Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In Digital Ocean, S3-like space keys can access all your buckets

ideas.digitalocean.com

Post reply on HN
Print view View original

11–20 of 104 posts

Re: In Digital Ocean, S3-like space keys can access all your buckets

#11

Post by Operyl »

k8sToGo wrote: post #10
sergioisidoro wrote: post #2

S3 (and similar storages) have caused plenty of security issues in several occasions (usually because of misconfigured buckets, making all contents available to the public). Given this, it would be expected that companies would pay a bit more attention to the security of these data storage methods. However, in Digital Ocean, by design, you can't restrict keys to certain buckets. Once you issue a key, it can access al…

Isn't this usually solved through some form of IAM policies? Does DO not have this?

No such luck there, but this is kind of the MO for DigitalOcean, sadly.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#12

Post by Operyl »

sneak wrote: post #6
snowstormsun wrote: post #5

And DO consistently ignores requests to add this. It prevents me from seriously using Spaces and I think many others, too.

DO has had a terrible attitude to security for as long as they've been around. I reported a major data leak vulnerability to them and they told me it was operating as intended, so I published it, and then they accused me of irresponsible disclosure, while simultaneously claiming that there was no security issue. This was a dozen years ago and the founders were involved in the response. They are at the top of the list…

Don’t forget the time they issued the same sshd keys to every instance because they didn’t scrub them from the images.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#13

Post by k8sToGo »

sneak wrote: post #6
snowstormsun wrote: post #5

And DO consistently ignores requests to add this. It prevents me from seriously using Spaces and I think many others, too.

DO has had a terrible attitude to security for as long as they've been around. I reported a major data leak vulnerability to them and they told me it was operating as intended, so I published it, and then they accused me of irresponsible disclosure, while simultaneously claiming that there was no security issue. This was a dozen years ago and the founders were involved in the response. They are at the top of the list…

Reminds me of a hosting company in my country. When you use their spaces thing, they generate a password for you (not being able to set your own is already a red flag for me, but ok). It was "hidden" in the UI to look secure. However, the password itself was passed as an argument that was part of the URL. So everyone who logs access urls could see the password.

I reported it, they fixed it quickly, but never acknowledged that it was a "security" issue.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#14

Post by londons_explore »

sergioisidoro wrote: post #2

S3 (and similar storages) have caused plenty of security issues in several occasions (usually because of misconfigured buckets, making all contents available to the public). Given this, it would be expected that companies would pay a bit more attention to the security of these data storage methods. However, in Digital Ocean, by design, you can't restrict keys to certain buckets. Once you issue a key, it can access al…

As a user, you can fix this by having a proxy that fits in front and manages ACL's.

Obviously you have to pay for resources for that proxy, and it's probably going to want a large bandwidth allocation. Lucky because DO doesn't charge for bandwidth.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#15

Post by rmbyrro »

londons_explore wrote: post #14
sergioisidoro wrote: post #2

S3 (and similar storages) have caused plenty of security issues in several occasions (usually because of misconfigured buckets, making all contents available to the public). Given this, it would be expected that companies would pay a bit more attention to the security of these data storage methods. However, in Digital Ocean, by design, you can't restrict keys to certain buckets. Once you issue a key, it can access al…

As a user, you can fix this by having a proxy that fits in front and manages ACL's. Obviously you have to pay for resources for that proxy, and it's probably going to want a large bandwidth allocation. Lucky because DO doesn't charge for bandwidth.

If I have to implement and manage an ACL myself (such a basic feature!!), it's better to go ahead and implement something like min.io and ditch DO entirely.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#17

Post by patrakov »

Is this post somehow related to the recent Ceph CVE-2023-43040 ("Improperly verified POST keys"), where Digital Ocean was also credited?

https://www.openwall.com/lists/oss-security/2023/09/26/10

---

A flaw was found in Ceph RGW. An unprivileged user can write to any bucket(s) accessible by a given key if a POST's form-data contains a key called 'bucket' with a value matching the name of the bucket used to sign the request.

The result of this is that a user could actually upload to any bucket accessible by the specified access key as long as the bucket in the POST policy matches the bucket in said POST form part.

We have assigned it a CVE of CVE-2023-43040 and the patch is attached.

Credits to Lucas Henry of Digital Ocean.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#18

Post by Operyl »

patrakov wrote: post #17

Is this post somehow related to the recent Ceph CVE-2023-43040 ("Improperly verified POST keys"), where Digital Ocean was also credited? https://www.openwall.com/lists/oss-security/2023/09/26/10 --- A flaw was found in Ceph RGW. An unprivileged user can write to any bucket(s) accessible by a given key if a POST's form-data contains a key called 'bucket' with a value matching the name of the bucket used to sign the re…

Nope, this post is from 2021 pretty much begging that DO provide per-bucket level access keys for Spaces. Otherwise, right now, all keys created for an account can access all buckets on that account.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#19

Post by belter »

sneak wrote: post #9
mdekkers wrote: post #7

Earlier quoted context omitted.

Could you provide more details?

On delete of VMs, the next user to be allocated disk would be able to read your data. There was a "scrub" feature that would bill you longer/extra to zeroize your data and not give it to the next customer. Apparently they hadn't heard of TRIM or thin provisioning. https://github.com/fog/fog/issues/2525 https://news.ycombinator.com/item?id=6983097 https://news.ycombinator.com/item?id=6983520

Some of the comments by DO on that GitHub thread, are really surprising, and disappointing to say the least...
Post reply on HN