All the latest UK technology news, reviews and analysis

Leaky Amazon S3 buckets put thousands of company secrets at risk

28 Mar 2013
Amazon Web Services logo

Researchers have uncovered thousands of misconfigured Amazon S3 storage buckets, making it possible to obtain access to potentially highly sensitive company data.

In the tests, penetration testing firm Rapid 7 was able to access personal photos from a social media service, a car dealership's sales records and account information, firms' employee records as well as unprotected database backups containing site data and encrypted password.

According to Will Vandevanter, senior security consultant at Rapid 7, the firm was able to access the information having identified more than a thousand publicly accessible Amazon S3 storage buckets.

Firms typically use Amazon's S3 system to store static content such as server backups, company documents, web logs, and publicly visible content such as website images. The files in S3 are then organised into so-called buckets.

“Although a file might be listed in a bucket it does not necessarily mean that it can be downloaded. Buckets and objects have their own access control lists,” Vandevanter wrote on a company blog.

Firms that had stored their data insecurely in S3 could be set for a rude awakening, he warned.

“Much of the data could be used to stage a network attack, compromise users accounts, or to sell on the black market.”

Typically, Amazon would make S3 buckets private, so the public ones are likely to be the results of users misconfiguration, said Vandevanter. 

Nonetheless, Amazon Web Services makes it easier for would-be hackers by using a URL structure that is easy to guess, making it child's play to access public buckets.

“Checking if a bucket is public or private is easy. All buckets have a predictable and publicly accessible URL,” he added.

Having identified hundreds of public buckets, Vandevanter and his colleagues took a random sample to check which buckets had accessible content.

They discovered more than five million accessible text documents, many of which where marked 'private' or confidential.

AWS told V3 there were many legitimate reasons users might choose to leave buckets open, but in cases where customers were unsure, it did its utmost to work with them to secure their data.

"AWS Support staff regularly reach out to customers who may have potential configuration issues with AWS, to assist those customers with achieving better efficiency, reduced costs, or in some cases, to remedy their security configuration and posture, for S3 and other services," a company spokesman told V3.

  • Comment  
  • Tweet  
  • Google plus  
  • Facebook  
  • LinkedIn  
  • Stumble Upon  
More on Cloud Computing
What do you think?
blog comments powered by Disqus

BYOD vs CYOD vs BYOC poll

Which approach is your firm taking to managing employees' mobile devices?

Popular Threads

Powered by Disqus
Sony Xperia Z2 Tablet powered by Android KitKat 4.4

Sony Xperia Z2 Tablet video

We take a look at the lightweight, waterproof tablet

Updating your subscription status Loading

Get the latest news (daily or weekly) direct to your inbox with V3 newsletters.

newsletter sign-up button

Data protection: the key challenges

Deduplication is a foundational technology for efficient backup and recovery


iPad makes its mark in the enterprise

The iPad can become a supercharged unified communications endpoint, allowing users to enhance their productivity

Software Development Engineer

Develop: Customise: Configure. Maximise your technical...

Retail and Finance Application Developer and Support Analyst

MS Dynamics Nav: Retail and Finance Application Developer...

Senior Database Developer - SQL, WPF

THE COMPANY: Halarose is a dynamic, small...

Technical Analyst: ICT Services

Technical Analyst: ICT Services £21,005 Woking...
To send to more than one email address, simply separate each address with a comma.