REVEALING THE INNER STRUCTURE OF AWS SESSION TOKENS

Summary from the TLDR InfoSec newsletter

Tal Be'ery, co-founder of ZenGo, performed a first ever analysis of AWS Session Tokens to uncover the components that make up a session token. The goal of this research was to discover if the tokens contained sensitive information and if tokens could be edited for forgery as well as other attack vectors. The research found that session tokens are base64 encoded protobufs that store most of the interesting information in a userEncryptedData field. The researchers found that they could forge tokens however AWS rejected forged tokens. The post includes more details about the reversing process and protobuf fields.