What a Cloud Bill Can Reveal

What a Cloud Bill Can Reveal

Speakers: Andre Maccarone, Director, Stroz Friedberg Digital Forensics and Incident Response

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=iYSbfMh-JUo

Overview

In an era where organizations increasingly rely on cloud infrastructure for their core operations, the security implications of these environments are paramount. Andre Maccarone, a Director at Stroz Friedberg Digital Forensics and Incident Response (part of Aon Cyber Solutions), delivered a compelling talk at RSAC 2024, highlighting an often-overlooked yet incredibly powerful resource in cybersecurity: cloud billing data. His presentation, "What a Cloud Bill Can Reveal," posited that the financial footprint left by cloud resource usage offers a unique lens through which to identify existing threats, enhance incident response, and gain critical insights into malicious activity.

Maccarone argues that while traditional digital forensics and incident response (DFIR) heavily relies on logs, these are frequently either not enabled by default, deleted by sophisticated threat actors, or simply overwhelming in volume. Cloud billing data, however, provides an immutable and cost-effective alternative or supplement. It exists inherently within cloud platforms like Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP), and the built-in analysis tools are free to use. By understanding how cloud services are billed and learning to interpret usage anomalies, security teams can uncover crypto mining operations, data exfiltration attempts, command and control infrastructure, and even reconstruct timelines of compromise, making it an indispensable tool in the modern cybersecurity arsenal.

Background

▶ Watch: Cloud billing data: underutilized resource in DFIR (0:00)

The pervasive adoption of cloud computing has revolutionized IT infrastructure, offering unparalleled flexibility, scalability, and cost efficiency. However, this shift also introduces new complexities for security professionals. Traditional DFIR methodologies, often rooted in on-premises environments, struggle with the ephemeral nature and distributed architecture of the cloud. A persistent challenge is the reliance on detailed logging, such as S3 object access logs or VPC flow logs. These logs are frequently not enabled by default, requiring proactive configuration. Even when enabled, a sufficiently privileged or determined threat actor can delete critical logs, effectively sanitizing their tracks and hindering forensic investigations. Furthermore, the sheer volume of data generated by cloud environments can be overwhelming, making it difficult for analysts to pinpoint relevant information during a time-sensitive incident.

Maccarone's talk positions cloud billing data as a crucial countermeasure to these challenges. The underlying principle is that any interaction with cloud resources, whether legitimate or malicious, incurs a cost, thereby leaving a financial footprint. This financial record is robust and difficult for threat actors to manipulate or delete, as it is foundational to the cloud provider's business model. The talk provided a high-level overview of how billing works across the major cloud platforms (AWS, Azure, GCP), which share similar models based on three pillars:

1. Flexibility and Scalability: Users only pay for what they consume, without long-term commitments or hardware investments. The pricing is often tiered, meaning the cost per unit decreases with higher usage, encouraging greater adoption. For example, AWS S3 storage might cost less per gigabyte after the first 50 terabytes.
2. Commitment-Based Discounts: For predictable, long-term resource usage, organizations can commit to one or three-year agreements, securing discounted rates.
3. Transparency and Predictability: Cloud providers offer detailed public breakdowns of service costs, and their platforms include tools for tracking historical and forecasting future expenses.

The actual cost drivers in the cloud are primarily categorized into:

• Compute Services: Such as AWS EC2 instances or Azure Virtual Machines, billed based on computing capacity (CPU, memory) and operational time (per hour, minute, or second).
• Storage Services: Including object storage (Amazon S3) and block storage (AWS EBS, Azure Managed Disk), billed by storage capacity, duration of storage, and data retrieval rates. Faster storage like SSDs typically costs more than HDDs. These are often billed on a per-gigabyte-per-month basis.
• Network and Data Transfer Services: Charges for moving data out of the cloud to the internet, or between different cloud services or regions. Notably, data upload to the cloud is typically free, while data download is charged. Transferring data between cloud services or regions is usually less expensive than transferring it to external internet destinations.
• Other Managed Services: This broad category includes specialized services like machine learning, security tools (e.g., AWS GuardDuty), and database services, each with its own specific billing model.

Understanding these billing mechanics is foundational to interpreting cloud bills for security insights, as anomalies in any of these categories can signal malicious activity.

Key Findings

▶ Watch: Overview of talk agenda and key topics (3:06)

The core revelation of Maccarone's talk is that cloud billing data is a highly effective, yet significantly underutilized, resource for digital forensics and incident response. It acts as an immutable ledger of activity, providing critical insights even when traditional logs are absent, compromised, or overwhelming.

Maccarone identified several key findings regarding the utility of cloud billing data in cybersecurity:

1. Financial Footprint of Malicious Activity: Threat actors, regardless of their intent (e.g., crypto mining, data exfiltration, C2 infrastructure), must consume cloud resources. This consumption invariably generates a financial cost, leaving an identifiable footprint in the billing data.
2. Identification of Existing Threats: By establishing a baseline of normal cloud spending, security teams can detect anomalous costs or usage patterns that indicate ongoing malicious activity. This includes spikes in service costs, usage of services not typically employed by the organization, activity in unusual geographic regions, and the presence of untagged resources in environments with strict tagging policies.
3. Enhanced Incident Understanding: In the aftermath of a breach, billing data can significantly enhance the understanding of an incident's scope and timeline. It can reveal when anomalous service usage began and ended, quantify the amount of data transferred (e.g., exfiltrated), or the number of messages sent by an attacker. This information is invaluable for incident reconstruction, especially when forensic logs are missing or have been tampered with.
4. Cost-Effective Security Addition: Cloud billing data and the associated analysis tools are inherently part of the cloud platforms and are typically free to use. This makes them a highly cost-effective addition to an organization's security suite, requiring no additional investment in tooling. Furthermore, alerts can be configured at no extra cost, providing early warnings of potential compromise.
5. Addressing Logging Gaps: Billing data serves as a critical alternative when ideal logging (e.g., S3 object access logging, VPC Flow Logs) is not enabled, or when threat actors have deleted forensic evidence. It provides a persistent record that is much harder for attackers to erase.
6. Common Threat Actor Services: Maccarone highlighted specific cloud services commonly abused by threat actors, which, when appearing anomalously in billing data, should raise immediate red flags:

• AWS Lambda / Azure Functions: Often used for malicious code execution, particularly in crypto mining operations due to their serverless nature and ability to scale.
• AWS Route 53 / Azure DNS: Used for domain hijacking or registering new domains for command and control (C2) infrastructure.
• AWS CloudFormation / Deployment Manager: Services for bulk deployment of resources. Threat actors leverage these to rapidly provision large numbers of compute instances (e.g., hundreds of thousands of dollars worth of EC2 instances for crypto mining).
• AWS Pinpoint / Azure Communication Services: Communication services (SMS, email) abused for spam campaigns or phishing.
• AWS Systems Manager / Azure Resource Graph: Asset management services that can be used by attackers for reconnaissance to understand the victim's environment, operating systems, and applications.

These findings collectively underscore the transformative potential of integrating cloud billing analysis into a comprehensive cybersecurity strategy, moving beyond traditional log-centric approaches to leverage a robust and often overlooked data source.

Technical Deep Dive

▶ Watch: Fundamental principles of cloud billing models (3:40)

Effective utilization of cloud billing data for security requires a granular understanding of how cloud services are billed and the capabilities of the available cost analysis tools. As noted, the three major cloud providers—AWS, Azure, and GCP—share similar billing philosophies, which primarily revolve around pay-as-you-go models, tiered pricing, and commitment-based discounts.

The foundational elements driving cloud costs include:

• Compute Services: These are the workhorses of the cloud, such as AWS EC2 instances or Azure Virtual Machines. Billing is typically based on the allocated computing capacity (CPU, memory) and the operational time the instance is running. Charges can be hourly, minute-based, or even per-second, depending on the service and configuration. Larger, more powerful instances naturally incur higher costs.
• Storage Services: Services like Amazon S3 (object storage) or AWS EBS and Azure Managed Disks (block storage) are billed based on several factors: the amount of data stored (e.g., per gigabyte per month), the duration the data is stored, and the rate of retrieval (how often data is accessed or downloaded). Faster storage types, such as SSD volumes, are more expensive than traditional HDD volumes.
• Network and Data Transfer Services: These charges arise when data moves across the cloud boundary or between different cloud regions/services. Crucially, data uploading to the cloud is generally free, but downloading data from the cloud to the internet is typically charged at a higher rate. Transferring data between services or regions within the cloud is also charged but usually at a lower per-gigabyte rate than egress to the internet. This distinction is vital for identifying potential data exfiltration.
• Other Managed Services: A vast array of specialized services, from machine learning platforms to security tools and databases, each has its own unique billing structure, often based on usage metrics specific to that service (e.g., number of API calls, data processed, features used).

To analyze this billing data, cloud providers offer powerful, built-in tools:

• AWS Cost Explorer: This is a primary tool for visualizing billing trends. It provides a graphical representation of spending, often color-coded by service, and offers up to 13 months of historical data, along with 12 months of forecasted costs. Key customization options include:
• Date Range Filter: To specify custom timeframes for analysis.
• Granularity: Allows viewing data monthly or daily. Hourly granularity is available but requires an additional cost.
• Group By: Enables grouping costs by various dimensions such as service, region, API operation, or availability zone, facilitating granular analysis.
• Filters: Used to narrow down the view to specific services, regions, or API operations, allowing investigators to "drill down" into anomalous expenses.
• Microsoft Azure Cost Management and Billing: Offers similar functionalities to AWS Cost Explorer, providing graphical representations, historical data (13 months), and forecasted costs, along with comparable filtering and grouping options.
• Google Cloud Platform (GCP) Reports: Also provides visual spending reports with similar filtering capabilities. A notable advantage of GCP is its extensive historical data, often going back to January 2017, offering a much longer baseline for trend analysis.

Identifying Threats with Cost Analysis

Maccarone outlined a systematic approach to identify existing threats using these tools, primarily demonstrated with AWS Cost Explorer:

1. Establish a Baseline: Leverage historical billing data (13 months for AWS/Azure, much more for GCP) to understand "normal" spending patterns. This includes typical services in use, their general cost ranges, and expected usage volumes.
2. Look for Anomalies: Deviations from this baseline are red flags. Specific anomalies to investigate include:

• Spikes in Service Cost and Usage: Unexpected increases in spending for a particular service.
• Charges for Unfamiliar Services: Billing for services not typically used or authorized by the organization.
• Spikes in Minimally Used Regions: Sudden increases in activity or cost in geographic regions where the organization has little to no legitimate presence.
• Activity from Untagged Resources: If the organization enforces a strict tagging policy (e.g., assigning key-value pairs like "project: XYZ" to resources), untagged resources stand out as highly suspicious, as threat actors rarely adhere to such policies.

Case Scenario: Crypto Mining Detection

Maccarone presented a compelling example of detecting crypto mining activity using AWS Cost Explorer:

• Initial Anomaly: A visible spike in EC2 instance spending in January 2024, when grouped by service over the last six months.
• Drill Down (Step 1): The investigator changes the date range to January and sets granularity to daily, then filters the service to "EC2 instance." This reveals a specific spike beginning around January 15th.
• Drill Down (Step 2): Further grouping by instance type reveals a new charge for an instance type identified as G3 4X Large.
• Interpretation: The G prefix in AWS instance types typically denotes a graphics-optimized instance, which possesses powerful GPUs. These instances are highly sought after for computationally intensive tasks like crypto mining.
• Next Steps: With this strong indicator, the security team would then pivot to other evidence sources, such as AWS CloudTrail logs, to identify the user or source IP address that created this G3 4X Large instance on January 15th, and initiate further forensic investigation.

This detailed breakdown demonstrates how cloud billing data, even without direct log access, can provide a powerful starting point for identifying and investigating complex cloud compromises.

Demo / Proof of Concept

▶ Watch: Key services and operations driving cloud costs (5:13)

While the talk didn't feature a live coding demo, Andre Maccarone effectively demonstrated the practical application of cloud billing analysis through two detailed case scenarios. These served as compelling proof-of-concept examples, illustrating how to leverage cloud provider tools to answer critical forensic questions.

Case Scenario 1: Identifying Crypto Mining (Already covered in Technical Deep Dive)

This scenario, detailed previously, showed how a spike in EC2 costs, granularly analyzed by instance type, could reveal the use of graphics-optimized instances (G3 4X Large), a strong indicator of crypto mining. The methodology involved establishing a baseline, identifying an anomaly (cost spike), and then drilling down using filters and grouping options within AWS Cost Explorer to pinpoint the specific service and instance type responsible for the increased expenditure. This effectively demonstrated how cost data could serve as an initial alert and guide subsequent, more traditional forensic investigations.

Case Scenario 2: Quantifying Data Exfiltration

This scenario addressed a common and challenging incident: a client executive team receives an extortion email claiming 500 gigabytes of data exfiltration. The client's IT team identified three publicly accessible S3 buckets (Prod1, Prod2, Prod3), but crucially, object-level logging was not enabled, leaving a critical gap in traditional forensic evidence.

Maccarone demonstrated how AWS Cost Explorer could fill this gap:

1. Filter for Data Transfer Out: The investigator configured AWS Cost Explorer to filter on a 30-day window with daily granularity and specifically targeted the usage type group S3 data transfer internet out. This filter isolates charges related to data moving from S3 buckets to the public internet.
2. Identify Transfer Days: The resulting bar graph clearly showed four distinct days within the 30-day window where data was transferred from S3 to the internet, establishing a timeline of potential exfiltration.
3. Quantify Per-Bucket Exfiltration: To determine which specific S3 buckets were involved and the volume of data from each, the investigator grouped the data by a custom tag named name (assuming the client had implemented this tagging policy for their S3 buckets). This analysis revealed:

• Prod1: Approximately 475 gigabytes of data transfer.
• Prod2: Approximately 10.70 gigabytes of data transfer.
• Prod3: No data transfer observed.

This information is incredibly valuable for the client, especially if Prod3 contained the most sensitive information, indicating it was not compromised, or if the threat actor's claim of 500GB was largely accurate, but the data originated from specific, less sensitive buckets.

1. Distinguish Reconnaissance from Actual Downloads: Maccarone further illustrated how to differentiate between an attacker performing reconnaissance on a bucket and actually downloading files. By grouping the data transfer by API operation, the analysis for one of the identified transfer days (e.g., March 30th) revealed:

• ListBucket API call: Associated with 1.5 gigabytes of data transfer. The ListBucket API call provides metadata about the contents of a bucket but does not actually download the files themselves. This indicates reconnaissance activity.
• GetObject API call: Associated with only 0.01 gigabytes of data transfer on the same day. The GetObject API call is the expected operation for actually downloading files from an S3 bucket.

This distinction is crucial for understanding the attacker's intent and actions. The small GetObject transfer suggests the threat actor might have been testing permissions or sampling files rather than performing a full exfiltration on that specific day, despite significant reconnaissance.

These case scenarios vividly illustrate the power of cloud billing data as a forensic artifact. They demonstrate how, even in the absence of traditional logs, cost analysis can provide precise answers regarding the "who, what, when, and how much" of a cloud incident, enabling organizations to quantify damages, prioritize response efforts, and make informed decisions during a breach.

Defensive Implications

▶ Watch: Introducing AWS Cost Explorer for billing visualization (7:00)

The insights gleaned from "What a Cloud Bill Can Reveal" offer several actionable defensive implications for organizations operating in the cloud:

1. Proactive Monitoring and Alerting: Organizations should implement proactive monitoring of their cloud billing data for anomalies. Cloud providers offer native alerting capabilities that can be configured to trigger notifications for unusual spending spikes, new services being deployed, or activity in atypical regions. This functions similarly to credit card fraud alerts, providing an early warning system for potential compromises.
2. Establish a Baseline of Normal Usage: A critical first step is to establish a clear baseline of normal cloud resource consumption. Security and finance teams should regularly review historical billing data to understand typical service usage, cost ranges, and geographical spending patterns. This baseline is essential for accurately identifying deviations that could signal malicious activity.
3. Enforce Strict Tagging Policies: Implementing and enforcing a robust tagging policy for all cloud resources (e.g., tags for project, owner, environment) is a powerful defensive measure. Threat actors typically do not tag the resources they provision, making untagged resources stand out as immediate red flags in cost reports. This provides an easy filter for identifying suspicious activity.
4. Integrate Cost Analysis into DFIR Playbooks: Cloud billing data should be formally integrated into an organization's digital forensics and incident response playbooks. In situations where traditional logs are unavailable, corrupted, or overwhelming, cost analysis can serve as a primary or supplementary data source to reconstruct timelines, quantify impact, and identify compromised resources.
5. Educate Security and Operations Teams: Training security analysts, cloud engineers, and even financial teams on how to interpret cloud billing reports from a security perspective is crucial. Understanding the financial footprint of various cloud services and recognizing common threat actor TTPs reflected in billing data can significantly enhance an organization's defensive posture.
6. Cross-Reference with Other Security Tools: While powerful, cloud billing data is most effective when cross-referenced with other security tools and logs. An anomaly detected in cost data (e.g., a spike in EC2 usage for graphics-optimized instances) should trigger an immediate investigation using CloudTrail logs, VPC Flow Logs, host-based forensics, and security information and event management (SIEM) systems to confirm and contextualize the malicious activity.
7. Understand Threat Actor Cloud TTPs: Security teams should familiarize themselves with the specific cloud services commonly abused by threat actors for activities like crypto mining (Lambda, Functions, G-series instances), command and control (Route 53, DNS), bulk deployment (CloudFormation, Deployment Manager), spamming (Pinpoint, Communication Services), and reconnaissance (Systems Manager, Resource Graph). Monitoring for anomalous usage of these specific services can provide targeted alerts.

By embracing cloud billing data as a vital security intelligence source, organizations can significantly improve their ability to detect, respond to, and recover from cloud-based cyber incidents, effectively turning a financial record into a powerful forensic artifact.

Key Takeaways

• Cloud billing data is an underutilized, powerful resource for DFIR: It provides an immutable financial record of cloud resource consumption, offering insights into malicious activity even when traditional logs are unavailable or compromised.
• Threat actors leave a financial footprint: Any use of cloud resources, legitimate or malicious, incurs a cost, which can be tracked and analyzed to detect compromise.
• Cloud providers offer free, built-in analysis tools: AWS Cost Explorer, Azure Cost Management, and GCP Reports provide robust capabilities for visualizing, filtering, and grouping billing data to identify anomalies.
• Cost analysis helps identify existing threats and reconstruct incidents: Spikes in service usage, charges for unusual services or regions, and untagged resources can signal ongoing attacks like crypto mining or C2 infrastructure. It also helps quantify data exfiltration and timeline incidents.
• Specific cloud services are commonly abused by attackers: Monitoring for anomalous usage of services like Lambda, Route 53, CloudFormation, Pinpoint, and Systems Manager can provide targeted alerts for various attack types.
• Integrate billing analysis into your security strategy: Proactive monitoring, baseline establishment, strong tagging policies, and cross-referencing with other security tools are crucial for leveraging this data effectively.

About the Speaker(s)

Andre Maccarone is a Director at Stroz Friedberg Digital Forensics and Incident Response, a consulting firm that is part of Aon Cyber Solutions. In his role, Andre leads a wide array of complex cyber investigations, which include tackling challenges such as cyber extortion, wire fraud, intellectual property theft, and incidents involving nation-state actors. His extensive experience in these high-stakes investigations has consistently exposed the critical need for alternative forensic data sources, particularly in cloud environments where traditional logging may be insufficient or compromised. Maccarone advocates for the strategic use of cloud billing data, highlighting its vital role in providing key answers during incident response and enhancing the overall understanding of cloud compromises.