The attacker only needs an AWS account to publish their backdoored AMI to the public Community AMI catalog and strategically choose a name that mimics the AMIs of their targets. The issue was fixed last year on September 19, and on December 1st AWS introduced a new security control named 'Allowed AMIs' allowing customers to create an allow list of trusted AMI providers. To make sure that the AMI is from a trusted source in the AWS marketplace, the search needs to include the 'owners' attribute, otherwise the risk of a whoAMI name confusion attack increases. Security researchers discovered a name confusion attack that allows access to an Amazon Web Services account to anyone that publishes an Amazon Machine Image (AMI) with a specific name. These conditions allow the attackers to insert malicious AMIs in the selection process by naming the resource similarly to a trusted one. Without specifying an an owner, AWS returns all matching AMIs, including the attacker's. If the parameter "most_recent" is set to "true," the victim's system provides the latest AMIs added to the marketplace, which may include a malicious one that has a name similar to a legitimate entry. Amazon advises customers to always specify AMI owners when using the "ec2:DescribeImages" API and enable the 'Allowed AMIs' feature for additional protection. Dubbed "whoAMI," the attack was crafted by DataDog researchers in August 2024, who demonstrated that it's possible for attackers to gain code execution within AWS accounts by exploiting how software projects retrieve AMI IDs. AMIs are virtual machines preconfigured with the necessary software (operating system, applications) used for creating virtual servers, which are called EC2 (Elastic Compute Cloud) instances in the AWS ecosystem. DataDog researchers notified Amazon about the flaw and the company confirmed that internal non-production systems were vulnerable to the whoAMI attack. Basically, all an attacker needs to do is publish an AMI with a name that fits the pattern used by trusted owners, making it easy for users to select it and launch an EC2 instance. The new feature is available via AWS Console → EC2 → Account Attributes → Allowed AMIs. To check if untrusted AMIs are currently in use, enable AWS Audit Mode through 'Allowed AMIs,' and switch to 'Enforcement Mode' to block them. DataDog has also released a scanner to check AWS account for instances created from untrusted AMIs, available in this GitHub repository. Amazon confirmed the vulnerability and pushed a fix in September but the problem persists on the customer side in environments where organizations fail to update the code. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. AWS stated that the vulnerability was not exploited outside of the security researchers' tests, so no customer data was compromised via whoAMI attacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 13 Feb 2025 23:40:03 +0000