5 ms·
Compromised EC2 image includes root access SSH key
A friend just forwarded me this e-mail he received from the Amazon EC2 Security Team.
http://pastebin.com/q1VH4rmF
Looks like a public Ubuntu EC2 image was available that included an SSH key to allow the publisher to log into any instance that is using this image as root.
- paulofisch 16y agoHi there, I originally made this AMI and I would like to apologise to anyone who's instance has been taken offline because they used this image. Through inexperience I left my public SSH key in the AMI, which I failed to appreciate the implications of despite a blog comment highlighting that I'd done so. For the record I'd like to state that I didn't use my unintended powers of root at any point for good or evil. This post stands as a good education of why it's worth checking images of unknown provenance and how to check your public key store for credentials. This issue will mainly affect anyone who wanted an AMI to check out Amazon's free tier which has a 10GB limit on EBS.
- whiskers 16y agoThanks for the response. If I was building an image for the first time I no doubt could easily make the same mistake. It'll definitely be something I make sure of I ever decide to make my own image in the future.
- wladimir 16y agoOoops! Hah, that could have happened to me. But it's a good lesson to people to be careful as to what AMI images they use. A SSH key is pretty easy to detect, but malignant people might plant more subtle backdoors.
- free 16y agoI got an email from amazon about this but I just have a couple of sample apps in there.
- jerrya 16y agoI've been looking at EC2 and would probably have used an AMI like yours, if not yours. So, FWIW, talking as an inexperienced n00b... As a suggestions, perhaps an as valuable, if not more valuable, (perhaps more difficult) contribution would a set of scripts that would create such an image. Having the scripts and not the image would allow the many eyes to secure against the pig in a poke while automating image creation. AMIs could then either be created by users themselves wanting to ensure they know exactly what is going on and then uploaded, or, if I understand what you were offering, public/cloneable AMIs could be created at some public gathering and witnessed and checksummed....
- NeedLucidAMI 16y agopaulofisch - are you planning to make a replacement ami that does not include the security hole, for those of use who still want to use ubuntu 10.04 server?
- NeedLucidAMI 16y agook, never mind. i see that ami-3e02f257 can be used in place of the compromised one.
- snapbuzz 16y agoWow! my instance was running this AMI. I am glad that this was not intentional. Kudos to the aws team for looking after it's customers.