Feeds

Don't lose sleep over cloud crypto hole, says Amazon

Virtually insignificant

Remote control for virtualized desktops

Amazon has played down the significance of a recently discovered vulnerability affecting its flagship Amazon Web Services cloud computing platform.

Interlinked security shortcomings created a theoretical mechanism for hackers to issue rogue admin requests, such as stopping virtual machines in an EC2 virtual environment or either create or deleting images. The technique relied on manipulating digitally signed SOAP messages in such a way as to avoid detection.

The attack was potentially possible because application signature verification and XML interpretation were handled separately by Amazon's SOAP interface. Eucalyptus, an open-source based framework for creating private cloud installations, was similarly vulnerable to the same kind of signature-wrapping attacks, according to a team of computer scientists from Germany's Ruhr University. The Ruhr team only went public last week after both Amazon and Eucalyptus had fixed the flaws, which arose from the possibility of modifying partially signed XML documents.

In addition, the researchers discovered cross-site scripting gaps between the AWS interface and the Amazon store, creating a possible means to inject malicious script code, creating a potential way to lift users' digital certs.

In a statement, Amazon said that none of its customers had actually been affected by the "potential vulnerability". Amazon goes on to point out the obstacles that would have stood in the way of a practical attack, even before it plugged the underlying security vulnerability highlighted by the Ruhr team.

This potential vulnerability involved a very small percentage of all authenticated AWS API calls that use non-SSL endpoints and was not a potentially widespread vulnerability as has been reported. Additionally, customers fully implementing the AWS security best practices were not susceptible to these vulnerabilities.

The [Amazon] team works with security researchers around the world to identify potential vulnerabilities and to inform and educate cloud users of the importance of maintaining strong security processes in the cloud.  When a potential vulnerability is identified, we work with researchers to quickly address the vulnerability and inform customers via the AWS Security Center. The potential vulnerabilities reported by researchers at Ruhr-University Bochum have been corrected and no customers have been impacted. The AWS security center provides a summary of the research findings and reminder of best practices for proper user validation.

Contrary to the headline in our original story, the admitted security would never have allowed hackers to take over AWS.

An Amazon security advisory, published on the Thursdsy in the weekend before the Ruhr team went public, explains why the now-plugged security weaknesses are nothing to lose sleep over. "The research showed that errors in SOAP parsing may have resulted in specially crafted SOAP requests with duplicate message elements and / or missing cryptographic signatures being processed," the advisory explains, adding that the XSS flaw created a potential means to snatch customer’s public X.509 certificate, allowing exploitation of the primary vulnerability.

"Both the SOAP and XSS vulnerabilities have been corrected and extensive log analysis has determined that no customers were impacted," Amazon's security advisory concludes. ®

Intelligent flash storage arrays

More from The Register

next story
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
The DRUGSTORES DON'T WORK, CVS makes IT WORSE ... for Apple Pay
Goog Wallet apparently also spurned in NFC lockdown
Cray-cray Met Office spaffs £97m on VERY AVERAGE HPC box
Only 250th most powerful in the world? Bring back Michael Fish
Microsoft brings the CLOUD that GOES ON FOREVER
Sky's the limit with unrestricted space in the cloud
'ANYTHING BUT STABLE' Netflix suffers BIG Europe-wide outage
Friday night LIVE? Nope. The only thing streaming are tears down my face
IBM, backing away from hardware? NEVER!
Don't be so sure, so-surers
Google roolz! Nest buys Revolv, KILLS new sales of home hub
Take my temperature, I'm feeling a little bit dizzy
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.