Amazon AWS Amazon Web Services users are carelessly leaking tons of sensitive data

eva2000 · Jun 5, 2017

Ouch folks using Amazon AWS services might want to double check their setups https://thenextweb.com/security/2017/06/02/amazon-web-services-leak-data-aws/#.tnw_peoAia2w

Personal credentials, proprietary source code, confidential employee contracts, even human genome sequences – these are just a few examples of sensitive data picked up by a security firm looking into a feature of Amazon’s Web Services.

“We were very surprised with both the amount and the sensitivity of the data that was shared publicly,” NVTEH CEO Ivo Ugrina told us.

Since launching AWS a little over ten years ago, Amazon has devoted commendable effort to provide quality training for businesses seeking to implement its cloud computing solutions into their already existing IT infrastructure.

But despite these attempts, it is still threateningly easy for uninformed users to make costly mistakes – mistakes that could not only set a company back millions of dollars, but also make invaluable data vulnerable to breaches.
Click to expand...

“Using cloud services inherently means storing data on computers you don’t own. Mistakes made in the cloud are therefore more likely to become public and the impact can range from embarrassment to loss of customer data,” Ugrina continued.

One thing that particularly bugged the Croatian cloud expert was the sloppy manner in which certain companies relied on Elastic Block Store (EBS) snapshots to share sensitive information between employees and with partners.

For those unfamiliar with the matter, EBS provides highly available block level storage volumes for use with Elastic Compute Cloud (EC2) instances.

In a way, the relation between EC2 and EBS is akin to that between a server and a hard disks: Think of EC2 instances as virtual servers and EBS volumes as the virtual hard disks that power those servers.

Much like hard disks, EBS volumes have their own backup system, more commonly known within AWS as EBS snapshots. Snapshots are point-in-time backups of EBS volumes that practically function as copies of the data stored on these volumes.

“If you want to backup the data from your EC2 instance, then you probably want to create EBS snapshots of the EBS volumes attached to the instance,” NVTEH research lead Neven Vucinic explains. “Users with appropriate access can afterwards copy your snapshot and create their own EBS volumes based on your snapshot, while your original snapshot remains unaffected.”
Click to expand...

It seems not all AWS users take the cue though. “Unfortunately, there are dozens of publicly created EBS snapshots daily that contain some kind of data that should not be publicly accessible,” Ugrina tells us.
Click to expand...

ArisC · Jun 5, 2017

R.I.P AWS.

eva2000 · Jul 20, 2017

wow more leaked AWS S3 buckets this time from Dow Jones Dow Jones index – of customers, not prices – leaks from AWS repo

It's an all-too-familiar, straightforward breach: someone left a cloud repository configured to offer “semi-public access”, meaning “the sensitive personal and financial details of millions of the company’s customers” was exposed.

“While Dow Jones has confirmed that at least 2.2 million customers were affected, UpGuard calculations put the number closer to 4 million accounts,” the post adds.

The repo was an AWS S3 bucket with the wrong privacy settings: by configuring it to allow access to authenticated users, whoever set it up didn't seem to realise they were offering access to any authenticated AWS user - not just those with Dow Jones-associated accounts).
Click to expand...

There's a customer file – the one the company reckons has upwards of 4 million records – that includes “customer names, internal Dow Jones customer IDs, home and business addresses, and account details, such as the promotional offer under which a customer signed up for a subscription”.
Click to expand...

can be confusing I guess Introduction to Managing Access Permissions to Your Amazon S3 Resources - Amazon Simple Storage Service

Overview of Managing Access

How Amazon S3 Authorizes a Request

Guidelines for Using the Available Access Policy Options

Example Walkthroughs: Managing Access to Your Amazon S3 Resources

Click to expand...

ArisC · Jul 20, 2017

"Accident"

eva2000 · Jul 20, 2017

Yeah scary.. sometimes I do wish Amazon AWS made their configuration for ACL and permissions easier to setup - pretty sure it doesn't need to be as complicated as it is right now.

ArisC · Jul 20, 2017

Never worked with AWS. I'm budget guy its sad too lol

eva2000 · Jul 20, 2017

I extensively use Amazon AWS services like S3, SNS, Cloudfront, Lambda, Route53 etc so had to learn the ropes for AWS IAM (Identify and Access Management) What Is IAM? - AWS Identity and Access Management

Video Introduction to AWS IAM

IAM Features

Accessing IAM

Overview of Identity Management: Users

Overview of Access Management: Permissions and Policies

Security Features Outside of IAM

Quick Links to Common Tasks

Click to expand...

and IAM Best Practices - AWS Identity and Access Management

To help secure your AWS resources, follow these recommendations for the AWS Identity and Access Management (IAM) service.

Topics

Lock Away Your AWS Account Root User Access Keys

Create Individual IAM Users

Use AWS Defined Policies to Assign Permissions Whenever Possible

Use Groups to Assign Permissions to IAM Users

Grant Least Privilege

Use Access Levels to Review IAM Permissions

Configure a Strong Password Policy for Your Users

Enable MFA for Privileged Users

Use Roles for Applications That Run on Amazon EC2 Instances

Delegate by Using Roles Instead of by Sharing Credentials

Rotate Credentials Regularly

Remove Unnecessary Credentials

Use Policy Conditions for Extra Security

Monitor Activity in Your AWS Account

Video Presentation About IAM Best Practices

Click to expand...

Jon Snow · Jul 20, 2017

Does this affect people using AWS with SES?

I couldn't find any of the settings and I don't use any of the services mentioned in the post.

buik · Jul 20, 2017

It does affect all external rent a (VPS) server, without physical access as end user and without knowing who does and who doesn't (staff), you never know who can review your data and who can't, both virtual and physical.

Apart from the fact that after stopping the rental, who knows if your server is formatted (in)correctly. For example Digital-ocean: Transparency Regarding Data Security

eva2000 · Jul 20, 2017

Jon Snow said: ↑

Does this affect people using AWS with SES?

I couldn't find any of the settings and I don't use any of the services mentioned in the post.
Click to expand...

Not exactly the same breach. Above is allowing other AWS IAM authenticated users access to S3 buckets containing data and info files. AWS SES is just a smtp service so there is no access to at rest stored data like in S3 buckets. But improperly setup AWS IAM credentials could allow IAM user who accesses S3 buckets to also access other AWS services like S3 buckets. It's why I create specific AWS IAM users to only access specific AWS services and drill down to even only accessing a specific AWS S3 bucket name only. That's why you should always use IAM Policy Test Simulator to check your permissions Testing IAM Policies with the IAM Policy Simulator - AWS Identity and Access Management

Testing IAM Policies with the IAM Policy Simulator - AWS Identity and Access Management

How the IAM Policy Simulator Works
The simulator evaluates the policies that you choose and determines the effective permissions for each of the actions that you specify. The simulator uses the same policy evaluation engine that is used during real requests to AWS services. But the simulator differs from the live AWS environment in the following ways:

The simulator does not make an actual AWS service request, so you can safely test requests that might make unwanted changes to your live AWS environment.

Because the simulator does not simulate running the selected actions it cannot report any response to the simulated request. The only result returned is whether the requested action would be allowed or denied.

If you edit a policy inside the simulator, these changes affect only the simulator. The corresponding policy in your AWS account remains unchanged.

Click to expand...

eva2000 · Jul 24, 2017

looks like AWS is reminding users now

Hello,

We're writing to remind you that one or more of your Amazon S3 bucket access control lists (ACLs) are currently configured to allow read access from any user on the Internet. The list of buckets with this configuration is below.

By default, S3 bucket ACLs allow only the account owner to list the bucket or write/delete objects; however, these ACLs can be configured to permit public read access. While there are reasons to configure buckets with public read access, including public websites or publicly downloadable content, recently there have been public disclosures by third parties of S3 bucket contents that were inadvertently configured to allow public read access but were not intended to be publicly available.

We encourage you to promptly review your S3 buckets and their contents to ensure that you are not inadvertently making objects visible to users that you don't intend. Bucket ACLs can be reviewed in the AWS Management Console (http://console.aws.amazon.com ), or using the AWS CLI tools. ACLs permitting "All Users" grant public read access to the related content.

For more information on configuring your bucket ACLs, please visit: Access Control List (ACL) Overview - Amazon Simple Storage Service

For additional assistance reviewing your bucket ACLs, please visit http://aws.amazon.com/support to create a case with AWS Developer Support.

Your list of buckets configured to allow read access from anyone on the Internet are:
Click to expand...

the S3 bucket for me is a public ACL'd static html website/file bucket so ok.

eva2000 · Sep 6, 2017

another leaked s3 bucket from Time Warner this time Yet another AWS config fumble: Time Warner Cable exposes 4 million subscriber records

Records of roughly four million Time Warner Cable customers in the US were exposed to the public internet after a contractor failed to properly secure an Amazon cloud database.

Researchers with security company Kromtech said freelancers who handled web applications for TWC and other companies had left one of its AWS S3 storage bins containing seven years' worth of subscriber data wide open on the 'net. That data included addresses and contact numbers, information about their home gateways, and account settings.

Just before the weekend, Kromtech said the vulnerable AWS instance was operated by BroadSoft, a cloud service provider that had been using the S3 silos to hold the SQL database information that included customer records.

When Kromtech spotted the repository in late August, it realized that databases had been set to allow public access, rather than limit access to administrators or authorized users.

"It is most likely that they were forgotten by engineers and never closed the public configuration. This would allow anyone with an internet connection to access extremely sensitive documents," Kromtech's Bob Diachenko said.
Click to expand...

eva2000 · Nov 21, 2017

yup still happening at highest levels of government/military https://arstechnica.com/information...ntel-gathering-operation-left-open-on-amazon/ !

A Pentagon contractor left a vast archive of social-media posts on a publicly accessible Amazon account in what appears to be a military-sponsored intelligence-gathering operation that targeted people in the US and other parts of the world.

The three cloud-based storage buckets contained at least 1.8 billion scraped online posts spanning eight years, researchers from security firm UpGuard's Cyber Risk Team said in a blog post published Friday
Click to expand...

Log in / Register

Forums

Join the community today

Amazon AWS Amazon Web Services users are carelessly leaking tons of sensitive data

eva2000 Administrator Staff Member

ArisC Active Member

eva2000 Administrator Staff Member

ArisC Active Member

eva2000 Administrator Staff Member

ArisC Active Member

eva2000 Administrator Staff Member

Jon Snow Active Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

Amazon AWS Amazon Web Services users are carelessly leaking tons of sensitive data

eva2000 Administrator Staff Member

ArisC Active Member

eva2000 Administrator Staff Member

ArisC Active Member

eva2000 Administrator Staff Member

ArisC Active Member

eva2000 Administrator Staff Member

Jon Snow Active Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.