21–30 of 73 posts
It’s still true that most security issues are caused by human ineptitude, not clever vulnerability-hunting or burning sophisticated zero-days.
I would replace "human ineptitude" with "flawed system design that makes it very easy to make very bad mistakes"
I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple acc…
Laziness in attempting to share data with someone in another org? "Nope, can't access it" ... "Nope, still can't access it"... "My manager is harassing me to get access now"... "Look, just make it public then change it back after I get it copied"...
Earlier quoted context omitted.
I would replace "human ineptitude" with "flawed system design that makes it very easy to make very bad mistakes"
But is the flawed system design here the automated system at AWS or the human-in-the-loop systems by which companies are providing admin access to IT resources, including AWS accounts?
I am so confused.
It would be trivial to make finding a snapshot require knowing a unique ID like an AMI.
And, why do I need to be able to search for 1000s of customers' public snapshots in the EC2 console? What conceivable purpose does that serve except being a giant opsec fail?
I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple acc…
There needs to be controls like S3 where you can explicitly block public data.
AWS IAM kind of sucks.
Earlier quoted context omitted.
For EBS, step 1 is reading the docs, step 2 is cutpasting a documentation example. For S3 I'm not sure how people are building their lists. AFAIK the API provides no enumeration. So this is possibly something coming from web crawl data (e.g. common crawl)
Perhaps something like this? https://github.com/eth0izzle/bucket-stream
The creator of the first Ubuntu distros for EC2 wrote about the dangers of public EBS snapshots 10 years ago: https://alestic.com/2009/09/ec2-public-ebs-danger/ He just got notified by AWS a couple days ago about the public snapshot he mentioned in the article. But at least AWS is trying to make things better here by proactively checking for public EBS snapshots and notifying people.
Earlier quoted context omitted.
Laziness in attempting to share data with someone in another org? "Nope, can't access it" ... "Nope, still can't access it"... "My manager is harassing me to get access now"... "Look, just make it public then change it back after I get it copied"...
The guy that produces that last line definitely wears a suit.
Earlier quoted context omitted.
But is the flawed system design here the automated system at AWS or the human-in-the-loop systems by which companies are providing admin access to IT resources, including AWS accounts?
Probably both! But I would argue that below a certain size provisioning things by hand probably makes sense. A UI that makes it too easy to make a private thing public is never ok.