Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is a static site hosted on AWS S3 'hackable'?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#21

Post by evandrix »

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

"Not through a web application vulnerability it can't (there is no application code to break!)." eg. metadata in images can contain executable code

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#23

Post by geofft »

rsync wrote: post #14
dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

"Not through a web application vulnerability it can't (there is no application code to break!)." This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server. So let's say the S3 data is immutab…

If Amazon is running a general-purpose web server with persistent state for S3 static hosting, I'd argue they're doing something very wrong.

It's not hard to write a web server that reads from persistent storage but has no need or ability to write to persistent storage. (You can give it a cache, but the cache is destroyable.) So you can attack the web server in memory (maybe), but there's no way to persist the attack. As soon as the web server gets restarted, the attack goes away, and there's also no way to spread the attack from one web server to any of the countless others.

Then it's a simple matter of load-balancing at scale and restarting these stateless web servers on a regular basis to make exploits infeasible, at least until you get to substantially more motivated and funded attackers. And Amazon is a fan of both load-balancing at scale and restarting things.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#24

Post by geofft »

evandrix wrote: post #21
dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

"Not through a web application vulnerability it can't (there is no application code to break!)." eg. metadata in images can contain executable code

Not intentionally-executable code, and unintentionally-executable code (i.e. exploits in image renderers) would affect the client, not the server, which isn't the direction we're concerned about.

If the server transcodes images, then yes, it should do the transcoding in a throwaway sandbox that outputs some hard-to-misparse intermediate format like a raw pixel array. But S3 doesn't do transcoding.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#25

Post by ossreality »

morgante wrote: post #20
dguido wrote: post #16

Earlier quoted context omitted.

No one has the source or binary code for the webserver AWS uses. It would be nearly impossible to write an exploit for it blind like that. Even if you did write it blind, it would be a slow process that likely requires bruteforcing parts of the address space and there is no way you could do it without alerting Amazon. tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinki…

Nobody has the source or binary code for dozens of proprietary systems which get hacked on a regular basis. In fact, I'd argue that most prominent hacks are of systems which are not open source.

And are probably, for example, IIS which I can at least open in a debugger or hexedit and look at.

Some very-proprietary service serving S3 content? Yeah, right.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#26

Post by rsync »

dguido wrote: post #16
rsync wrote: post #14

Earlier quoted context omitted.

"Not through a web application vulnerability it can't (there is no application code to break!)." This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server. So let's say the S3 data is immutab…

No one has the source or binary code for the webserver AWS uses. It would be nearly impossible to write an exploit for it blind like that. Even if you did write it blind, it would be a slow process that likely requires bruteforcing parts of the address space and there is no way you could do it without alerting Amazon. tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinki…

"tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinking about."

How would you rate it, in terms of "worth thinking about", relative to USB keys picked up off of the ground to infect industrial controllers to make centrifuges wiggle the wrong way ?

Where would you stick that in, you know, in your "worth thinking about it" spectrum ?

Just curious.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#27

Post by rsync »

ajross wrote: post #19
rsync wrote: post #14

Earlier quoted context omitted.

"Not through a web application vulnerability it can't (there is no application code to break!)." This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server. So let's say the S3 data is immutab…

If the threat model posits an attacker with an exploit for Amazon S3, then we're well out of the realm that is appropriate for security questions about static web sites. That's not to say that S3 could not possibly be broken, but if it is, there are vastly more attractive targets for that attack than some random static site.

"If the threat model posits an attacker with an exploit for Amazon S3"

No, I'm not talking about an "S3 exploit". In fact, quite the opposite. I'm talking about an exploit for the web server that serves static S3 sites (and yes, it is a web server) which would serve arbitrary content instead of the underlying S3 content.

The end user doesn't care that you injected the defaced content vs. altered the underlying content - defaced is defaced.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#28

Post by vacri »

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

> Make sure you use a secure domain registrar

AWS now resells domains from a selection of TLDs (generally the most common ones). They've partnered with gandi.net, who does the backend registrar stuff, but you can do it all from the Route53 AWS console. Means you can keep everything all in one place.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#29

Post by kriro »

dguido wrote: post #16
rsync wrote: post #14

Earlier quoted context omitted.

"Not through a web application vulnerability it can't (there is no application code to break!)." This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server. So let's say the S3 data is immutab…

No one has the source or binary code for the webserver AWS uses. It would be nearly impossible to write an exploit for it blind like that. Even if you did write it blind, it would be a slow process that likely requires bruteforcing parts of the address space and there is no way you could do it without alerting Amazon. tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinki…

That is a very weak argument. If anything I'd argue it's a net negative and not a positive that the code is closed from a security POV.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#30

Post by [deleted] »

dguido wrote: post #16
rsync wrote: post #14

Earlier quoted context omitted.

"Not through a web application vulnerability it can't (there is no application code to break!)." This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server. So let's say the S3 data is immutab…

No one has the source or binary code for the webserver AWS uses. It would be nearly impossible to write an exploit for it blind like that. Even if you did write it blind, it would be a slow process that likely requires bruteforcing parts of the address space and there is no way you could do it without alerting Amazon. tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinki…

[deleted]
Post reply on HN