InfoSecBulletin Cybersecurity for mankind
Security researchers disclosed a cirtical flaw in Amazon Elastic Container Service (ECS) that enables harmful containers to steal AWS credentials from other tasks on the same EC2 instance.
The attack, dubbed “ECScape,” exploits an undocumented internal protocol to impersonate the ECS agent and harvest privileged credentials without requiring container breakout.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Vulnerability Overview:
The ECScape attack takes advantage of a basic mistake in how ECS handles IAM credentials on shared EC2 instances.
Running multiple containers with varying privilege levels on the same host can lead to security risks. A low-privileged container could exploit the ECS Agent Communication Service (ACS) protocol to access credentials from higher-privileged tasks.
The vulnerability was discovered by security researcher Naor Haziz during development of an eBPF-based monitoring tool.
While investigating how ECS tasks retrieve metadata, Haziz observed that the ECS agent receives task credentials via a WebSocket connection to AWS’s control plane with a suspicious “sendCredentials=true” parameter.
AWS advises ECS users to take protective measures. Key strategies include not deploying high-privilege tasks with untrusted containers on shared instances, using dedicated hosts for critical services, or switching to AWS Fargate for isolated task environments.
Additional protections involve restricting IMDS access through the ECS_AWSVPC_BLOCK_IMDS setting, enforcing IMDSv2, and implementing least-privilege IAM policies.
Organizations should remove unnecessary Linux capabilities to reduce post-compromise risks.
The disclosure emphasizes key security aspects of container orchestration platforms and the need to grasp isolation boundaries in cloud environments.
While AWS has not indicated plans to modify the underlying architecture, the research emphasizes why Fargate’s micro-VM isolation provides stronger security guarantees for sensitive workloads.
