ScoutSuite flags Azure disks incorrectly as unencrypted

[Dziubey]

Description
ScoutSuite gives incorrect label for Azure disks. We have discovered that disks are flagged as unencrypted, even though default encryption at rest with platform-managed key is in use.

The disk is encrypted using default option:

ScoutSuite flags the disk and shows the encryption as being disabled:

To Reproduce

1. Create Azure VM (we use Linux)
2. Select default option for encryption type - Encryption at-rest with a platform-managed key
3. Rum ScoutSuite for the subscription where the VM has been deployed

The following CLI parameters have been used:

1. Azure
2. Subscription
3. Service-principal
4. Tenant
5. Client-id
6. Client-secret
7. Skip-aad

The full command executed to generate report:
_python3 scout.py azure --subscription xxxx -service-principal --tenant xxxx --client-id xxxx --client-secret xxxx --skip aad_

Additional context
ScoutSuite version 5.8.1 with default rules and conditions has been used.

[x4v13r64]

Thank you @Dziubey, we'll look into it.

[ramimac]

Based on a quick review the rule still looks "right":

https://github.com/nccgroup/ScoutSuite/blob/master/ScoutSuite/providers/azure/resources/virtualmachines/disks.py
https://github.com/nccgroup/ScoutSuite/blob/master/ScoutSuite/providers/azure/rules/findings/virtual-machines-disk-encryption.json
https://docs.microsoft.com/en-us/rest/api/compute/disks/get

This may be a problem with the difference between SSE and ADE that we need to specify? https://social.msdn.microsoft.com/Forums/en-US/a99a8425-bb00-4a7c-a4e1-02dc2c3e949b/azure-disk-encryption-vs-storage-service-encryption?forum=AzureDiskEncryption

[x4v13r64]

@Dziubey any input would be welcome...

[Dziubey]

Hi @j4v and @ramimac,

I run some tests to verify the above statements, and it seems like ScoutSuite only accepts ADE as a valid encryption type at the moment.
ADE requires additional configuration and work to be performed in order for this type to be enabled. Additionally, it is not available for all VM sizes and operating systems.
I think it would be very helpful if ScoutSuite recognized SSE as a valid encryption type as well.

More information on the above is available here:

1. Windows - https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview
2. Linux - https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-overview

Adding screenshots for reference:

1. SSE with PMK
   
   

1. SSE with CMK
   
   

2. AED
   
   

[Dziubey]

Hi @j4v and @ramimac,

Are there any plans for working on this issue in the near future?

Thanks

[x4v13r64]

Closing, this should now be fixed in develop.

Thanks for your help @Dziubey, feel free to reopen the issue if you find it's not sufficiently resolved.

[tetlika]

hello, is this issue fixed in 5.10.2 ? I still see in report disks which are encrypted by default at rest are marked as unencrypted.

[x4v13r64]

@tetlika it should, if you're still encountering this issue (or similar) please open an issue with detais.

[tetlika]

@j4v thanks for reply, submitted issue https://github.com/nccgroup/ScoutSuite/issues/952