3 ms·
Time Warner Cable also had the same data breach. I wonder by passwordless did they mean someone was able to do a ls command on the bucket and was able to downlo
by yeukhon 9y ago
Time Warner Cable also had the same data breach. I wonder by passwordless did they mean someone was able to do a ls command on the bucket and was able to download as a public/anon user (direct s3 link)? If this was done I bet you someone probably didn't have time to implement secure link, just decided to make the bucket open.
- pmiller2 9y agoThere's always time to implement basic security when it comes to personally identifiable info. This was simple ineptitude.
- yeukhon 9y agoYes agree, but incident like this usually orginatrd from laziness/ forgetting about turning the switch off.
- ufmace 9y ago> someone probably didn't have time to implement secure link, just decided to make the bucket open. That sounds more likely. AWS permissions are tricky, but not so tricky that it's easy to leave a bucket wide open like that. In my experience, they're much more likely to lock out someone who should be able to access them than to allow someone who shouldn't. Just bad practice to give up and allow anyone in.
- yeukhon 9y agoAnother possibility: someone was doing testing (and at thr stage too lazy), they made it public, and forgot about it even after they implemented authorization at the application level. Could have used trusted advisor...