Amazon S3 Ransomware Defenses

Cybr Christophe Limpalair
Fog Security Jason Kao

Defense Techniques

Prevention

IAM restrictions:

  • Bucket Policies
  • RCPs & SCPs
  • IAM least privilege

Data Deletion Prevention:

  • Object Lock
  • Versioning

Refer to footnote [1] for examples and more info

Detection

Monitor and Alerting:

  • Monitor S3 activity via CloudTrail (including data events)
  • Create CloudWatch alarms
  • Set up Lambda functions for automated response

Audit:

  • Monitor KMS Encryption Keys
  • Perform regular security audits

Recovery

Backup data:

  • Cross-account with AWS Backup
  • Isolate via IAM and separate encryption keys

Simulations:

  • Simulate ransomware attacks
  • Test recovery procedures regularly

Testing & Tools

Stratus Red Team

Cloud attack simulation framework

Tool #2
  • Launch simulated cloud attacks
  • Includes multiple S3 ransomware simulations

Website: https://stratus-red-team.cloud

Finders Keepers

KMS key resource finder

Tool #3
  • Finds resources encrypted with a specific KMS key
  • Helps determine the blast radius of compromised keys

Website: https://github.com/FogSecurity/finders-keypers

› python3 finders_keypers.py --keyarn \
  arn:aws:kms:us-east-1:123412341234:key/aaaaaaaa-aaaa-1111-aaaa-aaaa1111aaaa

Total Number of Resources encrypted with KMS Key Provided: 5
example-bucket-finderskeypers
vol-12341234123412345
vol-43214321432154321
arn:aws:dynamodb:us-east-1:123412341234:table/my-first-dynamodb-table
arn:aws:ssm:us-east-1:123412341234:parameter/sample-parameter

YES3 Scanner

S3 Security Scanner

Tool #4
  • Looks for potential S3 security issues related to access, encryption, and ransomware

Website: https://github.com/FogSecurity/yes3-scanner

› python3 yes3.py --profile <name> --region <region>

YES3 SCANNER RESULTS
AWS Account: 123412341234
Account Settings
Account Block Public Access Overall Status: OK
Bucket Summary
Total Buckets: 14
Buckets potentially public: 3
fog-pub-sample-bucket | Public Method: ['acl']
fog-pub-sample | Public Method: ['policy', 'acl']

Demo these tools with Cybr’s 1-Click Deploy Hands-On Labs

Encrypting S3 Data with SSE-KMS - AWS Console Learn how to encrypt S3 data with SSE-KMS using the AWS ConsoleS3 Ransomware Through Client-Side Encryption Test S3 ransomware through client-side encryption in a safe environmentS3 Ransomware through batch file deletion Test S3 ransomware through batch file deletion in a safe environmentSecuring S3 Against Ransomware with YES3 Use the YES3 scanning tool to discover S3 issues that could lead to ransomware

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Preview prompt
More cheat sheets