Public Cloud Security Credentials Flunk A Research Test

Researchers who grabbed security credentials via Google code search advise caution regarding sensitive data and public cloud services.

The access codes and secret keys of thousands of public cloud services users can be easily found with a simple Google code search, a team of security researchers said.
Researchers at Stach & Liu, a security consulting firm that develops Google hacking tools, first
revealed the results
of their cloud services research (PDF) at the Hacker Halted conference last month in Miami. Now the team is offering one word of advice to companies that are considering storing critical information on the public cloud: Dont.
It is not a good idea to put sensitive data out in the cloud right now--at least not until there are intrusion-detection systems that would let users see these types of searches on their cloud services, said Fran Brown, managing director at Stach & Liu. Companies are pushing forward on the cloud because they want the functionality, but theyre not seeing the risk.
In an online demonstration, Brown showed how an attacker who knows Google and some simple facts about cloud services authentication can easily find the access codes, passwords, and secret keys needed to unlock data stored in public cloud services environments such as Amazons EC3.
Such data is routinely stored by application developers and system administrators who dont know that their simple text files might be indexed by search engines and discoverable with a simple Google code search, Brown said.
We found literally thousands of keys stored this way, any one of which could be used to take control of computers in the cloud, shut them down, or used to launch attacks on other computers on the same service, he states.
The problem, according to Stach & Liu, is not necessarily the service provider, but the developers and administrators who store their credentials carelessly in text files and application code that might be exposed to the Web, particularly in Web-based cloud environments. All you need is one careless developer who puts his credentials in a text file--and youre hosed, Brown said.
Read the rest of this article on
Dark Reading
.

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Public Cloud Security Credentials Flunk A Research Test