Viewing profile — aaronwp

Another S3 breach, same as all the rest, except this time it risked a ton of crypto assets

This is the first Stripe breach I've found where the vendor didn't even bother to set a host password. All of their money was at risk. It's a good thing I'm so handsome and honest.…

stay tuned

Yes, if PII is involved it's common to run an audit like this. In addition to the access keys on the server image, Sega also accidentally published a database export containing PII…

Sega Europe left AWS S3 creds laying around in a server image on downloads.sega.com. I was able to use them to enumerate a bunch of storage, dig out more keys, and mock up a spear …

if anything my terrible merges usually detract from it