Vulnerabilities in Cloud Logging Services: Attack Techniques and Defense Strategies

Cloud logging services under attack: how attackers evade defenses

Cloud logging services, fundamental for visibility and security of cloud resources, are becoming primary targets for attackers. These services, such as AWS CloudTrail and Google Cloud Logging, offer a comprehensive view of actions performed within cloud environments, making them essential for security monitoring. However, this centrality also makes them attractive targets for those seeking to remain undetected.

Attackers can exploit these vulnerabilities to create weak points, evade detection, and, in some cases, establish continuous visibility within the victim's environment. Attack techniques against cloud logging services primarily fall into two categories: defense evasion and continuous visibility.

Defense evasion: how attackers remain undetected

Defense evasion is one of the main techniques used by attackers to carry out attacks without being discovered. This can involve modifying resources within the logging service. For example, an attacker might disable the logging mechanism itself, interrupting the log flow and creating a visibility gap for organizations.

In AWS, an attacker with the cloudtrail:StopLogging permissions can invoke the stop-logging API for a specific trail. Once this API is executed, logs will no longer be written for that trail in the S3 bucket, creating an immediate visibility gap. In Google Cloud, the equivalent action is disabling the sink. An attacker with the logging.sinks.update permissions can set the sink's disabled field to true to stop log writing.

Continuous visibility: how attackers maintain access

Continuous visibility is another technique used by attackers to maintain access to the victim's environment. This can involve transferring logs to their own account, establishing continuous visibility on the victim's environment. Attackers can use various techniques to achieve this, including disabling the logging mechanism, deleting the log storage destination, and deleting the log router.

Attack techniques: how aggressors disable logging

Attackers have a wide range of techniques to disable, alter, or delete logs, compromising the security integrity of the entire cloud environment. Among the most common techniques are:

• Interrupting logging
• Deleting the log storage destination
• Compromising logging through an encryption key controlled by the attacker
• Poisoning logs

Interrupting logging: the most direct method

The most direct method to suspend the log flow is to disable the logging mechanism itself. A wide range of security products depend on these log data to function. By disabling logs, an attacker can effectively blind the defense systems, compromising the security integrity of the entire cloud environment.

In AWS, an attacker with the s3:DeleteBucket permissions can use the delete-bucket API to delete the S3 bucket; this action also requires the s3:DeleteObject permission to empty the bucket. A few minutes after the action, the configuration of the associated CloudTrail trail will indicate this deletion. In Google Cloud, an attacker with the logging.buckets.delete permissions can delete the log bucket. In the case of a log bucket, deletion is not immediate. Once the deletion command is issued, the log bucket enters a DELETE_REQUESTED state, remaining in this state for seven days.

Protecting log buckets in Google Cloud

Google Cloud offers a[mechanism](https://docs.cloud.google.com/logging/docs/buckets#locking-logs-buckets) to protect against the deletion of log buckets, providing the ability to lock the log bucket. Once a bucket is locked, its retention policy becomes permanent and irreversible, meaning the bucket cannot be deleted by any user until each log entry within it has met the specified retention period.

Other defense evasion techniques

Another defense evasion tactic involves deleting the log routing resource, such as an AWS trail or a Google Cloud sink. Once deleted, new logs will no longer be written to the designated destination. An attacker can delete a log router using the AWS delete-trail API or the Google Cloud method google.logging.v2.AdminService.DeleteSink.

Advanced use cases for log compromise

Attackers are developing increasingly sophisticated techniques to exploit cloud logging services. Some examples include:

• Manipulating log timestamps to create false alibis
• Injecting false log events to distract analysts
• Creating shadow logs that appear legitimate but contain falsified data
• Exploiting differences between logging services of different cloud providers

These techniques demonstrate the need for security solutions that go beyond simple log monitoring, implementing mechanisms for validating and verifying data integrity.

Best practices for protecting logging services

To effectively protect cloud logging services, organizations should adopt the following best practices:

• Implement the principle of least privilege for access to logging services
• Use centrally managed encryption keys with access control
• Implement anomaly detection solutions for log activities

The importance of training and awareness

An often overlooked aspect in protecting logging services is staff training. Administrators must be aware:

• Of the most common attack techniques against these services
• Of the importance of keeping logging services up to date

Specific training programs, such as those offered by the Unit 42 Incident Response team, can provide the necessary skills to effectively manage and protect logging services.

Regulatory compliance considerations

Compromising logging services can have serious implications for regulatory compliance. Many regulations, including:

• GDPR
• HIPAA
• PCI DSS
• ISO 27001

Require the retention and accessibility of security logs for certain periods of time. Compromising logs can therefore lead to:

• Financial penalties
• Public disclosure requirements
• Loss of certifications
• Operational restrictions

Organizations must therefore consider the protection of logging services as an integral part of their regulatory compliance program.

Support tools and services

There are numerous tools and services available to help organizations protect their cloud logging services. Among these:

• Security Information and Event Management (SIEM) solutions
• Security Orchestration, Automation, and Response (SOAR) platforms
• Cloud security assessment services
• Log backup and recovery solutions

These tools can help monitor, protect, and restore logging services in case of compromise. It is essential to select solutions that are compatible with the specific logging services used by the organization.