Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Vulnerability: AWS Credential Disclosure

blog.trustlook.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Critical Vulnerability: AWS Credential Disclosure

#31

Post by logn »

jbert wrote: post #21

So - there has to be some trust to the client, unless the resource is public (or locked down with end-user creds). In this case, some kind of creds need to go into the app, right? So the best practise is simply to make those some creds which: 1) have limited privileges (e.g. just access one S3 bucket) and 2) can be centrally revoked (requiring app update for everyone?) I've read the link on the amazon Token Vending M…

I don't get why this is necessary. Is there no server backend in these cases? I don't do much mobile development, but I would just generate a random token and register that with my server, like a cookie.

Re: Critical Vulnerability: AWS Credential Disclosure

#32

Post by mahmoudimus »

systemizer wrote: post #25
mahmoudimus wrote: post #19

If you use Chef, at Balanced ( https://github.com/balanced ), we've built a pretty awesome tool called: "Citadel" ( https://github.com/balanced-cookbooks/citadel ) that uses IAM policies for fetching secrets securely stored in S3 buckets. It's pretty awesome. We're porting all of our code to use this, so we can open source most of our code freely and not have to necessary find ourselves working around security hurdle…

Cool. I'm curious: what was your motivation for doing this rather than using Chef's encrypted data bags? Is it because it's tightly integrated with IAM? If that's the case, does that mean you guys use a cookbook that tightly couples system users with IAM roles?

We're strong believers that data bags are an anti-pattern. One of our engineers, https://github.com/coderanger, wrote something up: https://coderanger.net/2014/02/data-bags/

He was employed previously at Opscode, now Chef Inc.

Re: Critical Vulnerability: AWS Credential Disclosure

#34

Post by wangsanli »

eduardordm wrote: post #13

In my company we have an application that stores an API key in its local storage. This API key is generated by the client app when it's first run and it's individual. If it gets stolen only that client will have its security compromised. That happened to us a couple of times, always on rooted android phones with pirated software installed. I'm a heavy AWS user but not too familiar with S3 keys, couldn't the keys be g…

Yes. You can request Temporary Credentials for s3 service. However, the only secure way to do it is on server side not on client.

Re: Critical Vulnerability: AWS Credential Disclosure

#35

Post by Patrick_Devine »

vanilla wrote: post #29

There was a Blog-post on HN 10 days ago, showing Amazon is actively scanning for this and warns developers. https://news.ycombinator.com/item?id=7491272 it also predates this blog post

Yeah, I'm not sure how anyone could consider this a "Critical Vulnerability". It's kind of cool and slightly frightening that Amazon scans for API keys. I'd love to know how they're going about the scan though; maybe using excess capacity to do a crawl and analyzing the results? Maybe through Alexa?

Re: Critical Vulnerability: AWS Credential Disclosure

#36

Post by jlgaddis »

scottm01 wrote: post #27
DigitalBison wrote: post #15

I don't mean to downplay the severity of this, and I could be missing something, but I fail to see how this is a new vulnerability that TrustLook has "discovered". We've seen countless stories on HN (unless I'm wildly misremembering) of credentials being leaked via client-side applications, including AWS credentials. Haven't developers been getting this wrong since the dawn of client-server authentication?

This does seem like a PR department writing rather then security researcher. Calling out AWS credentials seems to be particularly trolling, they just happen to be the secrets that were easiest to grep for I guess.

Indeed. I took a quick look at the "front page" of their blog and many of the post titles are what you would expect to see on press releases.

According to their "About Us" page, however, they are "a global leader in next-generation mobile security solutions." That's pretty remarkable to me considering the company was "founded in 2013" -- not bad for a year or so's work.

But I suppose that's easy to do when your "team consists of security industry veterans" (that shall go unnamed, it seems).

Maybe next week they'll reveal how my home is vulnerable to being broken into by a burglar armed with a battering ram.

Re: Critical Vulnerability: AWS Credential Disclosure

#38

Post by samstave »

yogo wrote: post #14

I'm not even sure this should be filed under vulnerability. How is this any different from embedding credentials on a webpage so that JavaScript can talk directly with the service lol.

It is a vulnerability in your environment if you're using some of these tools and your keys are in them. It is not a vulnerability of AWS itself.

Re: Critical Vulnerability: AWS Credential Disclosure

#40

Post by [deleted] »

mantrax4 wrote: post #6

One more example I'll use next time someone asks me "why service oriented architecture". Interaction with AWS should be wrapped in an app service. So the keys will be on your server. Your web sites or apps talk with that service, not the underlying implementation behind it (i.e. AWS). The API exposed by your app service should be secure by default. Sometimes some of those apps start as web sites, and they keep a lot…

[deleted]
Post reply on HN