Malicious Amazon Machine Images (AMIs)

Introduction

As organizations move their infrastructure, data and workload to the cloud, it is important to ensure that the Amazon Machine Images (AMI) from the AWS Marketplace used in creating the EC2 instance are safe. 

This article will explain AMIs in detail and will explore what it is, how it works, malicious AMIs and how they can be prevented.

Learn Cloud Security

Get hands-on experience with cloud service provider security, cloud penetration testing, cloud security architecture and management, and more.

Start Learning

What are AMIs?

An AMI is used to create virtual servers on an AWS environment. An AMI provides the information required to launch an Amazon Elastic Compute Cloud (EC2) instance. A single AMI can be used to launch multiple instances with the same configuration.

An AMI includes the following:

• A template for the root volume of the instance (typically an operating system, e.g., Amazon Linux, Ubuntu etc., an application server and applications).
• Launch permissions that control which AWS accounts can use the AMI to launch instances. AMI owners determine the availability of an AMI via launch permissions. A block device mapping that specifies the volumes to attach to the instance when it's launched.

There are three (3) types of AMIs:

• Public AMIs: These are AMIs made available for free by the developer.
• Private AMIs: These are private AMIs that can only be used by EC2 users granted access to them by the developer.
• Paid AMIs: These are private AMIs available for purchase from the developer in the AWS Marketplace.

Note: Amazon can’t vouch for the integrity or security of AMIs shared by other Amazon EC2 users.

What are malicious AMIs?

Malicious AMIs are community AMIs embedded with malicious codes, e.g., crypto miners, ransomware and so on. They are distributed via the AWS Marketplace to unsuspecting users who are running EC2 instances based on the community AMI.

In 2020, researchers at Mitiga found an active crypto miner on an EC2 instance during the assessment of an organization’s AWS environment. A review of the AMI revealed that the crypto miner was embedded in the AMI used by the organization.

The developer who published the malicious AMI on the AWS marketplace designed the crypto miner to carry out a form of financial fraud.

Malicious AMIs are not a new phenomenon. In 2018, Summit Route investigated an instance where an Ubuntu AMI had a Monero miner malware embedded in the AMI. The malicious code attempted to exploit vulnerabilities associated with Hadoop, Redis and ActiveMQ on the server. Subsequent to this, a CVE for malicious AMIs was created in 2018. This is CVE-2018-15869 which specifies that when an –owners flag is not specified when describing AMI images via the AWS Command Line Interface (CLI), one can end with a potentially malicious AMI.

Learn Cloud Security

Get hands-on experience with cloud service provider security, cloud penetration testing, cloud security architecture and management, and more.

Start Learning

How to mitigate the risks of malicious AMIs

There are a number of moves users can make to lower the risk of malicious AMIs.

1. Ensure that images are gotten from trusted and verified sources or vendors, e.g., Amazon.
2. Review EC2 instances running on your environment to ensure you can verify the type of AMI (i.e., private or public).
3. Review the AMIs to ensure that they do not come with pre-installed credentials such as public SSH keys or default usernames and passwords, which could allow unwanted third-party access to your running EC2 instances or preconfigured remote logging hosts.
4. Identify and disable unauthorized/unrecognized public SSH keys from your instances.
5. Create an image from your existing IT infrastructure or a base operating system you trust and use that as your own AMI.

Sources

Amazon Machine Images (AMIs), AWS

CVE-2018-15869, National Vulnerability Database

CVE-2018-15869, Common Vulnerabilities and Exposure

How We Build Code at Netflix, Netflix

Security Advisory, Mitiga

How to share and use Public AMIs in a secure manner, AWS