4 ms·
In that case Amazon's wording would be pretty disingenuous - "AWS customers' data and instances are not affected by these issues" when the reality is more like
by zurn 11y ago
In that case Amazon's wording would be pretty disingenuous - "AWS customers' data and instances are not affected by these issues" when the reality is more like "as far as we know nobody exploited this before we patched"?
- walterbell 11y agoGood point. In theory, they could have had other mitigations in place for this class of vulnerability, which they chose not to share with the GPL Xen community.
- FireBeyond 11y agoRight, "AWS customers' data and instances _ARE_ not affected" (emphasis mine) does not imply "AWS customers' data and instances _WERE_ not affected"
- walterbell 11y agoBreaches are a one-way state change, like death. If customer data WAS affected, then it IS affected, until customers take action such as disclosure, resetting passwords/keys, etc. If customer data was affected, AWS would need to advise customers to take remedial steps. Since they have not issued such advice, is it safe to assume that they had mitigation in place for this attack?
- ak4g 11y agoIt could also be the case that they have monitoring systems on the host machines that would have reliably detected this issue being exploited, even before this specific vulnerability was discovered (or perhaps better to say, given the age of the bug, before being discovered by someone that disclosed it to Xen).
- jerdfelt 11y agoIt depends on the version of Xen they are running. XSA-148 only affects Xen 3.4 and newer. If AWS is running an older version of Xen, they may never have been affected.
- rodgerd 11y agoSince Amazon don't tell anyone about what they run, and don't release back to the broader Xen community, I guess we'll never know.