Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Vulnerability: AWS Credential Disclosure

blog.trustlook.com

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Critical Vulnerability: AWS Credential Disclosure

#21

Post by jbert »

So - there has to be some trust to the client, unless the resource is public (or locked down with end-user creds).

In this case, some kind of creds need to go into the app, right?

So the best practise is simply to make those some creds which: 1) have limited privileges (e.g. just access one S3 bucket) and 2) can be centrally revoked (requiring app update for everyone?)

I've read the link on the amazon Token Vending Machine approach, but I still don't understand why that is better.

If I have the embedded creds to get a token from the TVM, and that token allows me to access an S3 bucket, how is that more secure from using limited IAM creds which just allow direct access to the bucket?

In both cases:

- the creds can be revoked centrally

- possession of the embedded creds allows access to the S3 bucket (either directly, or by fetching a token first)

Re: Critical Vulnerability: AWS Credential Disclosure

#22

Post by twistedpair »

A few times I've found myself looking to automate some AWS task to add/remove a bunch of widgets that their API does not easily allow. Turns out there are a few webapps that will do these things for you. On opening the app, they ask you to give them your AWS keys.

Who actually does this? Personally I fear most devs are not properly creating several groups and users and permissioning them to the bare minimum depending on the app/dev's minimum needs. Then again, AWS's tools don't help as doing X with AWS CLI might really require permission X, Y and Z, something you don't want to discover in production.

Re: Critical Vulnerability: AWS Credential Disclosure

#23

Post by yeukhon »

The title is so catchy. I came to think AWS credentials were leaked because Amazon didn't handle it properly. Instead, this is about someone committing credentials in app. This is like me committing a password into my git repo. How is this even new discovery?

I read about a similar one a few months ago. If I were to search for credentials, I should just search through bitbucket, google code and github. There are tons of passwords committed and many are probably still usable...

Re: Critical Vulnerability: AWS Credential Disclosure

#24

Post by [deleted] »

jbert wrote: post #21

So - there has to be some trust to the client, unless the resource is public (or locked down with end-user creds). In this case, some kind of creds need to go into the app, right? So the best practise is simply to make those some creds which: 1) have limited privileges (e.g. just access one S3 bucket) and 2) can be centrally revoked (requiring app update for everyone?) I've read the link on the amazon Token Vending M…

[deleted]

Re: Critical Vulnerability: AWS Credential Disclosure

#25

Post by systemizer »

mahmoudimus wrote: post #19

If you use Chef, at Balanced ( https://github.com/balanced ), we've built a pretty awesome tool called: "Citadel" ( https://github.com/balanced-cookbooks/citadel ) that uses IAM policies for fetching secrets securely stored in S3 buckets. It's pretty awesome. We're porting all of our code to use this, so we can open source most of our code freely and not have to necessary find ourselves working around security hurdle…

Cool. I'm curious: what was your motivation for doing this rather than using Chef's encrypted data bags?

Is it because it's tightly integrated with IAM? If that's the case, does that mean you guys use a cookbook that tightly couples system users with IAM roles?

Re: Critical Vulnerability: AWS Credential Disclosure

#26

Post by ludicast »

1) This is as many said, just an example of bad practice rather than something specific to AWS. I remember in my php days seeing commented-out php code in html that included db passwords. If putting passwords, api keys, etc. in client-side code doesn't make your hair stand up, well, something is wrong.

2) I would be curious what the backends were in these instances. With the growth of the BaaS-model for app development, I think we're going to see a lot more "offshoring" of these security things, where keys are thrown in the front-end app. "I do it with firebase, why not twilio or aws?"

Re: Critical Vulnerability: AWS Credential Disclosure

#27

Post by scottm01 »

DigitalBison wrote: post #15

I don't mean to downplay the severity of this, and I could be missing something, but I fail to see how this is a new vulnerability that TrustLook has "discovered". We've seen countless stories on HN (unless I'm wildly misremembering) of credentials being leaked via client-side applications, including AWS credentials. Haven't developers been getting this wrong since the dawn of client-server authentication?

This does seem like a PR department writing rather then security researcher. Calling out AWS credentials seems to be particularly trolling, they just happen to be the secrets that were easiest to grep for I guess.
Post reply on HN