All the latest UK technology news, reviews and analysis


Leaky Amazon S3 buckets put thousands of company secrets at risk

28 Mar 2013
Amazon Web Services logo

Researchers have uncovered thousands of misconfigured Amazon S3 storage buckets, making it possible to obtain access to potentially highly sensitive company data.

In the tests, penetration testing firm Rapid 7 was able to access personal photos from a social media service, a car dealership's sales records and account information, firms' employee records as well as unprotected database backups containing site data and encrypted password.

According to Will Vandevanter, senior security consultant at Rapid 7, the firm was able to access the information having identified more than a thousand publicly accessible Amazon S3 storage buckets.

Firms typically use Amazon's S3 system to store static content such as server backups, company documents, web logs, and publicly visible content such as website images. The files in S3 are then organised into so-called buckets.

“Although a file might be listed in a bucket it does not necessarily mean that it can be downloaded. Buckets and objects have their own access control lists,” Vandevanter wrote on a company blog.

Firms that had stored their data insecurely in S3 could be set for a rude awakening, he warned.

“Much of the data could be used to stage a network attack, compromise users accounts, or to sell on the black market.”

Typically, Amazon would make S3 buckets private, so the public ones are likely to be the results of users misconfiguration, said Vandevanter. 

Nonetheless, Amazon Web Services makes it easier for would-be hackers by using a URL structure that is easy to guess, making it child's play to access public buckets.

“Checking if a bucket is public or private is easy. All buckets have a predictable and publicly accessible URL,” he added.

Having identified hundreds of public buckets, Vandevanter and his colleagues took a random sample to check which buckets had accessible content.

They discovered more than five million accessible text documents, many of which where marked 'private' or confidential.

AWS told V3 there were many legitimate reasons users might choose to leave buckets open, but in cases where customers were unsure, it did its utmost to work with them to secure their data.

"AWS Support staff regularly reach out to customers who may have potential configuration issues with AWS, to assist those customers with achieving better efficiency, reduced costs, or in some cases, to remedy their security configuration and posture, for S3 and other services," a company spokesman told V3.

  • Comment  
  • Tweet  
  • Google plus  
  • Facebook  
  • LinkedIn  
  • Stumble Upon  
More on Cloud Computing
What do you think?
blog comments powered by Disqus
Poll

IT curriculum poll

With coding now compulsory in schools, how important are digital skills for the next generation of school leavers?
0%
0%
0%
100%

Popular Threads

Powered by Disqus
Xperia Z2 vs Galaxy Note 3 video review.jpg

Xperia Z2 vs Galaxy Note 3 video review

We pit Sony's 2014 flagship against Samsung's ruling phablet

Updating your subscription status Loading
Newsletters

Get the latest news (daily or weekly) direct to your inbox with V3 newsletters.

newsletter sign-up button
hpv3may

Getting started with virtualisation

Virtualisation can help you reduce costs, improve application availability, and simplify IT
management. However, getting started can be challenging

ibmv3may

Converting big data and analytics insights into results

Successful leaders are infusing analytics throughout their organisations to drive smarter decisions, enable faster actions and optimise outcomes

SQL Database and Report Developer

SQL Database and Report Developer My client are based...

Senior Java Developer, Eclipse - £40k - £60k - Southampton

Senior Java Developer, Eclipse - £40k - £60k - Southampton...

1st/2nd Line Support / Graduate - Windows / Network- £16-22k

1st/2nd Line Support / Graduate - Windows / Network...

PMO Manager -Programme Office Manager

Senior PMO Manager, Programme Office Manager, financial...
To send to more than one email address, simply separate each address with a comma.