One in Six Amazon S3 Cloud Storage Users Make Sensitive Data Public
March 28, 2013 5:54 AM
Amazon.com, Inc.'s (
cloud storage solution
is once again under the
spotlight of scrutiny
following a report by security firm
. The report by the firm's Senior Security Consultant Will Vandevanter complains that poor security in the cloud may be endangering scores of customers worldwide.
But before you blame Amazon, Mr. Vandevanter makes it clear that it is the businesses that are to blame for the exposure of sensitive customer data.
The service provider Amazon gives its customers the ability to make their data private. But according to the report, approximately one in six bins on Amazon S3 containing sensitive data are made public. It's hard to tell if this is mere incompetence on the part of firms using the service, or what the justification for this dangerous practice might be, but it's clear it's bad news for customers and perhaps unfair bad publicity for the service provider Amazon.
In his post "
There's a Hole in 1,951 Amazon S3 Buckets
", Mr. Vandevanter blogs:
The worst case scenario is that a bucket has been marked as "public", exposes a list of sensitive files, and no access controls have been placed on those files. In situations where the bucket is public, but the files are locked down, sensitive information can still be exposed through the file names themselves, such as the names of customers or how frequently a particular application is backed up.
It should be emphasized that a public bucket is not a risk created by Amazon but rather a misconfiguration caused by the owner of the bucket. And although a file might be listed in a bucket it does not necessarily mean that it can be downloaded. Buckets and objects have their own access control lists (ACLs). Amazon provides information on managing access controls for buckets
. Furthermore, Amazon helps their users by publishing a best practices document on
public access considerations around S3 buckets
. The default configuration of an S3 bucket is private.
While Amazon is not directly to blame, the structure of S3 URLs does exacerbate the problem, according to Mr. Vandevanter. As Amazon expects its users to make use of its robust privacy options when necessary, it gears its public S3 URLs for ease of use. As a result, it's very easy to guess the URL names needed to get access to public records.
Mr. Vandevanter demonstrates how companies are goofing on cloud security.
[Image Source: BrightCove/Rapid7]
The URLs of a bucket are http://s3.amazonaws.com/[bucket_name]/ or http://[bucket_name].s3.amazonaws.com/; private buckets will give an access denied error, while public buckets will show the first 1,000 records.
To guess the bucket names, the researcher used several sources:
Guessing names through a few different dictionaries:
List of Fortune1000 company names with permutations on .com, -backup, -media. For example, walmart becomes walmart, walmart.com, walmart-backup, walmart-media.
List of the top Alexa 100,000 sites with permutations on the TLD and www. For example, walmart.com becomes www.walmart.com, www.walmart.net, walmart.com, and walmart.
Extracting S3 links from the HTTP responses identified by the
. This enabled us to identify s3.amazonaws.com and cloudfront.net addresses “in the wild”. It is very common for a cloudfront.net address to point to an S3 bucket.
Bing Search API
was queried to gather a list of potentials.
The results allowed the discovery of 12,328 unique buckets -- 1,951 of which were public, and 10,377 of which were private. In total he gathered 126 billion files from the open buckets -- including files that appeared to contain private user data.
Robin Wood aka "DigiNinja" has published a
public web tool
that uses similar sources to generate a list of S3 bucket names.
An exasperated Amazon has told Mr. Vandevanter that it "currently putting measures in place to proactively identify misconfigured files and buckets moving forward."
In other words, Amazon realizes that some of its clients are too incompetent to manage its own security settings, so it's trying to take the responsibility on itself to double check their work.
But fixing the settings retroactively may not protect users fully. Mr. Vandevanter writes:
is a great resource to identify previously open buckets. Using a modified version of
I also quickly identified a few hundred buckets that are currently private that previously weren’t.
Looks like the only real solution is to not move to the cloud if you can't handle simple security of the hand-holding variety (which appears to be the case for some firms).
This security "study" is similar to the
hack done by Goatse Security researcher Andrew Auernheimer
. Showcasing the ambiguity of computer security laws, Mr. Vandevanter will likely be praised for his work (and has the security firm backing to protect him if he gets charged/sued) where as Mr. Auernheimer's similar dump of exposed AT&T, Inc. (
) customer data
earned him nearly 4 years in prison
. The message seems to be that if you work for corporate security, feel free to probe away, but if you work as an independent security researcher prepare to be harassed and sent to prison due to the U.S.'s poorly written computer crime laws.
"Young lady, in this house we obey the laws of thermodynamics!" -- Homer Simpson
Report: CIA Steps Aboard Amazon's Cloud, With Secret Services Contract
March 20, 2013, 5:57 PM
Goatse Security iPad Hacker Gets 41 Months for "Doing Arithmetic"
March 18, 2013, 11:06 PM
Amazon Web Services Failure Leads to Netflix Outage on Christmas Eve
December 27, 2012, 8:00 AM
AT&T's Gaping Hole Exposes 114,000 iPad 3G Buyers' Email Addresses
June 9, 2010, 5:55 PM
Not All the High-Tech Jobs Are in California
August 4, 2016, 8:29 PM
Google's Gleaming Glass HQ Gets Mountain View Snub, LinkedIn Gets the Love
May 7, 2015, 6:58 AM
Tech's Tax Day Fortunate Few: Qualcomm, Xerox, GE, et al. Pay Little or No Taxes
April 15, 2015, 11:30 AM
LinkNYC Terminals to Blanket New York City With Free WiFi, Free Calls, and Ads
November 17, 2014, 6:50 PM
Microsoft is Open-Sourcing Most of .NET, Adding OS X and Linux Support
November 12, 2014, 8:27 PM
Home Depot Lost 53 Million Emails, Blames Windows, Buys Execs New Macs
November 9, 2014, 5:00 PM
Most Popular Articles
How Apple watch Series 2 differ from the S1
February 18, 2017, 5:37 AM
Comparison: NuVision vs Kindle Fire HD
February 18, 2017, 6:25 AM
What do you or do not know about Apple iPhone 7 &7+
February 8, 2017, 9:27 AM
ROG Maximus VIII – Gaming Motherboard with integrated RGB Headers
February 7, 2017, 7:59 AM
This Can / May Satisfy the Movie lovers
February 19, 2017, 9:52 AM
Latest Blog Posts
AMD and More
Feb 24, 2017, 5:55 AM
Feb 23, 2017, 6:30 AM
Feb 21, 2017, 6:12 AM
Here is how startups are helping new parents in raising children
Feb 20, 2017, 6:45 AM
Around the World
Feb 18, 2017, 5:48 AM
News of Future
Feb 17, 2017, 6:30 AM
Amazon parachutes May Float Packages to Customers
Feb 16, 2017, 8:00 AM
Now you Can Watch Facebook on Your TV
Feb 15, 2017, 7:42 AM
Feb 14, 2017, 5:36 AM
Razer Blade Stealth – Little Kaby Lake Powerhouse
Feb 13, 2017, 7:50 AM
Android 7.0 Nougat 7.0 Update Bring Less Battery Life for Samsung Galaxy S7 & S7 Edge
Feb 12, 2017, 7:45 AM
Apple iPhone 8 – OLED Display & Wireless Charging
Feb 11, 2017, 8:09 AM
Feb 10, 2017, 6:15 AM
Feb 9, 2017, 6:00 AM
Eye catching news
Feb 8, 2017, 6:16 AM
Some World News
Feb 7, 2017, 6:15 AM
Feb 6, 2017, 10:11 AM
Feb 5, 2017, 7:27 AM
Notes and News
Feb 4, 2017, 5:53 AM
Feb 3, 2017, 5:30 AM
Feb 2, 2017, 7:00 AM
News Around The World.
Feb 1, 2017, 7:20 AM
More Blog Posts
Copyright 2017 DailyTech LLC. -
Terms, Conditions & Privacy Information