Feb 17, 2021 17:00:00

Salesforce releases AWS account attack tool but removes it in haste

Salesforce , a major customer management system, has released a tool ' Endgame ' that can attack AWS accounts in its GitHub repository. The Endgame repository has already been deleted, but it can be viewed in the Internet Archive at the time of writing the article.

GitHub --salesforce / endgame: An AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account --or share the resources with the entire internet
https://web.archive.org/web/20210216153239/https://github.com/salesforce/endgame

Endgame is a

penetration testing tool for AWS, developed by Salesforce engineer Kinnaird McQuade . With Endgame, you can abuse the resources of one AWS account with another AWS account or publish it on the Internet. Click the image below to see a GIF animation of how you can easily hack AWS resources using Endgame.

As a mechanism, it seems that it is abusing

a ' resource-based policy ' that can set permissions for each AWS resource such as S3 and Lambda, and searches for unnecessary permissions given to resources in a roundabout manner and attacks I am.

Managing permissions for cloud services is so complex that human error can always occur, assigning extra permissions. AWS offers an ' AWS IAM Access Analyzer ' that can detect such vulnerabilities, but McQuade points out that the AWS IAM Access Analyzer is not fully functional. The table below shows that AWS IAM Access Analyzer only supports 7 of the resources that Endgame is attacking.

Endgame is not for hacking, it was developed to ask AWS to improve permission management in addition to raising the security awareness of AWS users and developers. McQuade lists 'improvements in AWS IAM Access Analyzer' and 'increase in the number of

service control policies that can be set' as recommendations to AWS in the Endgame description column.

In addition, Endgame was published in Salesforce's GitHub repository, but at the time of article creation, it can no longer be viewed from the outside.

Page not found · GitHub · GitHub
https://github.com/salesforce/endgame

Endgame was also published in the developer McQuade's own GitHub repository, but at the time of writing the article, it was inaccessible like the Salesforce repository, and it seems that some measures were taken. Under these circumstances, the repositories that copied Endgame were scattered, but they have been deleted.

Page not found · GitHub · GitHub
https://github.com/kmcquade/endgame