Oops!!... did I reveal something? - Javan Mnjama | BSides Cape Town 2023
Channel: BSides Cape Town
Date: 16/12/2023

Protect your Azure infrastructure from insecure secrets in deployment templates with deployment grazor - an Azure PowerShell script that detects potential misconfigurations and leaked secrets.

Infrastructure as Code (IaC) has been a valuable tool in the arsenal of DevOps teams globally. IaC tools such as Bicep and Terraform promote speed and consistency of deployments. These tools and associated deployment templates are typically leveraged in environments requiring large scale infrastructure.

In Microsoft Azure, deployment templates are static files written in JSON, and used to define the configuration of a deployed resource. Whether a resource is deployed in Azure using the portal, Azure API, or IaC, these deployment templates will be stored in an Azure tenant by default.

When a development pipeline is executed, a new instance of a deployment template is created. For teams adopting agile methodologies, this may result in numerous deployment templates created for a single cloud instance. Consequently, secrets insecurely created by IaC without using secure strings will result in multiple instances of secrets stored in plain text, in such deployment templates.

Deployment templates stored in Azure tenants make for juicy targets for attackers, as they can be a great source of exploitable information. Additionally, the minimum permission required to view deployment templates in Azure is the reader role. Consequently, details such as passwords, access keys, and other secrets are potentially accessible if not secured correctly.

From a detection perspective identifying such potential misconfigurations of deployment templates at scale can be a daunting task. This will require discovering the templates containing leaked secrets and the associated cloud resource. Furthermore, there are limited tooling available to automate the process on detecting leaked secrets post deployment of cloud resources; present tooling mainly focuses on credential scanning within a pipeline. The deployment grazor aims to address this. Deployment grazor identifies potential misconfigurations and discovers leaked secrets within deployment templates.

From an offensive perspective, deployment grazor assists cloud penetration testers to discover sensitive data that could be used for lateral movement.

This session presents deployment grazor, an Azure PowerShell script that should be a companion to defensive and offensive security team operations.

Filmed at BSides Cape Town 2023
AV Sponsored by BITM Cyber Security