<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> </head> <body> <div dir="ltr"> <div></div> <div data-ogsc="" style=""> <div> <div dir="ltr" style="text-align: left;"></div> </div> <div>Thanks Colleen. Sorry for the rushed feeling. If you want to take more time, please use tomorrow to do your testing. </div> <div dir="ltr" style="text-align: left;"><br> </div> <div dir="ltr" style="text-align: left;">Thank you for all you do!!!!</div> <div dir="ltr" style="text-align: left;"><span style="font-size: 1rem;"><br> </span></div> <div><span style="font-size: 1rem;">Get </span><a href="https://aka.ms/o0ukef" data-ogsc="" style="font-size: 1rem;">Outlook for iOS</a></div> </div> </div> <hr style="display:inline-block;width:98%" tabindex="-1"> <div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Feiglstok, Colleen M [US] (MS) <Colleen.Feiglstok@ngc.com><br> <b>Sent:</b> Thursday, December 19, 2019 4:35:15 PM<br> <b>To:</b> Lastrilla, Jet <jlastrilla@mitre.org>; BRYAN, AUSTEN R Capt USAF AFMC AFLCMC/HNCP <austen.bryan.1@us.af.mil>; DIROCCO, ROGER E GG-13 USAF AFMC ESC/AFLCMC/HNCP <roger.dirocco.4@us.af.mil>; Kevin O'Donnell <kodonnel@redhat.com>; platformONE@redhat.com <platformONE@redhat.com>; Tim Gast <tg@braingu.com>; Bubb, Mike <mbubb@mitre.org>; TRAMBLE, ELIJAH Q Capt USAF AFMC AFLCMC/HNC <elijah.tramble.1@us.af.mil>; tj.zimmerman@braingu.com <tj.zimmerman@braingu.com>; LOPEZDEURALDE, RICHARD A Lt Col USAF AFMC AFLCMC/HNCP <richard.lopezdeuralde@us.af.mil>; Blade, Eric D [US] (MS) <Eric.Blade@ngc.com>; RAMIREZ, JOSE A CTR USAF AFMC AFLCMC/HNCP <jose.ramirez.50.ctr@us.af.mil>; Leonard, Michael C. <leonardm@mitre.org>; REINHARDT, MELISSA A GG-13 USAF AFMC AFLCMC/HNCP <melissa.reinhardt.2@us.af.mil>; Taylor Biggs <taylor@redhat.com>; Miller, Timothy J. <tmiller@mitre.org>; CRISP, JOSHUA M GS-09 USAF AFMC AFLCMC/HNCP <joshua.crisp.2@us.af.mil>; BOGUE, STEVEN E CTR USAF AFMC AFLCMC/HNCP <steven.bogue.1.ctr@us.af.mil>; Wilcox, John R. (San Antonio, TX) [US] (MS) <John.R.Wilcox@ngc.com><br> <b>Subject:</b> [EXT] Platform1 SAR</font> <div> </div> </div> <style>  </style> <div lang="EN-US" link="#0563C1" vlink="#954F72"> <div class="x_WordSection1"> <p class="x_MsoNormal">All,</p> <p class="x_MsoNormal"> </p> <p class="x_MsoNormal">The SAR and raw results from the new security testing will be sent through NGSafe in a few moments.</p> <p class="x_MsoNormal"> </p> <p class="x_MsoNormal">As usual, I felt very rushed with the testing, and feel like I have not done as thorough of a job as required. I was unable to log into the Web UIs, as no one from the Platform1 team gave me the account information. I had issues with Nessus, so the CVE’s were found through OSCAP this time.</p> <p class="x_MsoNormal"> </p> <p class="x_MsoNormal" style="margin-right:0in; margin-bottom:2.0pt; margin-left:0in; text-autospace:none"> A lot is the same as the last report, but please read through it, because there is some new information. I had to test as ec2-user again, which is another big issue that needs to be resolved ASAP. The more I use it and find out how it is being used, the more extremely concerned I am. It has multiple keys throughout the platform located in the .ssh directory, one of which is world readable. On some hosts, a real user is using the ec2-user account to create accounts, groups, and pull docker files. The account is non-attributable, so we have no way of knowing who is doing this. Someone could do serious damage with no consequence. I understand that the ec2-user is needed for standing up an ec2-image, but <span style="color:black">this account should only be used for implementing IAC, so that the changes implemented by ec2-user are codified. If manual admin is required, that IAC should provision the appropriate attributable accounts, and those accounts should be used from then on.</span> In my opinion, this is a critical finding and needs to be addressed ASAP. </p> <p class="x_MsoNormal"> </p> <p class="x_MsoNormal">I will be available during the day tomorrow for any questions.</p> <p class="x_MsoNormal"> </p> <p class="x_MsoNormal">Thanks</p> <p class="x_MsoNormal">Colleen</p> <p class="x_MsoNormal"> </p> </div> </div> </body> </html>