The fact that the consultant - unprompted - knows exactly what is going on suggests to me that Amazon needs to fix this. If one customer gets burned then the customer is an idiot. If lots of customers get burned then maybe its not the customers that are the problem.
$5,000 Security Breach
21–26 of 26 posts
Re: $5,000 Security Breach
#22We had an almost identical event last Sunday in one of our dev accounts: multiple high end spot instances in multiple regions with a newly created security group pointing to a suspect IP.
We caught and corrected it quickly, but we still don't know how the keys leaked out - we have chalked it up to lower security practices since it's not a production account and is shared by more people (e.g. no 2-factor on it). We started to investigate, but then Heartbleed happened.
I wish there were more mechanism in AWS to prevent bills from mounting up, but the basic billing alarms worked in this case. I can't imagine how or why spot instances would be excluded from alerts, their cost certainly is included in the estimates that alerts are based on.
Re: $5,000 Security Breach
#23I have 2-factor auth enabled on my AWS login - but am I right in thinking that if someone has my API keys that they don't need the 2nd factor?
Yes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.
Which is why most things should be done with IAM keys specifically locked down to minimal privileges.
Re: $5,000 Security Breach
#24Earlier quoted context omitted.
Well, getting an SSL private key is difficult as they don't often get into memory and are quite long (difficult to get from 64k at a time). Whereas AWS credential keys are something that get into your servers RAM much more frequently and are shorter strings. So it could easily be remote memory exploitation. But more likely social engineering or some other easy path in.
Heartbleed only exposed SSL memory (like incoming or outcoming connections), but not other memory (particularly not program memory), containing AWS keys.
[deleted]
Re: $5,000 Security Breach
#25Earlier quoted context omitted.
Yes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.
Which is why most things should be done with IAM keys specifically locked down to minimal privileges.
Agreed
Re: $5,000 Security Breach
#26Earlier quoted context omitted.
Yes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.
Which is why most things should be done with IAM keys specifically locked down to minimal privileges.
Apparently I have access keys that predate the release of IAM ! Fortunately there's a convenient "disable" link on security keys page.