5 ms·

For those wondering how this can happen - AWS' command line tools and SDKs by default upload files as private. Scarily, some other libraries set uploads to pub

For those wondering how this can happen - AWS' command line tools and SDKs by default upload files as private. Scarily, some other libraries set uploads to public by default, for example: https://www.smore.com/labs/tinys3/ https://www.smore.com/labs/tinys3/ For those who say cloud isn't less secure than on-prem... that may be true. However, the cloud is generally just one incorrect click or setting away from being completely open. Anyone know how the security researcher found the public bucket? Does he just crawl for buckets made up of common words? Does AWS not limit the amount of crawling from one IP?

raesene9 9y ago
The idea of crawling for S3 content has been around for a while (see this post from 2011 https://digi.ninja/blog/whats_in_amazons_buckets.php https://digi.ninja/blog/whats_in_amazons_buckets.php for one example). Also google can end up indexing content in places like S3 or Azure file stores if there's a link there from another piece of content that it indexes. (for example https://community.rapid7.com/community/infosec/blog/2013/03/27/1951-open-s3-buckets https://community.rapid7.com/community/infosec/blog/2013/03/...)
lazaroclapp 9y ago
Cloud isn't less secure than on-prem if you are your average software startup or non-tech company, which, for many reasons, is unlikely to go all out on on-prem security. Commodity cloud should be less secure than on-prem, if you are fucking Booz Allen...
- FooHentai 9y ago
  >Cloud isn't less secure than on-prem if you are your average software startup or non-tech company Even that's hard to argue, unless you rely on a fundamental incompetence within that startup or an often-unprovable competence level on the part of cloud providers. There have been enough cloud-hosting provider security facepalms hitting the front pages now so 'cloud providers are better at security than small shops' is starting to be called out as the blind falsehood it has always been. Fundamentally it has always really been 'We're unable to see what these guys are doing behind the curtain so we'll assume good faith', and little more. The emperor may have clothes, or in many cases has been utterly balls-out naked, but up until now groupthink has been that not knowing = must be secure. I am biased though, I spend most of my work hours analysing service providers big and small, self-hosted and cloud, and have probably developed a suitably sceptical view in that time.
FooHentai 9y ago
>For those who say cloud isn't less secure than on-prem... I mean that's fundamentally untrue, simply from a trust, venn-diagram point of view. With cloud you have to assume an additional trust with a third party that you don't with on-prem. Is this difference meaningful? that's arguable. But no matter which way it's argued it's still fundamentally true that in direct comparison between a cloud-hosted and self-hosted system, the cloud-hosted version inherently requires that a higher level of trust.
- nothrabannosir 9y ago
  I agree with OP, but this is not true. You can trust Amazon to be better at security than you are. In essence, depending on how (in)competent you are, cloud allows you to convert money into security. If I am a complete zero when it comes to securing my home, and I get a professional contractor to do it. Is that "inherently less secure" because I have to trust him, now, too? Not necessarily, if he does a much better job than I would have done. It can make up for that extra trust. If you are as competent, or more, than Amazon: sure. You are right. But not all of us are so lucky :)
  - FooHentai 9y ago
    >You can trust Amazon to be better at security than you are. You can't blindly trust them to be that, rather you determine them to be that. On an individual provider level you can definitely assess their capabilities and make that determination. But any attempt to blanket extend that to 'cloud providers' is an absurdity. There is no common element among 'cloud providers' that makes one provider's competence at security extend to any other provider under that same banner. Yet today common groupthink is 'cloud hosting is more secure than self hosting'. Nonsense. A simple reword reveals the absurdity: 'Allowing other people to run your IT systems is more secure than running it yourself'. The buzzword 'cloud' somehow turned a nonsense into a widely parroted myth.
    - Mystrl 9y ago
      I don't see how that's absurd. There is absolutely no way I could run a system myself that's more secure than what I could get by paying someone else to do it.

raesene9 9y ago

The idea of crawling for S3 content has been around for a while (see this post from 2011 https://digi.ninja/blog/whats_in_amazons_buckets.php https://digi.ninja/blog/whats_in_amazons_buckets.php for one example). Also google can end up indexing content in places like S3 or Azure file stores if there's a link there from another piece of content that it indexes. (for example https://community.rapid7.com/community/infosec/blog/2013/03/27/1951-open-s3-buckets https://community.rapid7.com/community/infosec/blog/2013/03/...)

lazaroclapp 9y ago

Cloud isn't less secure than on-prem if you are your average software startup or non-tech company, which, for many reasons, is unlikely to go all out on on-prem security. Commodity cloud should be less secure than on-prem, if you are fucking Booz Allen...

FooHentai 9y ago
>Cloud isn't less secure than on-prem if you are your average software startup or non-tech company Even that's hard to argue, unless you rely on a fundamental incompetence within that startup or an often-unprovable competence level on the part of cloud providers. There have been enough cloud-hosting provider security facepalms hitting the front pages now so 'cloud providers are better at security than small shops' is starting to be called out as the blind falsehood it has always been. Fundamentally it has always really been 'We're unable to see what these guys are doing behind the curtain so we'll assume good faith', and little more. The emperor may have clothes, or in many cases has been utterly balls-out naked, but up until now groupthink has been that not knowing = must be secure. I am biased though, I spend most of my work hours analysing service providers big and small, self-hosted and cloud, and have probably developed a suitably sceptical view in that time.

FooHentai 9y ago

>For those who say cloud isn't less secure than on-prem... I mean that's fundamentally untrue, simply from a trust, venn-diagram point of view. With cloud you have to assume an additional trust with a third party that you don't with on-prem. Is this difference meaningful? that's arguable. But no matter which way it's argued it's still fundamentally true that in direct comparison between a cloud-hosted and self-hosted system, the cloud-hosted version inherently requires that a higher level of trust.

nothrabannosir 9y ago
I agree with OP, but this is not true. You can trust Amazon to be better at security than you are. In essence, depending on how (in)competent you are, cloud allows you to convert money into security. If I am a complete zero when it comes to securing my home, and I get a professional contractor to do it. Is that "inherently less secure" because I have to trust him, now, too? Not necessarily, if he does a much better job than I would have done. It can make up for that extra trust. If you are as competent, or more, than Amazon: sure. You are right. But not all of us are so lucky :)
- FooHentai 9y ago
  >You can trust Amazon to be better at security than you are. You can't blindly trust them to be that, rather you determine them to be that. On an individual provider level you can definitely assess their capabilities and make that determination. But any attempt to blanket extend that to 'cloud providers' is an absurdity. There is no common element among 'cloud providers' that makes one provider's competence at security extend to any other provider under that same banner. Yet today common groupthink is 'cloud hosting is more secure than self hosting'. Nonsense. A simple reword reveals the absurdity: 'Allowing other people to run your IT systems is more secure than running it yourself'. The buzzword 'cloud' somehow turned a nonsense into a widely parroted myth.
  - Mystrl 9y ago
    I don't see how that's absurd. There is absolutely no way I could run a system myself that's more secure than what I could get by paying someone else to do it.