Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

scmagazine.com

Post reply on HN
Print view View original

11–20 of 21 posts

Re: Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

#11

Post by hypeatei »

arianvanp wrote: post #10

Though Amazon has protection against confused deputies for Principals , even within an account (every principal has a unique ID, and is account scoped), it doesn't have the same for Resources. And s3 buckets are not scoped to an account and their ARN is global and doesn't contain the account id. For the same reason i advice anybody to always use random suffixes (easily done in Terraform with name_prefix) when generat…

> And s3 buckets are not scoped to an account

Never used AWS, but how does it handle auth for data plane operations then?

Re: Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

#13

Post by teddyh »

minkles wrote: post #8
jay-barronville wrote: post #6

I’m surprised it took AWS ~4 months to fully resolve the vulnerabilities…

It has been 3 years since I reported a problem in one of their services and they still haven't found anyone who seems to even be able to understand the problem.

You mean they’ve been able to fool you for three years by only allowing to you to talk to people who won’t understand, thereby tricking you into not going public with the problem, so they don’t have to make any effort whatsoever to understand the problem, let alone fixing it.

Re: Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

#15

Post by noctarius »

hypeatei wrote: post #11
arianvanp wrote: post #10

Though Amazon has protection against confused deputies for Principals , even within an account (every principal has a unique ID, and is account scoped), it doesn't have the same for Resources. And s3 buckets are not scoped to an account and their ARN is global and doesn't contain the account id. For the same reason i advice anybody to always use random suffixes (easily done in Terraform with name_prefix) when generat…

> And s3 buckets are not scoped to an account Never used AWS, but how does it handle auth for data plane operations then?

It handles authentication on a request basis (which was its own issue just a little while ago): https://www.infoq.com/news/2024/05/aws-empty-s3-bucket-billi...

Re: Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

#16

Post by underlogic »

jay-barronville wrote: post #9
minkles wrote: post #8

Earlier quoted context omitted.

It has been 3 years since I reported a problem in one of their services and they still haven't found anyone who seems to even be able to understand the problem.

If it’s been 3 years since you reported a vulnerability, they’ve done nothing, and you can confirm the vulnerability still exists, you should tell the public about it since you’ve done your part as far as responsible disclosure is concerned—the public should know.

I don't get this responsible disclosure. Responsible to whom exactly? It takes leverage from security researchers who have risked their valuable time. Now the companies with lax security can dictate their pay, if any, through bounties while threatening them not to discuss their findings. It's corrupt

Re: Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

#17

Post by minkles »

teddyh wrote: post #13
minkles wrote: post #8

Earlier quoted context omitted.

It has been 3 years since I reported a problem in one of their services and they still haven't found anyone who seems to even be able to understand the problem.

You mean they’ve been able to fool you for three years by only allowing to you to talk to people who won’t understand, thereby tricking you into not going public with the problem, so they don’t have to make any effort whatsoever to understand the problem, let alone fixing it.

Even worse. We're a big enterprise customer. I've spoken to the people who actually architected and built the feature and they don't even understand the problem properly.

Re: Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

#18

Post by minkles »

jay-barronville wrote: post #9
minkles wrote: post #8

Earlier quoted context omitted.

It has been 3 years since I reported a problem in one of their services and they still haven't found anyone who seems to even be able to understand the problem.

If it’s been 3 years since you reported a vulnerability, they’ve done nothing, and you can confirm the vulnerability still exists, you should tell the public about it since you’ve done your part as far as responsible disclosure is concerned—the public should know.

It's not a vulnerability as such. It does retain data between two executions however that it shouldn't but we're in control of both executions so that doesn't really classify as a vulnerability.

Basically something is stateful that shouldn't be, probably because it's built on Lambda.

Re: Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

#19

Post by ls612 »

underlogic wrote: post #16
jay-barronville wrote: post #9

Earlier quoted context omitted.

If it’s been 3 years since you reported a vulnerability, they’ve done nothing, and you can confirm the vulnerability still exists, you should tell the public about it since you’ve done your part as far as responsible disclosure is concerned—the public should know.

I don't get this responsible disclosure. Responsible to whom exactly? It takes leverage from security researchers who have risked their valuable time. Now the companies with lax security can dictate their pay, if any, through bounties while threatening them not to discuss their findings. It's corrupt

“Wouldn’t it be a shame if we charged you with felonies under the CFAA. Now be a good little boy and shut up about our vulnerable systems.”

That’s basically the logic at play here, covered in an Orwellian veneer of “responsibility”.

Re: Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA

#20

Post by jay-barronville »

underlogic wrote: post #16
jay-barronville wrote: post #9

Earlier quoted context omitted.

If it’s been 3 years since you reported a vulnerability, they’ve done nothing, and you can confirm the vulnerability still exists, you should tell the public about it since you’ve done your part as far as responsible disclosure is concerned—the public should know.

I don't get this responsible disclosure. Responsible to whom exactly? It takes leverage from security researchers who have risked their valuable time. Now the companies with lax security can dictate their pay, if any, through bounties while threatening them not to discuss their findings. It's corrupt

> Responsible to whom exactly?

Unsuspecting users.

When you don’t give companies a chance to fix a vulnerability that could have serious consequences for users, you’re effectively putting the users in harm’s way by disclosing it to the public. Bad actors will take advantage of that information very quickly. Nothing good comes out of that.

Whether you like the company or not, remember that the users have no idea they’re at risk.

Post reply on HN