3 ms·

Another miss-configured S3 bucket, again? Really? I actually lost the count of this happening.

by csunbird 6y ago

RL_Quine 6y ago
I know of companies who store all of their AML/KYC in AWS buckets, going back years. It's scary really.
fragmede 6y ago
If you're using AWS, where else would you put it? Fire up an EC2 instance and obscurely store it in /var/www/? These days S3 buckets start off private, and the AWS console warns you "hey, the data in this bucket is publicly accessible, are you sure?" Irresponsibility is irresponsibility, no matter the system being used. An SFTP server can be configured with PermitRootLogin yes and PermitEmptyPasswords yes so at some point it's not the software that's the issue.
- Retric 6y ago
  Amazon allows S3 to be unsecured after multiple breaches. Simply the existence of the option is a security issue. PS: It's a basic question of convenience vs security. If you allow people to lower security settings, they will. However, if Amazon onky allowed the unsecured option to be temporary say 24 hours then it would be less convenient to leave things open.
  - Pfhreak 6y ago
    I used to agree with you, back when S3 defaulted to public or at the very least made public a very easy checkbox. These days it defaults to private and you have to click many warnings and unhide options to even expose the public options. That said, I don't know that many organizations practice good hygiene about which buckets they use. Like they might just use 'the one bucket that we have as a company' rather than separating their uses into many smaller buckets that are appropriately access controlled.
  - snazz 6y ago
    I'm not sure about S3, but I use Google Cloud Storage to host my websites and large file downloads. For that to work, "allUsers" has to have the "Cloud Storage Viewer" permission. Would it be possible for that to work without allowing GCS and S3 buckets to be public?

3 ms·

Another miss-configured S3 bucket, again? Really? I actually lost the count of this happening.

by csunbird 6y ago

Another miss-configured S3 bucket, again? Really? I actually lost the count of this happening.

RL_Quine 6y ago
I know of companies who store all of their AML/KYC in AWS buckets, going back years. It's scary really.
fragmede 6y ago
If you're using AWS, where else would you put it? Fire up an EC2 instance and obscurely store it in /var/www/? These days S3 buckets start off private, and the AWS console warns you "hey, the data in this bucket is publicly accessible, are you sure?" Irresponsibility is irresponsibility, no matter the system being used. An SFTP server can be configured with PermitRootLogin yes and PermitEmptyPasswords yes so at some point it's not the software that's the issue.
- Retric 6y ago
  Amazon allows S3 to be unsecured after multiple breaches. Simply the existence of the option is a security issue. PS: It's a basic question of convenience vs security. If you allow people to lower security settings, they will. However, if Amazon onky allowed the unsecured option to be temporary say 24 hours then it would be less convenient to leave things open.
  - Pfhreak 6y ago
    I used to agree with you, back when S3 defaulted to public or at the very least made public a very easy checkbox. These days it defaults to private and you have to click many warnings and unhide options to even expose the public options. That said, I don't know that many organizations practice good hygiene about which buckets they use. Like they might just use 'the one bucket that we have as a company' rather than separating their uses into many smaller buckets that are appropriately access controlled.
  - snazz 6y ago
    I'm not sure about S3, but I use Google Cloud Storage to host my websites and large file downloads. For that to work, "allUsers" has to have the "Cloud Storage Viewer" permission. Would it be possible for that to work without allowing GCS and S3 buckets to be public?