3 ms·
The report [0] might be one of the most damning I've seen for a little while. DES-encrypted AWS S3 creds with unlimited access baked in. Hashcat makes short wo
by shakna 8y ago
The report [0] might be one of the most damning I've seen for a little while.
DES-encrypted AWS S3 creds with unlimited access baked in. Hashcat makes short work (hours) of DES these days.
OpenSSl 1.0.1g, a rather outdated and rather vulnerable. Integer overflow, easily DOS-able, and double-free, amongst others.
And all of this with proof it works, whilst the company blusters.
> Siwak was adamant that the “accusations are false,” but did not say why.
... As far as I can tell without breaching my local laws by running the exploits... S3 hasn't revoked those keys yet, or required a more limited policy.
[0] https://www.0dayallday.org/guardzilla-video-camera-hard-coded-aws-credentials/ https://www.0dayallday.org/guardzilla-video-camera-hard-code...