“The robot seems to have crashed”
Three days abroad, one routine notification email, and a trail that led me to a backdoor in a region I had never used.
(Illustrative scenario, not a real incident)
It was a family trip abroad.
One morning my daughter ran over with her phone:“Dad, I think your robot crashed.”I laughed and said the hotel Wi-Fi was probably bad.
Then the website started to slow down.Then I couldn't even log in to the admin panel.
For three days of that trip,I lived in a café.My wife took the kids out to see the sights;I sat by the window, reading logs line by line.
What led me to the truthwas not some clever tool.It was a routine notification email, as plain as they come.
Following the steps in that email,I listed every region in the cloud, one by one.We only use one region,and that one was empty.But a region we had never touchedheld two programs.
It did just one thing:whenever someone knocked, it created a new administrator,handed over the keys with both hands,and granted itself permission to send email.
I used to think hackers went after big companies.Later I learnedthey don't care who you are,only what you can be turned into.
Laozi said: “What is at rest is easy to hold; what has not yet shown signs is easy to plan for.”Before there are any signs is when it is easiest to defend.
This time we were lucky,not well defended.
Even if you only use one region, list every region. A place you have never been should hold nothing at all.
AWS business users, beware: patrol the regions you never use, on a regular schedule. Attackers may plant malicious code there and use it to run against your remote services.