9 ms·
From the TC article: It’s not known for exactly how long the bucket was left exposed, but a text file left behind by an unnamed security researcher, dated Sept
by 1024core 5y ago
From the TC article:
It’s not known for exactly how long the bucket was left exposed, but a text file left behind by an unnamed security researcher, dated September 2018, warned that the bucket was “not properly configured” which can have “dangerous security implications.”
So... this has been a known problem since 2018. Time to stop tilting at windmills.
- arbitrage 5y agoIf it's all theater, then it's worth pointing out the A/C/M times of files are easy to fake. A competent intruder can feather filesystem times and modify logs to point investigators toward the wrong conclusion.
- wizzwizz4 5y agoDepends on the filesystem access. I didn't think Amazon buckets generally allowed that kind of thing.
- kayodelycaon 5y agoIt doesn't. There's no S3 API to change upload dates.
- electroly 5y agoNot in an S3 bucket you can't. We're not talking about a filesystem here.