Feeds

Don't lose sleep over cloud crypto hole, says Amazon

Virtually insignificant

Build a business case: developing custom apps

Amazon has played down the significance of a recently discovered vulnerability affecting its flagship Amazon Web Services cloud computing platform.

Interlinked security shortcomings created a theoretical mechanism for hackers to issue rogue admin requests, such as stopping virtual machines in an EC2 virtual environment or either create or deleting images. The technique relied on manipulating digitally signed SOAP messages in such a way as to avoid detection.

The attack was potentially possible because application signature verification and XML interpretation were handled separately by Amazon's SOAP interface. Eucalyptus, an open-source based framework for creating private cloud installations, was similarly vulnerable to the same kind of signature-wrapping attacks, according to a team of computer scientists from Germany's Ruhr University. The Ruhr team only went public last week after both Amazon and Eucalyptus had fixed the flaws, which arose from the possibility of modifying partially signed XML documents.

In addition, the researchers discovered cross-site scripting gaps between the AWS interface and the Amazon store, creating a possible means to inject malicious script code, creating a potential way to lift users' digital certs.

In a statement, Amazon said that none of its customers had actually been affected by the "potential vulnerability". Amazon goes on to point out the obstacles that would have stood in the way of a practical attack, even before it plugged the underlying security vulnerability highlighted by the Ruhr team.

This potential vulnerability involved a very small percentage of all authenticated AWS API calls that use non-SSL endpoints and was not a potentially widespread vulnerability as has been reported. Additionally, customers fully implementing the AWS security best practices were not susceptible to these vulnerabilities.

The [Amazon] team works with security researchers around the world to identify potential vulnerabilities and to inform and educate cloud users of the importance of maintaining strong security processes in the cloud.  When a potential vulnerability is identified, we work with researchers to quickly address the vulnerability and inform customers via the AWS Security Center. The potential vulnerabilities reported by researchers at Ruhr-University Bochum have been corrected and no customers have been impacted. The AWS security center provides a summary of the research findings and reminder of best practices for proper user validation.

Contrary to the headline in our original story, the admitted security would never have allowed hackers to take over AWS.

An Amazon security advisory, published on the Thursdsy in the weekend before the Ruhr team went public, explains why the now-plugged security weaknesses are nothing to lose sleep over. "The research showed that errors in SOAP parsing may have resulted in specially crafted SOAP requests with duplicate message elements and / or missing cryptographic signatures being processed," the advisory explains, adding that the XSS flaw created a potential means to snatch customer’s public X.509 certificate, allowing exploitation of the primary vulnerability.

"Both the SOAP and XSS vulnerabilities have been corrected and extensive log analysis has determined that no customers were impacted," Amazon's security advisory concludes. ®

Boost IT visibility and business value

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Microsoft: Azure isn't ready for biz-critical apps … yet
Microsoft will move its own IT to the cloud to avoid $200m server bill
Shoot-em-up: Sony Online Entertainment hit by 'large scale DDoS attack'
Games disrupted as firm struggles to control network
Cutting cancer rates: Data, models and a happy ending?
How surgery might be making cancer prognoses worse
Silicon Valley jolted by magnitude 6.1 quake – its biggest in 25 years
Did the earth move for you at VMworld – oh, OK. It just did. A lot
VMware's high-wire balancing act: EVO might drag us ALL down
Get it right, EMC, or there'll be STORAGE CIVIL WAR. Mark my words
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?