AWS Support able to access any S3 object due to permission change • Hacker News Board

Re: AWS Support able to access any S3 object due to permission change

#11

Post by comboy » Thu, Dec 23, 2021, 8:48 AM UTC

878654Tom wrote: post #8

_3u10 wrote: post #4

It’s their servers, they can do whatever they want with them. What are you going to do about it they have physical access, you have an API key. Suggestion, if you want to secure your data don’t put it on other peoples computers, and for fucks sake don’t store your crypto keys on someone else’s computer.

That is a really false statement. This is why contracts, audits,... exists and they define what each party can and can't do. When in violation this could result in huge fines, loss of business,... You can also securely storage your data on other servers by using client-side encryption. Not every business/person has the means or knowledge to have their own datacenter.

> You can also securely storage your data on other servers by using client-side encryption.

Hey but you have audits, contracts, why would you need that? You are effectively saying the same thing that parent comment is. You're just offering a more practical solution.

Re: AWS Support able to access any S3 object due to permission change

#12

Post by rvz » Thu, Dec 23, 2021, 8:49 AM UTC

So its completely Amazon's storage then? Given that and it's not your computer, so it also not your storage (even it is encrypted)?

If all of the above is true, is it time to panic? Perhaps maybe that why the cloud is somewhat of a scam anyways?

Re: AWS Support able to access any S3 object due to permission change

#13

Post by 878654Tom » Thu, Dec 23, 2021, 8:58 AM UTC

comboy wrote: post #11

878654Tom wrote: post #8

Earlier quoted context omitted.

That is a really false statement. This is why contracts, audits,... exists and they define what each party can and can't do. When in violation this could result in huge fines, loss of business,... You can also securely storage your data on other servers by using client-side encryption. Not every business/person has the means or knowledge to have their own datacenter.

> You can also securely storage your data on other servers by using client-side encryption. Hey but you have audits, contracts, why would you need that? You are effectively saying the same thing that parent comment is. You're just offering a more practical solution.

There are many reasons to do client-side encryption, some of them are that you want to storage the data on multiple storage providers but with the same key.

A national law of the country explicitly tells the company to do so, or a company you are in contract with asks of you to do so. The key that S3 can provide is not good enough for your internal usage,...

Stop looking at everything pure technically because that is not how the real world works.

Re: AWS Support able to access any S3 object due to permission change

#14

Post by usr1106 » Thu, Dec 23, 2021, 9:02 AM UTC

878654Tom wrote: post #8

_3u10 wrote: post #4

It’s their servers, they can do whatever they want with them. What are you going to do about it they have physical access, you have an API key. Suggestion, if you want to secure your data don’t put it on other peoples computers, and for fucks sake don’t store your crypto keys on someone else’s computer.

That is a really false statement. This is why contracts, audits,... exists and they define what each party can and can't do. When in violation this could result in huge fines, loss of business,... You can also securely storage your data on other servers by using client-side encryption. Not every business/person has the means or knowledge to have their own datacenter.

> When in violation this could result in huge fines, loss of business,...

The stress is on could. AWS is too big to be allowed to fail. Has Facebook seen such severe consequences because of known misconduct? And AWS is in a much more critical role for many businesses.

Re: AWS Support able to access any S3 object due to permission change

#15

Post by 878654Tom » Thu, Dec 23, 2021, 9:09 AM UTC

usr1106 wrote: post #14

878654Tom wrote: post #8

Earlier quoted context omitted.

That is a really false statement. This is why contracts, audits,... exists and they define what each party can and can't do. When in violation this could result in huge fines, loss of business,... You can also securely storage your data on other servers by using client-side encryption. Not every business/person has the means or knowledge to have their own datacenter.

> When in violation this could result in huge fines, loss of business,... The stress is on could. AWS is too big to be allowed to fail. Has Facebook seen such severe consequences because of known misconduct? And AWS is in a much more critical role for many businesses.

This will probably end in nothing, that is true.

But it could impact them if there came an issue out of it (someone can prove that AWS downloaded some of their files). AWS doesn't want to go in the news that they look at their customer data as that would impact the decisions of future and current deals of hosting their data on AWS.

I've worked for some big financial institutions and the longest part of the contract with AWS was all lawyers going over what is happening with the data, how AWS has access to it and especially how it doesn't have access to it.

Re: AWS Support able to access any S3 object due to permission change

#16

Post by raffraffraff » Thu, Dec 23, 2021, 9:15 AM UTC

hericium wrote: post #5

rronalddas wrote: post #2

KMS Encrypted objects shouldn't be affected though

Aren't KMS keys created by Amazon?

There are three types of S3 server side encryption:

- SSE-KMS

- SSE-S3

- SSE-C

Without having an AWS support person test each type and report back, one must assume that the only bulletproof s3 encryption methods are client-side (where you handle encryption and decryption yourself and they just store the blob) and SSE-C (where AWS don't store your keys, you send them in every bucket API request). But even that latter method has other caveats:

- What does the S3 service log? Who can access those logs?

- Where does TLS for your S3 https request get terminated? Who can view the traffic?

I'm assuming that this isn't just a regional issue, and that any AWS Support person globally could access buckets in any region. If so, then that's a big deal. If you're in Europe and your bank or healthcare provider is an AWS customer, how much trouble could you cause them (and by extension, AWS) right now?

Furthermore, with the antiwork movement and backlash amongst employees for their treatment of warehouse workers, one cannot guarantee that an AWS worker wouldn't do something to hurt the company.

Amazon need to head this of with a very thorough explanation of what happened and what was exposed directly and indirectly.

Re: AWS Support able to access any S3 object due to permission change

#17

Post by _3u10 » Thu, Dec 23, 2021, 9:19 AM UTC

deanCommie wrote: post #7

_3u10 wrote: post #4

It’s their servers, they can do whatever they want with them. What are you going to do about it they have physical access, you have an API key. Suggestion, if you want to secure your data don’t put it on other peoples computers, and for fucks sake don’t store your crypto keys on someone else’s computer.

A very shortsighted take. Sure, yes "they" can do whatever they want. But even in the world you are imagining where AWS is peeking at customer's data willy-nilly, I have to imagine you don't believe that every tech support representative should have default access to every AWS customer's storage data, do you? Even a dishonest unethical company that created backdoors for its employees would surely gate their backdoors…

AWS has regions in China, they verifiably DO have access to your data.

They also have regions in the US where they verifiably DO have access to your data.

Both points of access are verifiable by their compliance with the law in those countries ensuring that the government can access that data.

If you use their CA or EU locations it’s conceivable that they’ve developed separate software that actually protects your data but I would hazard a guess that they use the same backdoored software there once it has been sufficiently beta tested in us-east-1

Re: AWS Support able to access any S3 object due to permission change

#18

Post by _3u10 » Thu, Dec 23, 2021, 9:35 AM UTC

878654Tom wrote: post #8

_3u10 wrote: post #4

It’s their servers, they can do whatever they want with them. What are you going to do about it they have physical access, you have an API key. Suggestion, if you want to secure your data don’t put it on other peoples computers, and for fucks sake don’t store your crypto keys on someone else’s computer.

That is a really false statement. This is why contracts, audits,... exists and they define what each party can and can't do. When in violation this could result in huge fines, loss of business,... You can also securely storage your data on other servers by using client-side encryption. Not every business/person has the means or knowledge to have their own datacenter.

Amazon has many cases where they’ve been found to have violated contracts, laws, etc.

The rest of the points save for keeping the keys on your own hardware is orthogonal to whether Amazon with physical access to your data could access it.

I think we are both in agreement that in most cases the data isn’t worth accessing which is the real world protection most data on Amazon has.

Re: AWS Support able to access any S3 object due to permission change

#19

Post by ptcrash » Thu, Dec 23, 2021, 9:35 AM UTC

ealexhudson wrote: post #10

ptcrash wrote: post #9

Okay, opinions up front: I don't think this is worthy of "declaring a security incident. Having some experience working behind the scenes, just because this policy was changes this way doesn't mean "All AWS Support personnel had unrequited access to your S3 objects." To me, this reads as Twitter inflammatory nonsense. Here's why: * KMS Encrypted objects would not be accessible because the support personnel would need…

"Declaring an incident" means there's something to investigate, it didn't mean anything bad has happened: it's detection of a non-conformity. The output of the incident would look similar to what you wrote. Any time the wrong permissions are assigned and confidentiality is potentially breached, I think you have to have an incident. Arguably in some jurisdictions, it's a legal requirement to ensure you have a near mis…

That's enlightening; thanks. Hopefully the steps forward for determining scope and affected objects is easy

Re: AWS Support able to access any S3 object due to permission change

#20

Post by lmilcin » Thu, Dec 23, 2021, 9:36 AM UTC

raffraffraff wrote: post #16

hericium wrote: post #5

Earlier quoted context omitted.

Aren't KMS keys created by Amazon?

There are three types of S3 server side encryption: - SSE-KMS - SSE-S3 - SSE-C Without having an AWS support person test each type and report back, one must assume that the only bulletproof s3 encryption methods are client-side (where you handle encryption and decryption yourself and they just store the blob) and SSE-C (where AWS don't store your keys, you send them in every bucket API request). But even that latter…

> Without having an AWS support person test each type and report back, one must assume that the only bulletproof s3 encryption methods are client-side

It is normal practice to have a 3rd party access to your technical infrastructure (for example for purpose of support/maintenance). I was once contracted to maintain database for another company. You sign NDAs, you sign penalties, you sign your children to slavery and the right of first night with your wife. You know, standard business practice.

But if you care enough that you would not have contracted 3rd party access to the data, client-side is the only solution assuming the client is under your sole control.