Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
US Census Bureau: Data Exposed in Alteryx Leak Already Public
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
12/31/2017 | 9:54:51 PM
Re: Incorrectly Configured S3 Bucket
@Ryan: Well, they already have, as we've started to see. Whether it's enough, however, remains to be seen.
Cadopac
Cadopac,
User Rank: Apprentice
12/27/2017 | 7:12:53 AM
Re: Incorrectly Configured S3 Bucket
Agreed !
RyanSepe
RyanSepe,
User Rank: Ninja
12/26/2017 | 8:49:36 AM
Re: Incorrectly Configured S3 Bucket
@Dr T. "Secure VPC's"

My assumption is that amazon does this by default and then customers, unfortunately, reduce the security parameters. Based on earlier discussion on brand reputation I would be surprised if Amazon made customers pay more for a secure deployment.
RyanSepe
RyanSepe,
User Rank: Ninja
12/26/2017 | 8:46:23 AM
Re: Incorrectly Configured S3 Bucket
@Joe. That's a great point. Question is, what is the catalyst to start Amazon on the path of completely locking down their UI/UX from a hardening perspective? Is this exposure enough to facilitate a change?
Dr.T
Dr.T,
User Rank: Ninja
12/25/2017 | 7:15:21 PM
Re: Incorrectly Configured S3 Bucket
Anytime Amazon sees its name in the news articles about data breaches -- even if it's "not their fault" -- it's brand damaging. That is a good point and true. Nobody wants to be in the news because of breaches.
Dr.T
Dr.T,
User Rank: Ninja
12/25/2017 | 7:13:34 PM
Re: Incorrectly Configured S3 Bucket
Ultimately, the fault lies with the users/customers That would be the case, if system is breached because data is not encrypted at rest it, consumers and argue with that.
Dr.T
Dr.T,
User Rank: Ninja
12/25/2017 | 7:11:31 PM
Re: Incorrectly Configured S3 Bucket
Amazon, by default, should be deploying secure VPC's. I think Amazon already provides that, it may cost the consumer tough.
Dr.T
Dr.T,
User Rank: Ninja
12/25/2017 | 7:09:50 PM
Re: Incorrectly Configured S3 Bucket
Can someone elaborate as to if this was a fault of amazon or the company leveraging those services? That is the question in the cloud, it depends on the cloud service provider I guess
Dr.T
Dr.T,
User Rank: Ninja
12/25/2017 | 7:08:16 PM
Public data
It can be public data but if protected and accessed by hackers that would still constitute a breach and should be avoided
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
12/23/2017 | 5:39:41 PM
Re: Incorrectly Configured S3 Bucket
@Ryan: Since an outbreak of high-profile breaches due to misconfigured S3 buckets, Amazon has made some efforts to make things easier to configure and more transparent/visible. Ultimately, the fault lies with the users/customers -- but Amazon does bear some responsibility from a UI/UX perspective, no doubt. Anytime Amazon sees its name in the news articles about data breaches -- even if it's "not their fault" -- it's brand damaging.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Developing and Testing an Effective Breach Response Plan
Whether or not a data breach is a disaster for the organization depends on the security team's response and that is based on how the team developed a breach response plan beforehand and if it was thoroughly tested. Inside this report, experts share how to: -understand the technical environment, -determine what types of incidents would trigger the plan, -know which stakeholders need to be notified and how to do so, -develop steps to contain the breach, collect evidence, and initiate recovery.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-4273
PUBLISHED: 2022-12-03
A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the component Content-Type Handler. The manipulation of the argument pfimg leads to unrestr...
CVE-2022-4272
PUBLISHED: 2022-12-03
A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploi...
CVE-2021-32915
PUBLISHED: 2022-12-02
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE-2021-43864
PUBLISHED: 2022-12-02
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE-2021-43865
PUBLISHED: 2022-12-02
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.