Hundreds of exposed Amazon cloud backups found leaking sensitive data

Post by spydum » Sat, Aug 10, 2019, 1:04 AM UTC

t34543 wrote: post #25

joncrane wrote: post #5

I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple acc…

Aren’t public EBS snapshots the underlying mechanism for public AMIs? I’ve ran into complex permissions in a golden image deploy model where the same AMI is used across multiple accounts. There needs to be controls like S3 where you can explicitly block public data. AWS IAM kind of sucks.

Post by thegeomaster » Sat, Aug 10, 2019, 1:14 AM UTC

atoav wrote: post #47

lowdose wrote: post #22

Earlier quoted context omitted.

The guy that produces that last line definitely wears a suit.

As much as I dislike the typical suit wearer, the industry as a whole would be much better if IT-people wouldn’t blame everything on them and just tell them you won’t do it. If you are a welder and you boss wants you to weld a gas tank that hasn’t been emptied you tell him that he has no idea what the thing he asks for means, explain why and wait till the gas tank is emptied and everything is checked. I worked as a C…

Post by joncrane » Sat, Aug 10, 2019, 2:25 AM UTC

dboreham wrote: post #11

joncrane wrote: post #5

I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple acc…

Laziness in attempting to share data with someone in another org? "Nope, can't access it" ... "Nope, still can't access it"... "My manager is harassing me to get access now"... "Look, just make it public then change it back after I get it copied"...

Post by jcims » Sat, Aug 10, 2019, 3:11 AM UTC

AaronFriel wrote: post #24

I just checked an EC2 console and I can see 19,356 snapshots created by other users. I am so confused. It would be trivial to make finding a snapshot require knowing a unique ID like an AMI. And, why do I need to be able to search for 1000s of customers' public snapshots in the EC2 console? What conceivable purpose does that serve except being a giant opsec fail?

Post by judge2020 » Sat, Aug 10, 2019, 3:55 AM UTC

AaronFriel wrote: post #24

I just checked an EC2 console and I can see 19,356 snapshots created by other users. I am so confused. It would be trivial to make finding a snapshot require knowing a unique ID like an AMI. And, why do I need to be able to search for 1000s of customers' public snapshots in the EC2 console? What conceivable purpose does that serve except being a giant opsec fail?