Top 5 AWS Security Mistakes: Leaky S3 Buckets

guest · Aug 3, 2019

Top 5 AWS Security Mistakes: Leaky S3 Buckets
August 2, 2019
https://devops.com/top-5-aws-security-mistakes-leaky-s3-buckets/

In this article, we’ll dig into S3 buckets, explain how they become vulnerable, cover eight different ways they can inherently become open to the public and how to find and protect any public facing S3 data.
The S3 Bucket
S3 is one of the oldest services in AWS—so old that parts of it still support XML-based policies instead of the JSON you see everywhere else. S3 also has a lot of features that aren’t as commonly known or used anymore, such as allowing someone else to host put objects in your bucket yet still maintain ownership of them.
Sharing publicly, within an account, between accounts, hosting websites and so on, creates complexity. The good news is S3 always defaults to secure and private.

The bad news is AWS allows human beings to use it (and therefore weaken security) and can be confusing to manage. For example, S3 supports both read and write permissions (and list, for buckets). It’s possible to have no public read but public write permissions, which could lead to people placing bad files in your directories. [...]
Click to expand...

Minimalist · Aug 4, 2019

Concerns growing over AWS cloud security in Korea

Concerns are growing over the security and reliability of cloud computing offered by Amazon Web Services (AWS) after a former AWS worker allegedly stole data on 105 million customers of Capital One Bank.

The former AWS worker allegedly hacked the cloud server of Capital One Bank, operated by the firm, and stole the information, according to cybersecurity analysts here Friday.

They said Korean companies using the AWS cloud should be aware of potential data leaks because storing digital information on cloud servers is not a perfect way to protect it.
Click to expand...

http://www.koreatimes.co.kr/www/tech/2019/08/133_273271.html

guest · Aug 10, 2019

Hundreds of exposed Amazon cloud backups found leaking sensitive data
August 9, 2019
https://techcrunch.com/2019/08/09/aws-ebs-cloud-backups-leak/

How safe are your secrets? If you used Amazon’s Elastic Block Storage snapshots, you might want to check your settings.
You may have heard of exposed S3 buckets — those Amazon-hosted storage servers packed with customer data but often misconfigured and inadvertently set to “public” for anyone to access. But you may not have heard about exposed EBS snapshots, which poses as much, if not a greater, risk.

These elastic block storage (EBS) snapshots are the “keys to the kingdom,” said Ben Morris, a senior security analyst at cybersecurity firm Bishop Fox, in a call with TechCrunch ahead of his Def Con talk.

“They have the secret keys to your applications and they have database access to your customers’ information,” he said.
Morris built a tool using Amazon’s own internal search feature to query and scrape publicly exposed EBS snapshots, then attach it, make a copy and list the contents of the volume on his system.

“If you expose the disk for even just a couple of minutes, our system will pick it up and make a copy of it,” he said.
Click to expand...

Minimalist · Aug 20, 2019

AWS Promises to Scan for Misconfigured Servers

Like many recent data breaches, Capital One’s data breach was not the result of a vulnerability in Amazon’s cloud infrastructure, but rather how the financial giant had configured its systems. Even though Amazon Web Services wasn’t to blame, the company said that going forward, it will warn customers if it detects problems with how the customer had configured their systems and applications.
Click to expand...

https://duo.com/decipher/aws-promises-to-scan-for-misconfigured-servers

Brummelchen · Aug 20, 2019

Capital One could be such victim because not C1 was hacked but its database on aws servers.

guest · Sep 14, 2019

Hacking with AWS: incorporating leaky buckets into your OSINT workflow
September 13, 2019
https://blog.malwarebytes.com/resea...s-incorporating-leaky-buckets-osint-workflow/

Penetration testing is often conducted by security researchers to help organizations identify holes in their security and fix them, before cybercriminals have the chance. While there’s no malicious intent for the researcher, part of his job is to think and act like a cybercriminal would when hacking, or attempting to breach, an enterprise network.

Therefore, in this article, I will review Amazon AWS buckets as an avenue for successful penetration tests. The case study I’m using is from a reconnaissance engagement I conducted against a business. I will specifically focus on how I was able to use AWS buckets as an additional avenue to enrich my results and obtain more valuable data during this phase.
Click to expand...

In addition, I hope that it may also serve as a warning for companies deciding to use AWS to host private data and a reminder to secure potentially leaky buckets.
Click to expand...

guest · Feb 26, 2020

How to Prevent an AWS Cloud Bucket Data Leak
Following a handful of practices will help keep you from becoming the next news story
February 26, 2020
https://www.darkreading.com/applica...a-aws-cloud-bucket-data-leak--/d/d-id/1337093

When it comes to public cloud services, there's Amazon's AWS and then there's everyone else. With an estimated 39% market share, it's a rare cybersecurity professional who won't encounter AWS at some point in their career. And there's no question that protecting data in AWS begins with understanding bucket security.

Fortunately, from Amazon and a number of other sources scattered around the Internet, there are a handful of crucial practices that, if followed, will keep your data from sloshing out of its bucket and landing all over the web.
The cautionary tale
Recent cloud bucket data leak catastrophes like the Capital One breach show that there both cloud users and cloud service providers like AWS have roles to play in their own security.

"Just because misconfigurations is a customer problem doesn't mean that the [cloud service provider] vendors can't play a role there," says Cloud Security Alliance VP of Research John Yeoh. "Are they making sure that we have safe and secure default configurations? Are they giving us notifications? The bells should be ringing if we have sensitive information in a folder that's publicly exposed."
Fortunately, Amazon and other cloud platform providers are now doing some of the things Yeoh suggests. Here's what you need to know about the opportunities and the pitfalls.
Click to expand...

Policies, policies
There are policies that govern human behavior and policies that govern bucket behavior. Let's begin by looking at the former and then discuss how those can have an impact on the latter.
Click to expand...

guest · Mar 21, 2020

AWS Security Blog
Top 10 security items to improve in your AWS account
March 20, 2020
https://aws.amazon.com/blogs/security/top-10-security-items-to-improve-in-your-aws-account/

If you’re looking to improve your cloud security, a good place to start is to follow the top 10 most important cloud security tips that Stephen Schmidt, Chief Information Security Officer for AWS, laid out at AWS re:Invent 2019. Below are the tips, expanded to help you take action.
Click to expand...

guest · Aug 4, 2020

Leaky S3 buckets have gotten so common that they're being found by the thousands now, with lots of buried secrets
August 3, 2020
https://www.theregister.com/2020/08/03/leaky_s3_buckets/

The massive amounts of exposed data on misconfigured AWS S3 storage buckets is a catastrophic network breach just waiting to happen, say experts.

The team at Truffle Security says its automated search tools were able to stumble across some 4,000 open Amazon S3 buckets that included data companies would not want public, things like login credentials, security keys, and API keys.
In fact, the leak hunters say that the exposed data was so common, they were able to count an average of around 2.5 pieces of 'secret' data in each file they analyzed.

That the Truffle Security team was able to turn up roughly 4,000 insecure buckets with private information shows just how common it is for companies to leave their cloud storage instances unguarded.
Click to expand...

Though AWS has done what it can to get customers to lock down their cloud instances, finding exposed storage buckets and databases is pretty trivial for trained security professionals to pull off.

While the fact that the buckets were left open is pretty bad in and of itself, the Truffle crew believes that the real danger is that the exposed 'secrets' would have a cascading effect where an attacker could use the exposed keys and credentials to get into other, more secure accounts and services.
In other words, they fear that the misconfigured buckets would serve as the entry point for a much larger data leak.
Click to expand...

An API Worm In The Making: Thousands Of Secrets Found In Open S3 Buckets

S3 buckets are a common place to store files in AWS. These buckets have a feature that allows you to make your files readable by anyone on the internet without authentication. If the content is meant for public consumption, like storing HTML, CSS, and JS assets for a website, this feature can be really useful, but it’s a double edged sword.
Click to expand...

guest · Dec 14, 2020

Cloud Security: Messy Blobs and Leaky Buckets
December 13, 2020
https://www.tripwire.com/state-of-s...oud/cloud-security-messy-blobs-leaky-buckets/

Moving to the cloud means a lot more than just moving your servers and applications to the cloud; it’s also about the data – and data always has a target on it.

Are your cloud teams creating change tickets for important changes to configurations/information in the cloud? If not, why not? Who or what is keeping track of whether changes are authorized and what may put you at risk?

All configuration settings have security and cost implications. Knowing what they’re set to and if they’re in compliance with your corporate standard across your AWS accounts (or the equivalent in Azure) is important from both a security and cost perspective.
Click to expand...

Is Your Data Safe in the Cloud?
Overall, cloud storage has been a huge boon to the corporate IT world as well as to cloud storage providers themselves. But handing off your data to another entity doesn’t transfer or erase the responsibility (and liability) that you have for securing that data.

For a more in-depth look at cloud storage and security, please read this blog post about AWS S3 storage.
Click to expand...

Log in or Sign up

Top 5 AWS Security Mistakes: Leaky S3 Buckets

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Brummelchen Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Top 5 AWS Security Mistakes: Leaky S3 Buckets

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Brummelchen Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches