Security flaws let anyone snoop on Guardzilla smart camera video recordings

Re:Security flaws let anyone snoop on Guardzilla smart camer... by laurencei on Friday December 28, 2018 @02:10AM (#18775286)

> Fixing the vulnerability not only requires the keys to be changed on the server, but also a software patch to be rolled out on each affected device.

Is this correct?

Couldnt they just change the existing keys in AWS to be "write only" - and therefore allow a one way stream of data "in"?

That way, even with the keys, you cant actually get any existing videos, and only place new ones there?

I do this for my web application backups - my AWS keys on the server are "write only" (with no overwrite) to S3. Then, if my server was every compromised, my backups are NOT and are protected because the attackers cant get to them (to either overwrite or read the existing backup).

[ Parent | on HN ]

Re:Security flaws let anyone snoop on Guardzilla smart camer... by oavdeev on Friday December 28, 2018 @02:21AM (#18775313)

How did you do "no overwrite" bit? By enabling versioning?

[ Parent | on HN ]

Re:Security flaws let anyone snoop on Guardzilla smart camer... by laurencei on Friday December 28, 2018 @02:28AM (#18775328)

I use `s3:PutObject` with versioning - yes.

Although I've not tested if only having `s3:PutObject` even allows overwriting in the first place? You might not need versioning.

Also - they dont have `list` or `read` access, so they cant even see what files are there to overwrite in the first place. They might be able to guess depending on your code, but adding some random numbers and you'd be pretty safe.

Any AWS IWS experts able to confirm if `s3:PutObject` allows overwrite?

[ Parent | on HN ]

Re:Security flaws let anyone snoop on Guardzilla smart camer... by oavdeev on Friday December 28, 2018 @12:30PM (#18778103)

It does; unfortunately they don't have a nice way to just disallow overwrites (that's why I was curious how you implemented that)

[ Parent | on HN ]