Google Crypto Expert Exposes Trio of AWS Encryption Bugs

guest · Aug 15, 2020

Google Crypto Expert Exposes Trio of AWS Encryption Bugs
August 11, 2020
https://www.cbronline.com/news/aws-encryption-bugs

Amazon has updated its S3 encryption client after a cryptographic expert at Google identified three security vulnerabilities in how it secures content in S3 buckets. These included two bugs in its software development kit (SDK), earning her a brace of rare CVEs against the hyperscaler: CVE-2020-8912 and CVE-2020-8911.

Among Dr Sophie Schmieg’s trio of finds was one dubbed by security colleague Thai Duong as “one of the coolest crypto exploits in recent memory”.
AWS acknowledged the vulns more coolly in an August 7 developer blog as “interesting”.
The cloud provider played down the severity of the bugs [...]
Click to expand...

Two of the bugs have now been fixed in the latest version of the AWS encryption SDK; the cloud giant’s client-side encryption library. The third (and the only one apparently not allocated a CVE) meanwhile was patched by AWS on August 5.

It allowed an attacker with read access to an encrypted S3 bucket to recover the plaintext without accessing the encryption key. As Dr Schmieg noted this week: “The S3 crypto library tries to store an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext in an offline attack, if the hash is readable to the attacker.”*
Click to expand...

CVE-2020-8911 was detailed by Dr Schmeig on GitHub on Monday.
CVE-2020-8912 was also detailed with a proof-of-concept by Dr Schmieg this week.
“This exposes a padding oracle vulnerability.
Click to expand...

Log in or Sign up

Google Crypto Expert Exposes Trio of AWS Encryption Bugs

guest Guest

Log in or Sign up

Google Crypto Expert Exposes Trio of AWS Encryption Bugs

guest Guest

Useful Searches