Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hundreds of exposed Amazon cloud backups found leaking sensitive data

techcrunch.com

Post reply on HN
Print view View original

31–40 of 73 posts

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#32

Post by flavor8 »

rolltiide wrote: post #8
d2mw wrote: post #2

Public EBS snapshots are great, and thankfully a design other clouds didn't copy. I've found all kinds of stuff in there, including a 900GB Oracle backup of a publicly traded manufacturer's accounting system. It doesn't require much imagination to understand how this kind of data could be profited from, given relatively low effort It seems unlikely a lot of people didn't already know about this, it's hard to miss eve…

How do you scour for EBS snapshots and open browsable S3 buckets?

All public EBS snapshots appear in the EC2 > Snapshots section in the AWS UI. Toggle the dropdown in the top right of the table to "Public" and you'll see them. Sort by size and you'll get some interesting looking ones at the top.

It reminds me a bit of old time cdroms.

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#33

Post by 1000units »

fixitfixit wrote: post #28
lowdose wrote: post #22

Earlier quoted context omitted.

The guy that produces that last line definitely wears a suit.

Oh no. I work with very trendy Silicon Valley folks and it’s always someone in shorts and a t-shirt. Which is to say: it’s definitely a culture issue, but it doesn’t have to be a PHB doing it. I know a lot of really smart people who are under a lot of pressure, and combined with a lack of AWS knowledge, “just make it public” is surprisingly common.

And it's worth noting a nonnegligible percentage of high-achieving businesspeople would torture small animals for the right price. Being a little lax with security policies under pressure isn't so shocking.

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#34

Post by ggg3 »

AaronFriel wrote: post #24

I just checked an EC2 console and I can see 19,356 snapshots created by other users. I am so confused. It would be trivial to make finding a snapshot require knowing a unique ID like an AMI. And, why do I need to be able to search for 1000s of customers' public snapshots in the EC2 console? What conceivable purpose does that serve except being a giant opsec fail?

because having the bad guys go trhu the trouble of using a search engine like kuro et al will save the day?

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#39

Post by deadmutex »

lowdose wrote: post #22
dboreham wrote: post #11

Earlier quoted context omitted.

Laziness in attempting to share data with someone in another org? "Nope, can't access it" ... "Nope, still can't access it"... "My manager is harassing me to get access now"... "Look, just make it public then change it back after I get it copied"...

The guy that produces that last line definitely wears a suit.

This seems like a bias
Post reply on HN