13 ms·
Detailed Financial Histories Exposed for Thousands
- ssijak 9y agoThats cool, just following whats trendy
- save_ferris 9y agoI get that it's the customer's responsibility to correctly configure their services, but what does it say about the UX of AWS services that they're so easy to misconfigure with disastrous consequences? And despite this happening across a variety of industries, Amazon doesn't seem super concerned about it either, but I could be wrong here. There's just no excuse for this to keep happening, but the processes meant to prevent this are clearly failing.
- emeraldd 9y agoI suspect this kind of storage was not the original purpose of S3. For instance, it's a common to use S3 buckets to serve up webpage assets rather than using a dedicated CDN or your own servers.
- RhodesianHunter 9y agoIt's becoming the underlying datastore for everything from static websites to databases (see Athena)
- Ninn 9y agoDoes the same argument carry over to public FTP servers? I doubt it.
- siruncledrew 9y agoThe new console for AWS literally has a documentation link containing example bucket policies at the top of the page for S3 buckets. Either someone was given a job they clearly had no experience in or was alarmingly inadequate at performing their job duties. It really shows the level of incompetence so many of these companies operate at with no regard for PII.
- thesmallestcat 9y agoInsecure defaults are a footgun.
- joshmn 9y agoAbsolutely. Windows tells you that using a password is probably a good idea for a user account. Many websites these days force you to use a combination of letters/numbers/special characters. Why doesn't Amazon say "hey, this is publicly available, you wanna fix it?"
- inopinatus 9y ago> Why doesn't Amazon say "hey, this is publicly available, you wanna fix it?" They do. It's clearly warned about in the interface both at the time you make it so and with a big "PUBLIC" sticker label afterwards. What's more, I've received warning emails from AWS notifying of (intentionally) public buckets. Public buckets for private data are a deliberate and wilful choice by lazy, reckless administrators.
- ghaff 9y agoI noticed this when I went into my console the other day. (Ironically, to set up a public bucket for something.) I don't think the UI was bad before but, now, you'd have to be pretty clueless to have a bucket public by accident.
- deleted 9y ago[deleted]
- ghaff 9y agoYou've always had to make it public deliberately. The new console UI makes setting a bucket to public a very deliberate effort.
- moduspol 9y agoThey're secure by default on S3. You have to go out of your way to make it public, or grant anyone else access.
- TheAdamAndChe 9y agoWhat makes you think it's the UX of AWS services that is leading to these issues?
- x23oeuiudi7 9y agoThe fact that it keeps happening repeatedly.
- zitterbewegung 9y agoMaybe if you house sensitive information you should have a person or multiple people enforce security across your organization? Scapegoating one technology or person is not the correct attitude because it could have been anything else. Also, amazon is improving their UX for these things already.
- 1stranger 9y agoBoth can be true.
- FLUX-YOU 9y ago>Maybe if you house sensitive information you should have a person or multiple people enforce security across your organization? They probably didn't care, and should suffer consequences as a result. This looks like a really small company who contracted this stuff out to a WordPress shop. There's almost no tech employees or positions on job boards for them.
- twunde 9y agoApple has actually updated their UX recently to let you know if your s3 buckets are public or not. EDIT: The recent update made it explicitly clear that your bucket is public. Previously, you might not notice, especially if you were taking over from a previous sysadmin (or more likely a developer)
- deleted 9y ago[deleted]
- hashkb 9y agoAren't S3 defaults entirely private? It's pretty obvious what you're doing when you make a bucket public.
- at-fates-hands 9y agoI honestly don't know what the solution is. Making a good user experience (read: convenience) and keeping your stuff secure is always a balancing act. I can't tell you how many times I've told a manager or director not to do something because it would make our client data insecure, only to have them basically reply with, "I'm your boss, do what I say." This guy may have known exactly what he was doing, but relented to other higher ups who told him to do something. The shitty part is now this is public, all the execs can point to the developer and say it was his fault and fire him without incurring any repercussions themselves.
- madeofpalk 9y agoActually, AWS S3 console will now SCREAM at you if you leave anything public. Now, if you don't know your S3 bucket is public that's entirely on you.
- vannevar 9y agoThe problem isn't that our data has become public; it's that businesses accept data as identity. They mostly just mindlessly automated manual paperwork processes that were slow, but also less efficient to defraud. By only looking at costs, and not at risks, business has built our ecommerce infrastructure on sand. The notion of identity as it relates to business transactions needs to be reworked from the ground up.
- bogomipz 9y agoWell said. I'm curious what are your thoughts on how that could or should be reworked.
- jstanley 9y agoWe should use public key cryptography to prove our identity.
- Faaak 9y agoFor example with certificates on a national card, like spain or estonia.
- mcny 9y ago> For example with certificates on a national card, like spain or estonia. There is so much wrong with a national identity card. For example, who will pay for it? I don't want to pay for it. I don't want my taxes to pay for it. Even if you find some way to pay for it, I don't want it. What's next? Will you require me to carry a identity card on me at all times? "Random" cavity search for people walking down the road?
- heavenlyblue 9y agoBut then you seem to be willing to pay for the fraudulent debt in your name due to identity theft.
- hdogan 9y agoThis might be related with https://news.ycombinator.com/item?id=15826906 https://news.ycombinator.com/item?id=15826906
- laurencei 9y agoIs there a way I can triple check my S3 bucket is secure? I know I've not enabled public access that I know of - but given the recent focus on this; what are the exact steps that I need to follow so I can sleep at night and show a level of diligence on the issue?
- NathanKP 9y agoEnable Amazon Macie. It automatically classifies your data in S3 buckets, detects situations where data is more open than it should be, and warns you if access patterns for data change in a way that may indicate that you have been hacked or someone is misusing their level of access to the data. https://aws.amazon.com/macie/ https://aws.amazon.com/macie/
- Operyl 9y agoNeat! Didn't know about that service, hopefully businesses accept that hefty price tag though. It's obvious they don't want to invest too heavily in sec-orgs as it stands it seems.
- NathanKP 9y agoPretty soon with the GDPR kicking in it will be more expensive to not protect the data than it is to protect it. All companies processing the personal data of people residing in the EU regardless of the company’s location who have a breach of data where the organization has been shown to violate basic privacy design concepts can be fined 4% of annual global turnover or €20 million, whichever is greater. It goes into enforcment in May 2018: https://www.eugdpr.org/ https://www.eugdpr.org/ If Macie saves you just once from that giant fine it probably just paid for itself for years!
- napsterbr 9y agoHey, I'm all in for that, but how do we handle data breaches on small business where 20mil corresponds to, say, 100 years of profit? I haven't read the law but the faq does not mention the 20mil figure
- vintageseltzer 9y agoAre there any examples of class-action lawsuits or legal consequences against companies that expose sensitive data like this in the U.S.?
- astura 9y agoHere's a discussion on the topic: https://www.bankinfosecurity.com/data-breach-lawsuits-fail-a-8213 https://www.bankinfosecurity.com/data-breach-lawsuits-fail-a...
- ryanf323 9y agoThose AWS “practitioners” who are too stupid or lazy to figure out IAM policies. Thankfully, AWS has added bright yellow labels to identify public buckets. However, labels won’t be enough to motivate some people to learn JSON.
- gldev3 9y agoLast year one of mexico's political parties left the nominal list with a lot of citizen's information available in an AWS server, unforgivable; how come this keeps happening.
- tomlong 9y agoIt's frustrating that whatever I do to protect my own identity/data, no amount of 2FA or password generators or my own good practice mitigates the loss/theft of data/identify in this way. I'm as good at it as anyone I know (and unsurprisingly I work in tech) and it's still a complete crapshoot.
- Veratyr 9y agoNot everything you do is futile. Refraining from distributing your data is very effective.
- LoonyBalloony 9y agoWhat will happen to this corporation? Any punishment at all? It didn't say in the article.
- jimjimjim 9y agoAWS server considered harmful.
- ngold 9y agoBack in the paper days. I moved into a new office only to discover a dozen or so boxes crammed full of people's personal files. Mortgage applications and taxes. It took a couple of weeks to track down the parent company buy all sorts of damage could have been done had I been anyone else.
- pleasecalllater 9y agoOh, another company... cool. Who will get to jail? Oh, nobody. Who will get bonuses? Oh, the management. Who will be fired? Oh, some programmers or admins.
- Jdam 9y agolooks totally like an admin shortcoming to me though
- zeep 9y agoDo amazon AWS servers expose everything by default?
- dbenhur 9y agoNo. The exact opposite, in fact.
- vvram 9y agoIt's great to see attention being drawn to responsible use of cloud services, which for most part have safe defaults. I absolutely support, responsible disclosure but it is always uncomfortable to see that security researchers (this particular team) goes beyond vulnerability discovery and handles the data directly. Who is responsible for safe disposal of the data they downloaded and analyzed ?
- defined 9y agoFinding smart solutions to the issue of corporate data breaches is laudable. Finding solutions that are feasible for use by people who are being paid the lowest wage that the company they work for can get away with will be miraculous, IMHO. The reason I say this is that knowing not to give a sensitive AWS S3 bucket public access is 101-level AWS expertise, which means either of these scenarios are likely: - The persons responsible did not know any better, or - They did know better, but made an error provoked by pressure due to understaffing. Both of these point to a lack of competent security personnel, either due to understaffing, or hiring insufficiently experienced staff, both of these due to minimizing salary budgets (or clueless hiring managers, perhaps).