Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is a static site hosted on AWS S3 'hackable'?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 51 posts

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#11

Post by Gigablah »

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

A custom TLS cert for Cloudfront costs $600/month. And that's just to deploy it, you still have to buy the cert yourself.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#12

Post by jaggederest »

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

There are various other ways you could alter a static website too - leaving aside client-side stuff like malware, you could DNS hijack or MITM it with a bogus cert.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#13

Post by imperalix »

Gigablah wrote: post #11
dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

A custom TLS cert for Cloudfront costs $600/month. And that's just to deploy it, you still have to buy the cert yourself.

SNI only distributions don't cost $600/month.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#14

Post by rsync »

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

"Not through a web application vulnerability it can't (there is no application code to break!)."

This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server.

So let's say the S3 data is immutable, as far as the "web server" and the attacker are concerned ... that's very nice, of course, but if you have control over the web server, instead of parlaying that into control over the underlying data, just tell the web server to spit out other data.

The S3 content is still safe and unchanged, but your website is nicely defaced, since your "amazon s3 webserver" exploit is just feeding it new content.

(drastically oversimplified, of course - but be clear, if there is a web server (and there is) there is web-server-attack-surface)

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#15

Post by kalleboo »

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

Re: 2. Uploading an SSL cert and using it on CloudFront is free, as long as you're fine with it requiring SNI. CloudFlare "Universal SSL" also requires SNI. The $600/mo thing is if you want dedicated IPs at all their endpoints.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#16

Post by dguido »

rsync wrote: post #14
dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

"Not through a web application vulnerability it can't (there is no application code to break!)." This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server. So let's say the S3 data is immutab…

No one has the source or binary code for the webserver AWS uses. It would be nearly impossible to write an exploit for it blind like that. Even if you did write it blind, it would be a slow process that likely requires bruteforcing parts of the address space and there is no way you could do it without alerting Amazon.

tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinking about.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#18

Post by dguido »

jaggederest wrote: post #12
dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

There are various other ways you could alter a static website too - leaving aside client-side stuff like malware, you could DNS hijack or MITM it with a bogus cert.

OP mentioned they had a dedicated computer, so I ignored endpoint security issues.

DNS hijacking and other firms of network MITM are a risk, sure, but they are so incredibly rare to see in the wild that it's outside the scope of most people's concerns. "Normal" attackers generally can't pull it off.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#19

Post by ajross »

rsync wrote: post #14
dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

"Not through a web application vulnerability it can't (there is no application code to break!)." This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server. So let's say the S3 data is immutab…

If the threat model posits an attacker with an exploit for Amazon S3, then we're well out of the realm that is appropriate for security questions about static web sites.

That's not to say that S3 could not possibly be broken, but if it is, there are vastly more attractive targets for that attack than some random static site.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#20

Post by morgante »

dguido wrote: post #16
rsync wrote: post #14

Earlier quoted context omitted.

"Not through a web application vulnerability it can't (there is no application code to break!)." This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server. So let's say the S3 data is immutab…

No one has the source or binary code for the webserver AWS uses. It would be nearly impossible to write an exploit for it blind like that. Even if you did write it blind, it would be a slow process that likely requires bruteforcing parts of the address space and there is no way you could do it without alerting Amazon. tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinki…

Nobody has the source or binary code for dozens of proprietary systems which get hacked on a regular basis.

In fact, I'd argue that most prominent hacks are of systems which are not open source.

Post reply on HN