Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hundreds of exposed Amazon cloud backups found leaking sensitive data

techcrunch.com

Post reply on HN
Print view View original

11–20 of 73 posts

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#11

Post by dboreham »

joncrane wrote: post #5

I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple acc…

Laziness in attempting to share data with someone in another org?

"Nope, can't access it" ...

"Nope, still can't access it"...

"My manager is harassing me to get access now"...

"Look, just make it public then change it back after I get it copied"...

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#12

Post by eli »

snazz wrote: post #7
eli wrote: post #6

Earlier quoted context omitted.

I would replace "human ineptitude" with "flawed system design that makes it very easy to make very bad mistakes"

That's a valid way to categorize all memory errors in C.

And I think we should absolutely hold that against C as a development language.

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#13

Post by fromthestart »

joncrane wrote: post #5

I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple acc…

>Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public?

Maybe they're trying to reproduce functionality of docker? It would actually be extremely useful for research involving modeling/AI because you could trivially reproduce the results by bundling the exact code and data.

Edit: actually maybe I'm confusing EBS snapshots with AMIs...

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#14

Post by mtgx »

eli wrote: post #6
snazz wrote: post #4

It’s still true that most security issues are caused by human ineptitude, not clever vulnerability-hunting or burning sophisticated zero-days.

I would replace "human ineptitude" with "flawed system design that makes it very easy to make very bad mistakes"

Not sure why you're downvoted. It's pretty clear that when a lot of people make "dumb mistakes" despite the solution being "obvious", it's because a flawed system design.

Look at the simplest analogy to this - the opt-out/opt-in buttons. If something is opt-out by default, then most people will leave it that way, even if they have no good reason to leave it is. And advertising companies like Google and Facebook take full advantage of this.

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#15

Post by moduspol »

d2mw wrote: post #10
rolltiide wrote: post #8

Earlier quoted context omitted.

How do you scour for EBS snapshots and open browsable S3 buckets?

For EBS, step 1 is reading the docs, step 2 is cutpasting a documentation example. For S3 I'm not sure how people are building their lists. AFAIK the API provides no enumeration. So this is possibly something coming from web crawl data (e.g. common crawl)

Perhaps something like this?

https://github.com/eth0izzle/bucket-stream

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#16

Post by heyoni »

dboreham wrote: post #11
joncrane wrote: post #5

I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple acc…

Laziness in attempting to share data with someone in another org? "Nope, can't access it" ... "Nope, still can't access it"... "My manager is harassing me to get access now"... "Look, just make it public then change it back after I get it copied"...

goes home completely forgetting to change it back...

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#17

Post by dragonwriter »

d2mw wrote: post #2

Public EBS snapshots are great, and thankfully a design other clouds didn't copy. I've found all kinds of stuff in there, including a 900GB Oracle backup of a publicly traded manufacturer's accounting system. It doesn't require much imagination to understand how this kind of data could be profited from, given relatively low effort It seems unlikely a lot of people didn't already know about this, it's hard to miss eve…

> and it's also quite surprising AWS have yet to correct the design. 90% chance it is mostly a UI problem -- there are no warning labels around snapshotting in the EC2 UI

Snapshots are private by default, you have to actively make them public (impossible if encrypted) or share them (which also requires sharing the associated keys if encrypted.)

Now, AWS hasn't wrapped the extra layer of “by default, reject any setting or policy allowing public or cross-account access unless separate additional default switches have been toggled off” thing to EBS that they have to S3. But people still expose stuff via S3, so that's hardly a panacea. At some point, one has to conclude that customers are responsible, in many cases for giving too many(or just the wrong) people admin access to their accounts.

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#18

Post by slenk »

d2mw wrote: post #2

Public EBS snapshots are great, and thankfully a design other clouds didn't copy. I've found all kinds of stuff in there, including a 900GB Oracle backup of a publicly traded manufacturer's accounting system. It doesn't require much imagination to understand how this kind of data could be profited from, given relatively low effort It seems unlikely a lot of people didn't already know about this, it's hard to miss eve…

Well, for S3 buckets, Amazon has made it very clear when it is public. It also used to be pretty clear.

For EBS - nothing is public by default, so customers have to willingly decide to click buttons to make it public.

By default, if I create a snapshot, it is NOT public...

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#19

Post by dragonwriter »

eli wrote: post #6
snazz wrote: post #4

It’s still true that most security issues are caused by human ineptitude, not clever vulnerability-hunting or burning sophisticated zero-days.

I would replace "human ineptitude" with "flawed system design that makes it very easy to make very bad mistakes"

But is the flawed system design here the automated system at AWS or the human-in-the-loop systems by which companies are providing admin access to IT resources, including AWS accounts?

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#20

Post by jedberg »

The creator of the first Ubuntu distros for EC2 wrote about the dangers of public EBS snapshots 10 years ago:

https://alestic.com/2009/09/ec2-public-ebs-danger/

He just got notified by AWS a couple days ago about the public snapshot he mentioned in the article.

But at least AWS is trying to make things better here by proactively checking for public EBS snapshots and notifying people.

Post reply on HN