Feeds

Don't lose sleep over cloud crypto hole, says Amazon

Virtually insignificant

Top 5 reasons to deploy VMware with Tegile

Amazon has played down the significance of a recently discovered vulnerability affecting its flagship Amazon Web Services cloud computing platform.

Interlinked security shortcomings created a theoretical mechanism for hackers to issue rogue admin requests, such as stopping virtual machines in an EC2 virtual environment or either create or deleting images. The technique relied on manipulating digitally signed SOAP messages in such a way as to avoid detection.

The attack was potentially possible because application signature verification and XML interpretation were handled separately by Amazon's SOAP interface. Eucalyptus, an open-source based framework for creating private cloud installations, was similarly vulnerable to the same kind of signature-wrapping attacks, according to a team of computer scientists from Germany's Ruhr University. The Ruhr team only went public last week after both Amazon and Eucalyptus had fixed the flaws, which arose from the possibility of modifying partially signed XML documents.

In addition, the researchers discovered cross-site scripting gaps between the AWS interface and the Amazon store, creating a possible means to inject malicious script code, creating a potential way to lift users' digital certs.

In a statement, Amazon said that none of its customers had actually been affected by the "potential vulnerability". Amazon goes on to point out the obstacles that would have stood in the way of a practical attack, even before it plugged the underlying security vulnerability highlighted by the Ruhr team.

This potential vulnerability involved a very small percentage of all authenticated AWS API calls that use non-SSL endpoints and was not a potentially widespread vulnerability as has been reported. Additionally, customers fully implementing the AWS security best practices were not susceptible to these vulnerabilities.

The [Amazon] team works with security researchers around the world to identify potential vulnerabilities and to inform and educate cloud users of the importance of maintaining strong security processes in the cloud.  When a potential vulnerability is identified, we work with researchers to quickly address the vulnerability and inform customers via the AWS Security Center. The potential vulnerabilities reported by researchers at Ruhr-University Bochum have been corrected and no customers have been impacted. The AWS security center provides a summary of the research findings and reminder of best practices for proper user validation.

Contrary to the headline in our original story, the admitted security would never have allowed hackers to take over AWS.

An Amazon security advisory, published on the Thursdsy in the weekend before the Ruhr team went public, explains why the now-plugged security weaknesses are nothing to lose sleep over. "The research showed that errors in SOAP parsing may have resulted in specially crafted SOAP requests with duplicate message elements and / or missing cryptographic signatures being processed," the advisory explains, adding that the XSS flaw created a potential means to snatch customer’s public X.509 certificate, allowing exploitation of the primary vulnerability.

"Both the SOAP and XSS vulnerabilities have been corrected and extensive log analysis has determined that no customers were impacted," Amazon's security advisory concludes. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
The DRUGSTORES DON'T WORK, CVS makes IT WORSE ... for Apple Pay
Goog Wallet apparently also spurned in NFC lockdown
Hey - who wants 4.8 TERABYTES almost AS FAST AS MEMORY?
China's Memblaze says they've got it in PCIe. Yow
Cray-cray Met Office spaffs £97m on VERY AVERAGE HPC box
Only 250th most powerful in the world? Bring back Michael Fish
Microsoft brings the CLOUD that GOES ON FOREVER
Sky's the limit with unrestricted space in the cloud
'ANYTHING BUT STABLE' Netflix suffers BIG Europe-wide outage
Friday night LIVE? Nope. The only thing streaming are tears down my face
IBM, backing away from hardware? NEVER!
Don't be so sure, so-surers
Google roolz! Nest buys Revolv, KILLS new sales of home hub
Take my temperature, I'm feeling a little bit dizzy
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.