Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is a static site hosted on AWS S3 'hackable'?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#41

Post by liviu- »

mcintyre1994 wrote: post #39
nilsjuenemann wrote: post #33

Earlier quoted context omitted.

That isn't true. Every static website could be vulnerable through DOM XSS. In this case the integrity of the site is violated. PoC: http://bit.ly/1S834lS - redirects to http://www.heute.de/#"> src=x onerror=document.write(String.fromCharCode(60,105,102,114,97,109,101, 32,115,114,99,61,34,104,116,116,112,58,47,47,99,97,116, 46,119,119,119,46,104,101,117,116,101,46,100,101,46,109,101,111,119, 98,105,102,121,46,99,111,1…

Hey, would you mind splitting that line up a bit? It's screwing with the layout and making a lot of comments really wide. Edit: Thanks :)

Sounds like a bug in HN layout. One fix is setting ".default" a `max-width` attribute, and ".comment { overflow-wrap: break-word; }`.

User styles managers can fix this per user, but I sent HN an email to let them know.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#42

Post by lmm »

kirushik wrote: post #36
robwormald wrote: post #32

Earlier quoted context omitted.

My parent's business got nailed by #4, and its been an unbelievable nightmare dealing with. Any suggestions on secure domain registrars?

Gandi works reasonably good for me. AFAIR, it's also under French jurisdiction, not a US one. (This might be good in case of fake DMCA takedowns, but also bad in some other cases...)

I've heard Gandi recommended against since they have a morality clause in their ToS.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#43

Post by matiu »

How I would hack it (if I was evil and cared enough):

1. Gather info from whois DB, google search, site spidering, going to your house and looking through your trash.

2. Ring you up - Hello I'm Joe from the tax department/credit card company/bank we need to confirm your address .. give your address .. could I please confirm you are the credit card holder, I just need the last 4 digits

3. Ring your friends, family and business contacts - use smooth talking to gather as much info as possible.

4. Ring up Amazon - oh yes I am mister XXX, I forgot my password, please can you reset it. If they don't I'll try to guess information, and glean any info out of the replies.

5. Ring up your email provider and do the same

6. Keep on ringing about 8 hours apart to make sure I get different teams, so it's fresh each time, until I had enough info to get access to the account

7. Make sure to delete all backups

8. Deface to my hearts content - change all the passwords, blah blah

--------

This is the info I'd try and gather:

* Name - probably from whois

* DOB - probably from public records search - or ringing friends

* Phone - probably from your trash or mailbox

* Last four credit card digits - probably will get from your trash, or tricking you on the phone

* Date of last payment - Probably from tricking Amazon

* Password bits - pet's name, girfriend/wife/child names and ages, keylogger in an email I sent you

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#44

Post by TamDenholm »

matiu wrote: post #43

How I would hack it (if I was evil and cared enough): 1. Gather info from whois DB, google search, site spidering, going to your house and looking through your trash. 2. Ring you up - Hello I'm Joe from the tax department/credit card company/bank we need to confirm your address .. give your address .. could I please confirm you are the credit card holder, I just need the last 4 digits 3. Ring your friends, family and…

As always the weakest part of any security system is the people within it.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#45

Post by jmnicolas »

rsync wrote: post #26
dguido wrote: post #16

Earlier quoted context omitted.

No one has the source or binary code for the webserver AWS uses. It would be nearly impossible to write an exploit for it blind like that. Even if you did write it blind, it would be a slow process that likely requires bruteforcing parts of the address space and there is no way you could do it without alerting Amazon. tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinki…

"tl;dr what you described is possible, I guess, but so incredibly unlikely it's not even worth thinking about." How would you rate it, in terms of "worth thinking about", relative to USB keys picked up off of the ground to infect industrial controllers to make centrifuges wiggle the wrong way ? Where would you stick that in, you know, in your "worth thinking about it" spectrum ? Just curious.

I think it's not "worth thinking about" for someone that has to ask this question on HN.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#46

Post by brianwawok »

lmm wrote: post #42
kirushik wrote: post #36

Earlier quoted context omitted.

Gandi works reasonably good for me. AFAIR, it's also under French jurisdiction, not a US one. (This might be good in case of fake DMCA takedowns, but also bad in some other cases...)

I've heard Gandi recommended against since they have a morality clause in their ToS.

If you are selling peaches or dogfood, does it matter?

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#47

Post by lmm »

brianwawok wrote: post #46
lmm wrote: post #42

Earlier quoted context omitted.

I've heard Gandi recommended against since they have a morality clause in their ToS.

If you are selling peaches or dogfood, does it matter?

If you are selling peaches or dogfood you don't care about any of the stuff in this whole thread - who's even going to attack you? The organizations that have to worry about this stuff are those who are doing something controversial.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#48

Post by kirushik »

lmm wrote: post #47
brianwawok wrote: post #46

Earlier quoted context omitted.

If you are selling peaches or dogfood, does it matter?

If you are selling peaches or dogfood you don't care about any of the stuff in this whole thread - who's even going to attack you? The organizations that have to worry about this stuff are those who are doing something controversial.

Or just having some really reckless competitors. Uber-vs-Lyft style reckless.

Re: Ask HN: Is a static site hosted on AWS S3 'hackable'?

#50

Post by mattkrea »

bigiain wrote: post #7
mattkrea wrote: post #5

Earlier quoted context omitted.

I don't think anyone will be willing to say yes or no. Just don't count on something being 'unhackable'. AFAIK there are no published flaws in S3 static hosting.

I will say "Yes". With 100% certainty. Interesting people do stuff like this "for fun": http://dangerousprototypes.com/2013/01/19/29c3-travis-goodsp... and this: http://spritesmods.com/?art=hddhack How much would you bet against the people described below having even better versions of those two hacks, and being fully aware of Amazon's supply chain? "The book included a photograph of intercepted packages being opened…

Haha, well if your threat model includes the government I'm fairly certain we're all screwed.
Post reply on HN