One third of Amazon Web Services machines have customer-created security holes

German researchers have discovered major security vulnerabilities in the virtual machines published by customers of Amazon Web Services (AWS) on its infrastructure suggesting that about 30 per cent are insecure.

Scientists from the Darmstadt Research Center for Advanced Security (CASED) found that roughly a third of the 1,100 public Amazon Machine Images on the site are vulnerable, in most cases because customers had failed to heed Amazon's recommendations on security and implementation.

While the news will be bad PR to an extent for AWS, it's more the fault of its customers, and shows the immaturity of the industry.

CASED said that, while much of the industry is concentrating on whether the underlying cloud infrastructure of services provided by the likes of AWS is secure, it seems the threats are often caused by the customers themselves.

Flawed configurations meant that the researchers could harvest critical data such as passwords, cryptographic keys and certificates from the virtual machines. Such data could be used to "operate criminal virtual infrastructures, manipulate web services or circumvent security mechanisms such as Secure Shell", said CASED.

"The problem clearly lies in the customers' unawareness and not in AWS," said CASED professor Ahmad-Reza Sadeghi.

"We believe that customers of other cloud providers endanger themselves and other cloud users similarly by ignoring or underestimating security recommendations."

Mike Smart, European solutions director at SafeNet, argued that user education should be a big priority for the industry.

"As more valuable data is moved to the cloud we also need to embed better security features into cloud services and how they interact with physical infrastructure," he added.

"Solutions that take and adapt proven technologies like strong authentication and encryption to the cloud are critical. But end users should go further and ensure their digital keys are never stored on the cloud but are held and used within hardware security modules in their premises."