Attacks/Breaches

8/9/2018
02:20 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

AWS Employee Flub Exposes S3 Bucket Containing GoDaddy Server Configuration and Pricing Models

Publicly accessible S3 bucket included configuration data for tens of thousands of systems, as well as sensitive pricing information.

Editors' note: This article and its headline was updated to correct details about ownership of the S3 bucket and contents therein. 

Another week, another publicly accessible AWS storage cloud found to be leaking enterprise secrets. This time around, the company exposed was GoDaddy – but in a twist on the normal storyline, it was an AWS employee responsible for the misconfiguration. Researchers with the UpGuard Cyber Risk Team today disclosed that they found a publicly accessible Amazon S3 bucket wide open for public consumption.  

Included within that data store were documents that detailed configurations for tens of thousands of systems in the AWS cloud. Additionally, documents with pricing information about these systems were similarly accessible. 

"Essentially, this data mapped a very large scale AWS cloud infrastructure deployment, with 41 different columns on individual systems, as well as summarized and modeled data on totals, averages, and other calculated fields," UpGuard's researchers reported. "Also included were what appear to be GoDaddy's discounts from Amazon AWS, usually restricted information for both parties, who must negotiate for rates."

Exposures such as these have become extremely prevalent. In this year alone, organizations including Accenture, FedEx, and Walmart have all been similarly exposed. Even though Amazon S3 buckets are securely configured by default, many AWS customers tend to turn off security settings for expedience. In an unusual turn of events, this particular exposure was caused not by GoDaddy but by an AWS employee.  

"The bucket in question was created by an AWS salesperson to store prospective AWS pricing scenarios while working with a customer," an Amazon spokesperson said. "No GoDaddy customer information was in the bucket that was exposed. While Amazon S3 is secure by default, and bucket access is locked down to just the account owner and root administrator under default configurations, the salesperson did not follow AWS best practices with this particular bucket.”

According to one study earlier this year by Digital Shadows, researchers estimated that 1.5 billion sensitive files were visible on the internet from misconfigured S3 buckets, NAS devices, FTP servers, and other cloud storage systems.

Configuration information such as that detailed in the exposed documents could potentially provide attackers with a wealth of information, including data about hostname, operating system, memory, CPU, AWS region, and what the specific workloads were being used for. This would be extremely valuable for attackers seeking to map out GoDaddy infrastructure to help direct future malicious activity and find particularly juicy targets. 

However, a spokesperson with GoDaddy explained that the documents exposed were "speculative models from an AWS employee and do not reflect work currently underway with Amazon."

Nevertheless, the pricing data exposed by this incident could have been used for competitive advantage by GoDaddy rivals, technology service vendors, and cloud providers.

"Knowing the details of GoDaddy’s AWS discounts could give others a negotiation advantage and price point that would otherwise be unknown," the report explains. "Furthermore, the way in which GoDaddy allocates their cloud spend is also strategic – this is a blueprint for running cloud infrastructure at the largest scales."

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
8 Security Tips to Gift Your Loved Ones For the Holidays
Steve Zurier, Freelance Writer,  12/18/2018
How to Engage Your Cyber Enemies
Guy Nizan, CEO at Intsights Cyber Intelligence,  12/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-16883
PUBLISHED: 2018-12-19
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.
CVE-2018-17192
PUBLISHED: 2018-12-19
The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on th...
CVE-2018-17193
PUBLISHED: 2018-12-19
The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior ...
CVE-2018-17194
PUBLISHED: 2018-12-19
When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and even...
CVE-2018-17195
PUBLISHED: 2018-12-19
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, a...