Published on: 2025-02-17

Intelligence Report: whoAMI attack could allow remote code execution within AWS account – Securityaffairs.com

1. BLUF (Bottom Line Up Front)

A newly identified cyberattack technique, termed “whoAMI,” allows threat actors to execute arbitrary code within Amazon Web Services (AWS) accounts by leveraging vulnerabilities in Amazon Machine Images (AMIs). This attack could potentially impact thousands of AWS accounts, posing significant risks to organizations utilizing these services. Immediate action is recommended to mitigate these vulnerabilities by adopting enhanced security measures and verifying AMI sources.

2. Detailed Analysis

The following structured analytic techniques have been applied for this analysis:

Analysis of Competing Hypotheses (ACH)

The primary hypothesis is that threat actors exploit the AMI search process to introduce malicious images, bypassing standard verification processes. Alternative hypotheses include insider threats or misconfigurations within AWS environments.

SWOT Analysis

Strengths: AWS’s robust security infrastructure and community AMI catalog provide a strong foundation for cloud services.

Weaknesses: The AMI search process vulnerability allows for the introduction of malicious images.

Opportunities: Enhancing AMI verification processes and user education can reduce attack vectors.

Threats: Increased sophistication of cyber threats targeting cloud infrastructures.

Indicators Development

Indicators of emerging threats include unusual AMI creation patterns, discrepancies in AMI metadata, and unauthorized access attempts linked to newly deployed instances.

3. Implications and Strategic Risks

The whoAMI attack presents significant risks to national security and economic interests by potentially compromising sensitive data stored in AWS environments. The attack could disrupt regional stability by targeting critical infrastructure sectors reliant on cloud services. Organizations must assess their cloud security postures to mitigate these risks.

4. Recommendations and Outlook

Recommendations:

• Implement stringent AMI verification processes and ensure AMI sources are verified and trusted.
• Adopt AWS’s new security guardrails and encourage the use of owner attribute filters during AMI searches.
• Enhance user education on the risks associated with community AMIs and the importance of security best practices.

Outlook:

Best-case scenario: Rapid adoption of new security measures significantly reduces the risk of whoAMI attacks.

Worst-case scenario: Failure to address vulnerabilities leads to widespread exploitation, resulting in substantial data breaches and financial losses.

Most likely outcome: Gradual improvement in security practices mitigates risks, but isolated incidents may continue as threat actors adapt.

5. Key Individuals and Entities

The report mentions Datadog Security Lab as the entity responsible for identifying the whoAMI attack. The advisory was initially shared by Datadog, highlighting the collaborative efforts in addressing this cybersecurity threat.