser to fall back to the target server, allowing JavaScript on the attacker's page to send requests to the target server with the same origin.
The extracted credentials had minimal permissions and limited potential damage, but service disruption was possible.
They could prevent further digging into AWS and possible harm by limiting access to other HTTP services.
The screenshot worker vulnerability was patched with IMDSv2 implementation.
Conducting ethical hacking or penetration testing, wherein you intentionally hack into your own network to identify security vulnerabilities, is a proactive and strategic approach to bolstering cybersecurity defences.
By simulating real-world attack scenarios, organizations can gain valuable insights into potential weaknesses that could be exploited by malicious actors.
Simply put, hacking oneself provides an opportunity to address vulnerabilities beforehand, ensuring a more secure network environment before adversaries have a chance to exploit identified vulnerabilities.
This Cyber News was published on www.hackread.com. Publication date: Thu, 07 Dec 2023 14:14:10 +0000