4 ms·
Researchers Uncover 'Massive Security Flaws' In Amazon Cloud
- DiabloD3 15y agoFor those looking to ditch Amazon over their mismanagement, try a real VPS provider like RapidXen.
- TimothyFitz 15y agoThe researchers uncovered an XML Signature Wrapping attack, which requires the attacker has access to the plaintext of a correctly authorized XML request sent to Amazon. Given that every client I know of uses https for EC2 APIS, this isn't what I would call a "Massive Security Flaw". More details on XML Signature Wrapping here: http://clawslab.nds.rub.de/wiki/index.php/XML_Signature_Wrapping_-_Simple_Context http://clawslab.nds.rub.de/wiki/index.php/XML_Signature_Wrap...
- tptacek 15y agoYou should read their actual paper, esp. section 3.1 (last graf) and 3.2 (first 2 grafs). You've oversimplified the problem; there is a variant of the attack that doesn't require an XML signature, for instance.
- maratd 15y agoWhy is this a story if the flaws have already been fixed? I have no expectations of perfection from Amazon, just responsiveness.
- salem 15y agoAt the very least it's a reminder to follow or exceed the security related recommendations.