6 ms·
Hackers could have taken over AWS
- olegp 15y agoI do find it odd that they encourage you to use the same account to sign into Amazon the store and AWS. That seems a bit like asking for a Subway loyalty card to buy a gun.
- brlewis 15y agoWhen did they start doing that? When I started using S3 to back up other people's photos I immediately created a second Amazon account for AWS. I don't remember them discouraging me from doing that.
- olegp 15y agoWhat I meant was that if you use the email registered for amazon.com when signing up to AWS they don't create a separate account for you or suggest that you use a different e-mail to create a new account.
- brlewis 15y agoThat's a good point. I suppose it's not surprising, though, that they streamline the signup process for a service that they charge for.
- kingsidharth 15y agoTheir focus is on fast user acquisition. So fastest is the best. I wonder how many do care if it's the same account. Like people sleep well with their data on DropBox. Those who care, think and create separate account.
- wgx 15y agoIs DropBox particularly insecure?
- snewman 15y agoFrom the article, one problem is that even if you don't use your AWS account on the Amazon store, you could, and so XSS vulnerabilities in the store can be used to hijack AWS accounts. Unfortunately the store is large and complex and so has a large attack surface area.
- btn 15y agoAmazon offer security token authentication for accessing AWS account resources, which can limit the impact of a breach in another part of their system.
- sdfjkl 15y agoHeadline wildly inaccurate.
- amnigos 15y agoSo we can assume that the cloud security is as strong as the security at weakest link in one of the centralized access component. Can we have a workflow or multi-level authorizations for critical actions like delete or terminate actions of cloud resources?.
- nadahalli 15y agoIs it just me, or does the article seem like gobbledygook. What is EC4 authentication anyway?
- dmor 15y agoDid I miss something, or this basically trying to call out something that Amazon fixed before anyone actually discovered it. Reads like FUD
- oflannabhra 15y agoIn other news, Hitler could have won and the terrorists could have successfully followed up 9/11. I do think this story is noteworthy, not because of the headline, but because it draws attention to the underlying deficiencies of XML cryptography, as others have pointed out in comments.
- sector 15y agoThe attackers reported the problem to Amazon and allowed Amazon to fix it prior to their public disclosure. I don't see how that's FUD. There was a problem, they found it, they let Amazon fix it, then they reported what they'd found.
- tptacek 15y agoWS-* and XML cryptography is such a clusterfuck. It's ironic to see Amazon injured by use of "standard" constructions; they'd have been better off rolling their own here.
- azth 15y agoYou shouldn't really be surprised though; especially after Yegge's rant the other week. Software quality at Amazon is pretty mediocre, and pales in comparison to Google's (I worked at both places.)
- taylorbuley 15y agoGlad the Reg is sensationalist enough to spark a discussion (seriously). The orig item didn't do so hot. http://news.ycombinator.com/item?id=3160301 http://news.ycombinator.com/item?id=3160301