acsac 2018 there’s a hole in that bucket! 7 december 2018 ... · a large-scale analysis of...

There’s a Hole in that Bucket!A Large-scale Analysis of Misconfigured S3 Buckets

Andrea Continella, Mario Polino, Marcello Pogliani, Stefano Zanero

7 December 2018ACSAC 2018

Cloud Storage Services

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Amazon S3

● Users create buckets (storage containers)

● Amazon S3 supports various access control policies○ User-level○ Bucket-level○ Resource-level

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Amazon S3

● Users create buckets (storage containers)

● Amazon S3 supports various access control policies○ User-level○ Bucket-level○ Resource-level

● REST API to read/write:○ http[s]://<BUCKET_NAME>.s3[-region].amazonaws.com/○ http[s]://s3[-region].amazonaws.com/<BUCKET_NAME>/

HTTP/1.1 403 Forbiddenx-amz-bucket-region: ap-southeast-2Content-Type: application/xmlTransfer-Encoding: chunkedDate: Mon, 19 Mar 2018 13:22:24 GMTServer: AmazonS3

<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>4CBC01F61S808F69</RequestId><HostId>zPQX088xyzUTAH704xQLZFg9toDH</HostId>

</Error>

What couldpossibly go wrong?

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Threats

Misconfigurations in access control rules can be really dangerous

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Threats

Misconfigurations in access control rules can be really dangerous

Data Leakage

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Threats

Misconfigurations in access control rules can be really dangerous

Data Leakage Resource Infection

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Threats

Misconfigurations in access control rules can be really dangerous

Data Leakage Resource Infection

Ransom Demand

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Threats

Misconfigurations in access control rules can be really dangerous

Data Leakage Resource Infection

Ransom Demand

Domain Name Trust Exploiting

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Threats

Misconfigurations in access control rules can be really dangerous

404

Data Leakage Resource Infection

Ransom Demand

Domain Name Trust Exploiting

Subdomain Takeover

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Methodology

Dictionary

Mutations

Enumeration

Candidates

Candidate Generation

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Methodology

Dictionary

Crawler

Mutations

Enumeration

Candidates

PublicWWW

Candidate Generation

Web Crawling

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Methodology

Dictionary

Crawler

Mutations

Enumeration

Candidates

PublicWWW

Passive DNS

Candidate Generation

Web Crawling

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Methodology

Dictionary

Crawler

Mutations

Enumeration

Candidates

Scanner

Existing & PublicBuckets

PublicWWW

Passive DNS

Candidate Generation

Web Crawling

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Methodology

Dictionary

Crawler

Mutations

Enumeration

Candidates

Scanner

Existing & PublicBuckets

Inspector

ReadableBuckets

WritableBuckets

PublicWWW

Passive DNS

Candidate Generation

Web Crawling

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Methodology

Dictionary

Crawler

Mutations

Enumeration

Candidates

Scanner

Existing & PublicBuckets

Inspector

ReadableBuckets

WritableBuckets

PublicWWW Website Inspector

VulnerableWebsites

Passive DNS

Candidate Generation

Web Crawling

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Scanning Result Summary

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Scanning Result Summary

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Scanning Result Summary

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Scanning Result Summary

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Scanning Result Summary

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Region Distribution

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

File Types

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

File Types

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Sensitive Exposure

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Vulnerable Websites

We collected 5,196 websites relying on 2,468 buckets

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Vulnerable Websites

We collected 5,196 websites relying on 2,468 buckets

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Vulnerable Websites

We collected 5,196 websites relying on 2,468 buckets

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Vulnerable Websites

We collected 5,196 websites relying on 2,468 buckets

*Note that websites can overlap among the different types of vulnerability

*

Mitigation

Fix the damn permissions!

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Mitigation

Amazon S3BucketOwner

is my bucketsecured?

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Mitigation

Amazon S3BucketOwner

Browser

Extension is this resource trusted?

is my bucketsecured?

https://bucketsec.necst.it

https://github.com/necst/truster

Responsible Disclosure

A Large-scale Analysis of Misconfigured S3 Buckets Andrea Continella et al. ACSAC 2018

Conclusions

● We investigated security implications of using the Amazon S3 service● Raise the awareness of a real-world security problem and warn users of its

security implications● ~14% of S3 buckets are public● ~2% of S3 buckets are publicly writable● 191 vulnerable websites● We need automated solutions

○ Automatically check for potential misconfigurations○ Protect client-side users

Thanks!Questions?

Andrea Continellaconand@cs.ucsb.eduhttps://conand.me

@_conand