All the latest UK technology news, reviews and analysis


Leaky Amazon S3 buckets put thousands of company secrets at risk

28 Mar 2013
Amazon Web Services logo

Researchers have uncovered thousands of misconfigured Amazon S3 storage buckets, making it possible to obtain access to potentially highly sensitive company data.

In the tests, penetration testing firm Rapid 7 was able to access personal photos from a social media service, a car dealership's sales records and account information, firms' employee records as well as unprotected database backups containing site data and encrypted password.

According to Will Vandevanter, senior security consultant at Rapid 7, the firm was able to access the information having identified more than a thousand publicly accessible Amazon S3 storage buckets.

Firms typically use Amazon's S3 system to store static content such as server backups, company documents, web logs, and publicly visible content such as website images. The files in S3 are then organised into so-called buckets.

“Although a file might be listed in a bucket it does not necessarily mean that it can be downloaded. Buckets and objects have their own access control lists,” Vandevanter wrote on a company blog.

Firms that had stored their data insecurely in S3 could be set for a rude awakening, he warned.

“Much of the data could be used to stage a network attack, compromise users accounts, or to sell on the black market.”

Typically, Amazon would make S3 buckets private, so the public ones are likely to be the results of users misconfiguration, said Vandevanter. 

Nonetheless, Amazon Web Services makes it easier for would-be hackers by using a URL structure that is easy to guess, making it child's play to access public buckets.

“Checking if a bucket is public or private is easy. All buckets have a predictable and publicly accessible URL,” he added.

Having identified hundreds of public buckets, Vandevanter and his colleagues took a random sample to check which buckets had accessible content.

They discovered more than five million accessible text documents, many of which where marked 'private' or confidential.

AWS told V3 there were many legitimate reasons users might choose to leave buckets open, but in cases where customers were unsure, it did its utmost to work with them to secure their data.

"AWS Support staff regularly reach out to customers who may have potential configuration issues with AWS, to assist those customers with achieving better efficiency, reduced costs, or in some cases, to remedy their security configuration and posture, for S3 and other services," a company spokesman told V3.

  • Comment  
  • Tweet  
  • Google plus  
  • Facebook  
  • LinkedIn  
  • Stumble Upon  
More on Cloud Computing
What do you think?
blog comments powered by Disqus
Poll

Windows 7 end of mainstream support

What are your plans for when Microsoft ends mainstream support for Windows 7 in January 2015?
10%
10%
3%
63%
14%

Popular Threads

Powered by Disqus
LG G3 in gold black and white

LG G3 vs Galaxy S5 video

We pit the two Korean firms' flagship smartphones against each other

Updating your subscription status Loading
Newsletters

Get the latest news (daily or weekly) direct to your inbox with V3 newsletters.

newsletter sign-up button
hpv3may

Getting started with virtualisation

Virtualisation can help you reduce costs, improve application availability, and simplify IT
management. However, getting started can be challenging

ibmv3may

Converting big data and analytics insights into results

Successful leaders are infusing analytics throughout their organisations to drive smarter decisions, enable faster actions and optimise outcomes

Data Centre Technical Project Manager

Our client is seeking a talented Data Centre Technical...

Data Centre Technical Specialist - Citrix/VMware and Microsoft

Our client requires a Senior Data Centre Services Lead...

IT Manager - Data Centre Support Services BAU

Our client is seeking an experienced Data Centre Manager...

IT Manager - Data Centre Support Services BAU

Our client is seeking an experienced Data Centre Manager...
To send to more than one email address, simply separate each address with a comma.