Paige Thompson convicted over data theft from AWS user accounts

Re:Paige Thompson convicted over data theft from AWS user ac... by jrm4 on Monday June 20, 2022 @04:02PM (#31815068)

The only tragedy here is that this Paige person will get in trouble and Amazon will likely not.

[ Parent | on HN ]

Re:Paige Thompson convicted over data theft from AWS user ac... by culpable_pickle on Monday June 20, 2022 @06:04PM (#31816713)

What did amazon do wrong here?

[ Parent | on HN ]

Re:Paige Thompson convicted over data theft from AWS user ac... by zenexer on Monday June 20, 2022 @06:36PM (#31817091)

The metadata service is a big issue. When you pair EC2 with common, off-the-shelf software, you can end up inadvertently allowing requests to EC2's metadata service. That allows an attacker to gain the same privileges as the EC2 instance they're hitting, which often means they can access resources like private S3 buckets.

While the metadata service isn't technically a vulnerability, it's poorly designed. Not enough thought went into its security, but too much relies on it for them to disable the current version overnight. Any changes are going to take many years.

[ Parent | on HN ]

Re:Paige Thompson convicted over data theft from AWS user ac... by jrm4 on Tuesday June 21, 2022 @02:41PM (#31827465)

How is "technically not a vulnerability" not a vulnerability?

This kind of thinking strikes me as exactly how Amazon gets away with this stuff.

[ Parent | on HN ]

Re:Paige Thompson convicted over data theft from AWS user ac... by doopy1 on Monday June 20, 2022 @06:22PM (#31816917)

Not fix a gaping hole that was reported to them repeatedly for years.

[ Parent | on HN ]