One in Six Amazon S3 Cloud Storage Users Make Sensitive Data Public
March 28, 2013 5:54 AM
Amazon.com, Inc.'s (
cloud storage solution
is once again under the
spotlight of scrutiny
following a report by security firm
. The report by the firm's Senior Security Consultant Will Vandevanter complains that poor security in the cloud may be endangering scores of customers worldwide.
But before you blame Amazon, Mr. Vandevanter makes it clear that it is the businesses that are to blame for the exposure of sensitive customer data.
The service provider Amazon gives its customers the ability to make their data private. But according to the report, approximately one in six bins on Amazon S3 containing sensitive data are made public. It's hard to tell if this is mere incompetence on the part of firms using the service, or what the justification for this dangerous practice might be, but it's clear it's bad news for customers and perhaps unfair bad publicity for the service provider Amazon.
In his post "
There's a Hole in 1,951 Amazon S3 Buckets
", Mr. Vandevanter blogs:
The worst case scenario is that a bucket has been marked as "public", exposes a list of sensitive files, and no access controls have been placed on those files. In situations where the bucket is public, but the files are locked down, sensitive information can still be exposed through the file names themselves, such as the names of customers or how frequently a particular application is backed up.
It should be emphasized that a public bucket is not a risk created by Amazon but rather a misconfiguration caused by the owner of the bucket. And although a file might be listed in a bucket it does not necessarily mean that it can be downloaded. Buckets and objects have their own access control lists (ACLs). Amazon provides information on managing access controls for buckets
. Furthermore, Amazon helps their users by publishing a best practices document on
public access considerations around S3 buckets
. The default configuration of an S3 bucket is private.
While Amazon is not directly to blame, the structure of S3 URLs does exacerbate the problem, according to Mr. Vandevanter. As Amazon expects its users to make use of its robust privacy options when necessary, it gears its public S3 URLs for ease of use. As a result, it's very easy to guess the URL names needed to get access to public records.
Mr. Vandevanter demonstrates how companies are goofing on cloud security.
[Image Source: BrightCove/Rapid7]
The URLs of a bucket are http://s3.amazonaws.com/[bucket_name]/ or http://[bucket_name].s3.amazonaws.com/; private buckets will give an access denied error, while public buckets will show the first 1,000 records.
To guess the bucket names, the researcher used several sources:
Guessing names through a few different dictionaries:
List of Fortune1000 company names with permutations on .com, -backup, -media. For example, walmart becomes walmart, walmart.com, walmart-backup, walmart-media.
List of the top Alexa 100,000 sites with permutations on the TLD and www. For example, walmart.com becomes www.walmart.com, www.walmart.net, walmart.com, and walmart.
Extracting S3 links from the HTTP responses identified by the
. This enabled us to identify s3.amazonaws.com and cloudfront.net addresses “in the wild”. It is very common for a cloudfront.net address to point to an S3 bucket.
Bing Search API
was queried to gather a list of potentials.
The results allowed the discovery of 12,328 unique buckets -- 1,951 of which were public, and 10,377 of which were private. In total he gathered 126 billion files from the open buckets -- including files that appeared to contain private user data.
Robin Wood aka "DigiNinja" has published a
public web tool
that uses similar sources to generate a list of S3 bucket names.
An exasperated Amazon has told Mr. Vandevanter that it "currently putting measures in place to proactively identify misconfigured files and buckets moving forward."
In other words, Amazon realizes that some of its clients are too incompetent to manage its own security settings, so it's trying to take the responsibility on itself to double check their work.
But fixing the settings retroactively may not protect users fully. Mr. Vandevanter writes:
is a great resource to identify previously open buckets. Using a modified version of
I also quickly identified a few hundred buckets that are currently private that previously weren’t.
Looks like the only real solution is to not move to the cloud if you can't handle simple security of the hand-holding variety (which appears to be the case for some firms).
This security "study" is similar to the
hack done by Goatse Security researcher Andrew Auernheimer
. Showcasing the ambiguity of computer security laws, Mr. Vandevanter will likely be praised for his work (and has the security firm backing to protect him if he gets charged/sued) where as Mr. Auernheimer's similar dump of exposed AT&T, Inc. (
) customer data
earned him nearly 4 years in prison
. The message seems to be that if you work for corporate security, feel free to probe away, but if you work as an independent security researcher prepare to be harassed and sent to prison due to the U.S.'s poorly written computer crime laws.
"So if you want to save the planet, feel free to drive your Hummer. Just avoid the drive thru line at McDonalds." -- Michael Asher
Report: CIA Steps Aboard Amazon's Cloud, With Secret Services Contract
March 20, 2013, 5:57 PM
Goatse Security iPad Hacker Gets 41 Months for "Doing Arithmetic"
March 18, 2013, 11:06 PM
Amazon Web Services Failure Leads to Netflix Outage on Christmas Eve
December 27, 2012, 8:00 AM
AT&T's Gaping Hole Exposes 114,000 iPad 3G Buyers' Email Addresses
June 9, 2010, 5:55 PM
Not All the High-Tech Jobs Are in California
August 4, 2016, 8:29 PM
Google's Gleaming Glass HQ Gets Mountain View Snub, LinkedIn Gets the Love
May 7, 2015, 6:58 AM
Tech's Tax Day Fortunate Few: Qualcomm, Xerox, GE, et al. Pay Little or No Taxes
April 15, 2015, 11:30 AM
LinkNYC Terminals to Blanket New York City With Free WiFi, Free Calls, and Ads
November 17, 2014, 6:50 PM
Microsoft is Open-Sourcing Most of .NET, Adding OS X and Linux Support
November 12, 2014, 8:27 PM
Home Depot Lost 53 Million Emails, Blames Windows, Buys Execs New Macs
November 9, 2014, 5:00 PM
Most Popular Articles
Kobo Aura One Vs Kindle Paperwhite
January 10, 2017, 1:21 AM
New at CES 2017 - Changhong 8K Super Slim TV 65ZHQ3R
January 8, 2017, 1:07 AM
OPPO R9 – The Smartphone with Excellent Camera and Long Battery Life
January 12, 2017, 12:01 AM
Debuted at CES: Hisense - A2 Dual Screen Smartphone
January 9, 2017, 7:05 AM
Are you in the market for a private antenna?
January 11, 2017, 12:01 AM
Latest Blog Posts
Jan 16, 2017, 7:58 AM
Jan 15, 2017, 12:32 AM
Here is Some News
Jan 14, 2017, 12:39 AM
News: Improved and New products
Jan 13, 2017, 12:01 AM
News around the world
Jan 12, 2017, 12:01 AM
Rumors and Announcements
Jan 11, 2017, 12:01 AM
This year CES and ridiculous gadgets
Jan 10, 2017, 12:01 AM
Nokia Android phone spurns the west.
Jan 9, 2017, 12:08 AM
New at CES 2017 - Changhong 8K Super Slim TV 65ZHQ3R
Jan 8, 2017, 1:07 AM
Debuted at CES 2017 - Vuzix Blade 3000 Smart Sunglasses
Jan 8, 2017, 12:39 AM
Some news of Day
Jan 7, 2017, 12:01 AM
News 2017 CES
Jan 6, 2017, 12:01 AM
Here is the Latest News in Tech
Jan 5, 2017, 1:47 AM
AI Beats World’s Best at Chinese board game “Go”
Jan 4, 2017, 11:21 AM
Las Vegas 2017 CES
Jan 3, 2017, 12:01 AM
News of Jan 2nd 2017
Jan 2, 2017, 4:40 AM
Wishing you all, the New Year brings the light of hope, joy, success, and Happy, Happy New Year.
Jan 1, 2017, 1:48 AM
New End of Year News
Dec 31, 2016, 12:01 AM
More Blog Posts
Copyright 2017 DailyTech LLC. -
Terms, Conditions & Privacy Information