One In Six Amazon S3 Storage Buckets Are Ripe For Data-Plundering 79
tsamsoniw writes "Using a combination of relatively low-tech techniques and tools, security researchers have discovered that they can access the contents of one in six Amazon Simple Storage Service (S3) buckets whose owners had them set to Public instead of Private. All told, researchers discovered and explored nearly 2,000 public buckets, according to Rapid 7 Senior Security Consultant Will Vandevanter, from which they gathered a list of more than 126 billion files, many of which contained sensitive information such as source code and personal employee information. Researchers noted that S3 URLs are all predictable and public facing, which make it that much easier to find the buckets in the first place with a scripting tool."
I think it's booty (Score:5, Funny)
You have done an excellent job of revealing the very loose fabric of the internet, especially those that would not set their own security properly. However, under current law, you have violated so many laws, with so many more to come, that your best way out is to stand on the last iceberg in the Arctic and hope it does not melt anytime soon. Just to clarify, here's a few of the things you've clearly done, and I don't even have to prove them.
Access and distribution of pornography (surely one of those buckets was full of porn, a felony in 20 countries)
Access and distribution of child pornography (well at least one of those buckets has it, or did, or will one day)
Failure to report a bucket full of child pornography
Conspiracy to distribute
Hacking every country in the world... let me explain, no wait let me sum up.
Amazon has storage in 193 countries
By accessing one you have violated the statutes of every country attacked
This is basically punishable by the rest of your life in prison in every country, except the Vatican, which will send you to hell.
So now you are going to hell, after spending the rest of your life kissing bubba's pants
Unauthorized access (fines from Amazon, billions $$$$ ($100,000 per bucket per country, ouch!)
Future crimes (as the future is soon you are already guilty of:
Discussing a hacking attempt
Intent to hack
Intent to exploit, list exploits, financially gain from exploits
I can't type anymore, and there's no doubt as far as most governments are concerned I'm as guilty as you are by now.
Re: (Score:2)
Re:I think it's booty (Score:5, Informative)
http://yro.slashdot.org/story/13/03/18/1641221/41-months-in-prison-for-man-who-leaked-att-ipad-email-addresses [slashdot.org]
Re: (Score:2)
Re: (Score:2)
Re:I think it's booty (Score:4)
Re: (Score:2)
The difference here is most of this shit is supposed to be public.
This whole article is goddamn idiotic. One of the primary uses of S3 is as an asset hosting service for websites. That doesn't mean there are a trillion public files that aren't supposed to be. It means people are using the service. So great, you found a trillion public files. You know what else does that already? Google.
It sounds to me like this "security researcher" is just some asshat that wasted time writing a script, and news outlets ha
Re: (Score:2)
The difference here is most of this shit is supposed to be public.
Most != All. The entire point of this sort of exploit is to draw attention to widespread gross misunderstanding and misconfiguration of services used by a great many developers, content managers, etc. Maybe this is difficult to understand, so allow me to rephrase it: the entire point is that a large number of these files shouldn't be public, and at minimum this demonstrates incompetence on the part of those who put those files into public buckets. More interestingly, depending on the nature of the improperl
Re: (Score:2)
Private is the default setting?
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Private is the default setting. Which is why TFS notes that this is about buckets who users had set them to Public instead of Private.
Re: (Score:2)
Maybe in your country, not mine.
An analogy of this law is: You will be punishable by law if you open a unlocked door when unauthorized.
Re: (Score:2)
You have done an excellent job of revealing the very loose fabric of the internet, especially those that would not set their own security properly. However, under current law, you have violated so many laws, with so many more to come, that your best way out is to stand on the last iceberg in the Arctic and hope it does not melt anytime soon. Just to clarify, here's a few of the things you've clearly done, and I don't even have to prove them.
Access and distribution of pornography (surely one of those buckets was full of porn, a felony in 20 countries) Access and distribution of child pornography (well at least one of those buckets has it, or did, or will one day) Failure to report a bucket full of child pornography Conspiracy to distribute Hacking every country in the world... let me explain, no wait let me sum up. Amazon has storage in 193 countries By accessing one you have violated the statutes of every country attacked This is basically punishable by the rest of your life in prison in every country, except the Vatican, which will send you to hell. So now you are going to hell, after spending the rest of your life kissing bubba's pants Unauthorized access (fines from Amazon, billions $$$$ ($100,000 per bucket per country, ouch!) Future crimes (as the future is soon you are already guilty of: Discussing a hacking attempt Intent to hack Intent to exploit, list exploits, financially gain from exploits I can't type anymore, and there's no doubt as far as most governments are concerned I'm as guilty as you are by now.
The content owners granted access permissions to everyone by leaving their S3 buckets public; there's no way stumbling upon information made publicly available is considered hacking. Only the owners of these buckets could be convicted of anything, assuming stupidity is a crime.
Re: (Score:3)
The content owners granted access permissions to everyone by leaving their S3 buckets public; there's no way stumbling upon information made publicly available is considered hacking. Only the owners of these buckets could be convicted of anything, assuming stupidity is a crime.
Again, tell that to weev, who did the EXACT same thing and has already been convicted of 41 months in prison.
Re: (Score:1)
Oh they search engines have been attacked legally too but they usually:
1) are corporations so they can't be sent to jail
2) have resources to defend themselves in court or settle out of court
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
It's cute how naive you are.
Re: (Score:1)
Re: (Score:2)
Massively offtopic, but...
"Professor, what's another word for pirate treasure?"
"Well I think it's booty" "booty" "booty that's what it is"
-- Beastie Boys "Professor Booty"
URLs? (Score:4, Insightful)
"Researchers noted that S3 URLs are all predictable and public facing"
I thought that was the whole effing point of URLs/URIs? Whether or not you get authorized to access them should be a completely orthogonal issue...or not?
Re: (Score:3)
Researchers noted that S3 URLs are all predictable and public facing, which make it that much easier to find the buckets in the first place with a scripting tool.
So basically they walked down the street checking door to see which ones were unlocked then looked inside the unlocked houses?
Public Stores or Private Houses (Score:1)
So basically they walked down the street checking door to see which ones were unlocked then looked inside the open stores. These are marked public. They're public.
~orb
Re: (Score:3, Interesting)
So basically they walked down the street checking door to see which ones were unlocked then looked inside the unlocked houses?
It would be like walking down a street and peeking in to public restaurant to see what's on the menu.
Re: (Score:2)
These storage buckets are presumably meant to be private, not public. So the private houses analogy is much better than the public restaurant analogy here.
Re: (Score:1)
These storage buckets are presumably meant to be private, not public. So the private houses analogy is much better than the public restaurant analogy here.
By default every bucket and file is marked as private. If something is marked as public then it has been explicitly marked that way by the user.
Re: (Score:2)
You know that.
I know that.
90% of people who "code" or deal with software -- should not be allowed anywhere near anything that has aspects of security aspects of systems and software.
Good luck trying to find a manager that a) understands that, b) can identify the 10% vs the masses, c) is willing to pay that 10% what they're worth.
Shit, the 50% of managers and "architects" and developers who create unscalable crap are long gone off to their next task before whatever they last created gets to the point of impl
Re: (Score:1)
I thought that was the whole effing point of URLs/URIs? Whether or not you get authorized to access them should be a completely orthogonal issue...or not?
In systems with URLs that contain some sort of object identifier, using a non-predictable identifier is a great way to add another layer of security. It doesn't replace actual authentication or authorization checks, it just complements them.
For example, if I have a REST URL like this:
http://someserver/users/ID [someserver]
If I use sequential numbers, or actual usernames as the identifier, it becomes trivial for someone to enumerate all of them by iterating through numbers, or a dictionary. However, if the ID is a 128-bi
Morons Don't Read Slashdot (Score:1, Troll)
Amazon's Jeff Bezos must not give much direction to his crew about running things right.
Re:Morons Don't Read Slashdot (Score:5, Interesting)
Amazon's Jeff Bezos must not give much direction to his crew about running things right.
The default policy is set to private and Amazon provides extensive documentation and support should customers wish to secure things properly. 5 out of 6 did, and think the sixth is a blithering idiot. How is Bezos responsible for the sixth guy shooting himself in the foot as when he was handed the gun it clearly said "Do not pull trigger while pointing at self."?
Re: (Score:1)
Being an idiot does not automatically revoke rights to things like privacy and property. Else you could argue that stealing from people who don't lock their doors is not a crime.
Re:Morons Don't Read Slashdot (Score:4, Informative)
> The default policy is set to private
It is now, but it wasn't in Dec 2006 when I first started using S3. I looked through my buckets, and all of them I created that month are all public.
Re: (Score:2)
This just in... (Score:5, Interesting)
People don't bother reading the manual. Then, everything explodes. How is this news? Please, find me a person in this industry who doesn't know what RTFM means. "Idiot who didn't RTFM exposes personal info." Those of us in the industry have a term for when things like this happen: Tuesday.
What'll be news is when they say "And then the manager and personnel responsible went to jail, because their idiocy cost tax payers millions in lost productivity spent fixing their credit reports and financial lives."
Hacking (Score:1)
I thought white-hat hacking was illegal unless you got the owner's permission...
Re: (Score:1)
What's the news here? (Score:4, Funny)
A billion out of a billion Facebook accounts are ripe for the plundering too. Just wait for the next feature change and the inevitable default setting of "public" applied to every account.
Will these guys get 41 months in jail too? (Score:4, Insightful)
If the justice department or any company affected by this wants to, they could claim Computer Fraud and Abuse.
Yet somehow I doubt the "researches" will get any jail time.
Public v. Private (Score:2)
So, if you want your bucket to be private, you shouldn't actively set it to be Public instead of Private. Okay, I can see that, but I'm trying desperately to figure out how this is news.
Not a security hole (Score:2)
The default in s3 has containers set to private. The 'flaw' here is that public containers can be listed by anyone.
1) set container to public
2) shout loudly that the public can see inside your public container
I'm tempted to call the author a moron.
Re: (Score:2)
It's not a problem with Amazon. The issue is with developers not bothering to think about what they're doing when they chuck data into buckets that are expressly set to public. It's potentially a very large problem for companies that expose sensitive customer information or things like access credentials in this manner. If you think I'm kidding about the latter, I'm not, having seen that happen.
S3 - MegaUpload... (Score:2)
but with a crapier business plan?
Duh... (Score:2)
Slashdot has the same issue (Score:1)
For example, this [slashdot.org]. No user authentication required at all.
Not relevant to everyone (Score:2)
While I admit, folks have their own priorities and needs... I only tend to trust "the cloud" for things that are public or well encrypted.