Int 7: ️ Cloud Forensics S3 - Menganalisis Log Akses AWS S3

Target Skill: Analisis akses log S3 untuk mendeteksi data breach, privilege escalation, dan unauthorized access di cloud
Tools: aws-cli, jq, python3

Langkah Praktikum

cd ~ && mkdir forensics-int7 && cd forensics-int7

AWS S3 adalah service penyimpanan cloud. Ketika terjadi breach, S3 access logs adalah sumber utama investigasi.

# 1. Simulasi S3 Access Log
python3 << 'PYEOF'
import json
from datetime import datetime, timedelta

logs = [
    # (timestamp, IP, user, action, key, status, bytes)
    ("2026-06-18T08:00:00Z", "192.168.1.100", "admin", "GET", "/bucket/report.pdf", 200, 50000),
    ("2026-06-18T08:05:00Z", "203.0.113.5", "iam_user", "ListBucket", "/bucket/", 200, 0),
    ("2026-06-18T08:05:10Z", "203.0.113.5", "iam_user", "GET", "/bucket/backup.sql", 200, 1048576),
    ("2026-06-18T08:05:15Z", "203.0.113.5", "iam_user", "GET", "/bucket/customers.csv", 200, 2097152),
    ("2026-06-18T08:05:20Z", "203.0.113.5", "iam_user", "GET", "/bucket/keys.txt", 200, 1024),
    ("2026-06-18T08:10:00Z", "203.0.113.5", "iam_user", "PUT", "/bucket/exfil-data.zip", 200, 52428800),
    ("2026-06-18T08:15:00Z", "203.0.113.5", "iam_user", "DELETE", "/bucket/access.log", 204, 0),  # ❌ Hapus log!
]

# Analisis
print("=== S3 Access Log Analysis ==*")
print(f"{'Waktu':<25} {'IP':<18} {'Action':<15} {'Key':<25} {'Size':<10}")
print("-"*95)

for ts, ip, user, action, key, status, size in logs:
    suspicious = ""
    if ip == "203.0.113.5" and action in ["GET", "PUT", "DELETE"]:
        suspicious = " ← 🚩"
    print(f"{ts:<25} {ip:<18} {action:<15} {key:<25} {size:<10}{suspicious}")

print("\n📌 Analisis:")
print("  08:05:00 - List bucket (enumeration)")
print("  08:05:10-20 - Download data sensitif (backup.sql, customers.csv, keys.txt)")
print("  08:10:00 - Upload file besar (50MB) - kemungkinan data exfiltration")
print("  08:15:00 - DELETE access.log - menutup jejak!")
PYEOF

# 2. Anomali detection pattern
echo ""
echo "=== Anomaly Detection ==*"
echo "  ✅ Normal: Satu user download 1-2 file per hari"
echo "  🚩 Anomali: 5 file dalam 20 detik + upload besar + delete log"
echo "  🚩 IP tidak dikenal (203.0.113.5) - bukan IP perusahaan"
echo "  🚩 Akses jam kerja? Tidak - akses jam 08:05? Bisa dianggap jam kerja"
echo "  🚩 Tapi download + upload + delete log dalam 10 menit = EXFILTRATION!"

Temuan

Anomali	Detail
IP asing	203.0.113.5 - tidak terdaftar di IP whitelist perusahaan
Akses massal	5 file dalam 20 detik - bukan pola manusia normal
Upload besar	50MB ZIP - kemungkinan kompresi data curian
Delete log	access.log dihapus - indikasi penyembunyian bukti

Refleksi: Cloud forensics berbeda dari tradisional karena tidak ada akses fisik ke disk. Semua bukti ada di log - itulah kenapa S3 server access logging WAJIB diaktifkan. "Cloud shared responsibility model" berarti keamanan data adalah tanggung jawabmu, bukan cloud provider.

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy