4 ms·
> Fixing the vulnerability not only requires the keys to be changed on the server, but also a software patch to be rolled out on each affected device. Is this
by laurencei 8y ago
> Fixing the vulnerability not only requires the keys to be changed on the server, but also a software patch to be rolled out on each affected device.
Is this correct?
Couldnt they just change the existing keys in AWS to be "write only" - and therefore allow a one way stream of data "in"?
That way, even with the keys, you cant actually get any existing videos, and only place new ones there?
I do this for my web application backups - my AWS keys on the server are "write only" (with no overwrite) to S3. Then, if my server was every compromised, my backups are NOT and are protected because the attackers cant get to them (to either overwrite or read the existing backup).
- oavdeev 8y agoHow did you do "no overwrite" bit? By enabling versioning?
- laurencei 8y agoI use `s3:PutObject` with versioning - yes. Although I've not tested if only having `s3:PutObject` even allows overwriting in the first place? You might not need versioning. Also - they dont have `list` or `read` access, so they cant even see what files are there to overwrite in the first place. They might be able to guess depending on your code, but adding some random numbers and you'd be pretty safe. Any AWS IWS experts able to confirm if `s3:PutObject` allows overwrite?
- oavdeev 8y agoIt does; unfortunately they don't have a nice way to just disallow overwrites (that's why I was curious how you implemented that)