News for hackers. Stuff that matters.

A comment on Defense Contractor Left Sensitive Pentagon Files on Unprotected AWS S3 Bucket.

Re:Defense Contractor Left Sensitive Pentagon Files on Unpro... by danso on Wednesday May 31, 2017 @10:25AM (#14452756)
It's really confusing how they ended up in this predicament. S3 buckets are private by default. You have to manually configure them to be public-read. Given the scope of Booz Allen's work, it doesn't seem like they needed any of the S3 buckets to ever be just public. I wonder if they're using software or maybe even just copied a script in which the default assumption for S3 configuration and uploads is to set files to be public?
[ Parent | on HN ]
Re:Defense Contractor Left Sensitive Pentagon Files on Unpro... by conorh on Wednesday May 31, 2017 @01:07PM (#14454098)
We had this issue previously as one of our clients was using cyberduck to upload files and it had default read access for public for uploads.

[1] https://forums.aws.amazon.com/thread.jspa?messageID=213248

[ Parent | on HN ]
Re:Defense Contractor Left Sensitive Pentagon Files on Unpro... by danso on Wednesday May 31, 2017 @02:12PM (#14454683)
Yeah, this is also something that can be set using Transmit (my OS X GUI of choice). I guess I assumed that, given the size of the data they have to manage, they have something more sophisticated than file-management-by-click-and-drag but...maybe I'm giving them too much credit in terms of dev ops.
[ Parent | on HN ]
Re:Defense Contractor Left Sensitive Pentagon Files on Unpro... by jamiesonbecker on Wednesday May 31, 2017 @01:41PM (#14454418)
tinyS3 used to do this as well:

https://github.com/smore-inc/tinys3/issues/44

[ Parent | on HN ]
Re:Defense Contractor Left Sensitive Pentagon Files on Unpro... by QuinnyPig on Wednesday May 31, 2017 @12:14PM (#14453630)
I'm wondering if they were bitten by the semi-common "any authenticated user" misunderstanding. That maps to any user in all of S3, not just your account.
[ Parent | on HN ]
Re:Defense Contractor Left Sensitive Pentagon Files on Unpro... by unclesaamm on Wednesday May 31, 2017 @12:47PM (#14453938)
Much more likely for it to be the ole "Download it quickly and I'll make it private"

Edit: After reading the article, I have no idea what could explain this. They had a dozen passwords in there as well..

[ Parent | on HN ]
Re:Defense Contractor Left Sensitive Pentagon Files on Unpro... by Florin_Andrei on Wednesday May 31, 2017 @02:17PM (#14454732)
Who knows what dumb GUI they used that configures the bucket with public access by default.
[ Parent | on HN ]
Re:Defense Contractor Left Sensitive Pentagon Files on Unpro... by empath75 on Wednesday May 31, 2017 @02:01PM (#14454587)
This happens surprisingly often.
[ Parent | on HN ]