Printed from http://www.electronista.com

Researcher finds unsecured photos, data on Amazon S3 storage

updated 07:56 am EDT, Thu March 28, 2013

One in six data buckets found to be publicly viewable

An investigation into Amazon's Simple Storage Service (S3) discovered a sixth of data stores, known as buckets, on the service are left open to public viewing. Further examination showed that a number of items on open display were of a sensitive nature, including source code for mobile games, user log-in details, and various other items of personal information.

The investigation by Will Vandevanter of security firm Rapid 7, published by Help Net Security, used a script to generate URLs based on the names of businesses that use Amazon S3, discovering 12,328 buckets in total. While 10,377 buckets were listed as private and not viewable, 1,951 were not only public, but the service provided a list of the first 1,000 objects stored in each discovered bucket.

Data recovered from the public buckets ranged from "personal photos from a medium-sized social media service," to "Employee personal information and member lists across various spreadsheets." PHP source code found in one bucket contained configuration files that held usernames and passwords. Roughly 60-percent of the file listings were of images, with a number of found text-based documents using the term "Confidential" or "Private" in various parts.

By default, Amazon S3 sets buckets to be private. By the nature of buckets becoming public, it had to be altered by the owner of the bucket, be it on purpose or by accident. Even so, Amazon is taking steps to warn users about the issue, as well as working to identify misconfigured buckets in the future.



By Electronista Staff
Post tools:

TAGS :

toggle

Comments

Login Here

Not a member of the MacNN forums? Register now for free.

toggle

Network Headlines

toggle

Most Popular

Sponsor

Recent Reviews

Sound Blaster Roar Bluetooth speaker

There could very well be a new king of the hill for Bluetooth speakers, with Sound Blaster's recent entry into the marketplace. Bringi ...

Kenu Airframe Plus

Simple, stylish and effective, the Kenu Airframe + portable car mount is the latest addition to Kenu's lineup. Released earlier this y ...

Plantronics Rig Surround 7.1 headset

Trying to capture the true soundscape of video games can be a daunting task. Looking to surround-sound home theater options, users hav ...

Sponsor

toggle

Most Commented

 
toggle

Popular News