5 ms·

Seems it was 3rd party apps data stored in ... openly accessible S3 buckets. -_-

• nvr219 8y ago
  Isn't this the most common reason for these leaks? Does Amazon not have screaming red banners saying "this is gonna be openly accessible?"
  • badwolf 8y ago
    It seems just about every "data breach" like this turns out to be an S3 bucket left open to anyone, or a MongoDB instance left with default settings/etc... With how easy it has become to vacuum up such huge amounts of data, this type of "breach" really needs to stop :(
  • themattress 8y ago
    No screaming red banner, but each bucket does indeed get marked with large orange rectangle that reads “Public”. It’s easily noticeable. In my limited experience, a lot of the open buckets problem comes from the fact that access to * is the path of least resistance vs a proper IAM and bucket config. When feature work is on the line ain’t nobody got time for that :/
    • wangchungtonite 8y ago
      A lot of devs likely using aws in this manner are also not likely using the web interface an instead operating from cli pipelines where it’s easy to miss
    • sbr464 8y ago
      Recently (past couple of years) I’ve noticed you’ll also get emails notifying of any publicly accessible buckets.
  • jasonlotito 8y ago
    Not red, but yes, they make it clear and obvious what this means. People don't do this by accident. It's 100% willful.
    • kakarot 8y ago
      Who stands to gain for freely releasing this data?
  • statguy 8y ago
    Also, aren't the buckets private by default?