Feeds

Don't lose sleep over cloud crypto hole, says Amazon

Virtually insignificant

Top 5 reasons to deploy VMware with Tegile

Amazon has played down the significance of a recently discovered vulnerability affecting its flagship Amazon Web Services cloud computing platform.

Interlinked security shortcomings created a theoretical mechanism for hackers to issue rogue admin requests, such as stopping virtual machines in an EC2 virtual environment or either create or deleting images. The technique relied on manipulating digitally signed SOAP messages in such a way as to avoid detection.

The attack was potentially possible because application signature verification and XML interpretation were handled separately by Amazon's SOAP interface. Eucalyptus, an open-source based framework for creating private cloud installations, was similarly vulnerable to the same kind of signature-wrapping attacks, according to a team of computer scientists from Germany's Ruhr University. The Ruhr team only went public last week after both Amazon and Eucalyptus had fixed the flaws, which arose from the possibility of modifying partially signed XML documents.

In addition, the researchers discovered cross-site scripting gaps between the AWS interface and the Amazon store, creating a possible means to inject malicious script code, creating a potential way to lift users' digital certs.

In a statement, Amazon said that none of its customers had actually been affected by the "potential vulnerability". Amazon goes on to point out the obstacles that would have stood in the way of a practical attack, even before it plugged the underlying security vulnerability highlighted by the Ruhr team.

This potential vulnerability involved a very small percentage of all authenticated AWS API calls that use non-SSL endpoints and was not a potentially widespread vulnerability as has been reported. Additionally, customers fully implementing the AWS security best practices were not susceptible to these vulnerabilities.

The [Amazon] team works with security researchers around the world to identify potential vulnerabilities and to inform and educate cloud users of the importance of maintaining strong security processes in the cloud.  When a potential vulnerability is identified, we work with researchers to quickly address the vulnerability and inform customers via the AWS Security Center. The potential vulnerabilities reported by researchers at Ruhr-University Bochum have been corrected and no customers have been impacted. The AWS security center provides a summary of the research findings and reminder of best practices for proper user validation.

Contrary to the headline in our original story, the admitted security would never have allowed hackers to take over AWS.

An Amazon security advisory, published on the Thursdsy in the weekend before the Ruhr team went public, explains why the now-plugged security weaknesses are nothing to lose sleep over. "The research showed that errors in SOAP parsing may have resulted in specially crafted SOAP requests with duplicate message elements and / or missing cryptographic signatures being processed," the advisory explains, adding that the XSS flaw created a potential means to snatch customer’s public X.509 certificate, allowing exploitation of the primary vulnerability.

"Both the SOAP and XSS vulnerabilities have been corrected and extensive log analysis has determined that no customers were impacted," Amazon's security advisory concludes. ®

Beginner's guide to SSL certificates

More from The Register

next story
It's Big, it's Blue... it's simply FABLESS! IBM's chip-free future
Or why the reversal of globalisation ain't gonna 'appen
'Hmm, why CAN'T I run a water pipe through that rack of media servers?'
Leaving Las Vegas for Armenia kludging and Dubai dune bashing
Microsoft and Dell’s cloud in a box: Instant Azure for the data centre
A less painful way to run Microsoft’s private cloud
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
Windows 10: Forget Cloudobile, put Security and Privacy First
But - dammit - It would be insane to say 'don't collect, because NSA'
CAGE MATCH: Microsoft, Dell open co-located bit barns in Oz
Whole new species of XaaS spawning in the antipodes
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.