As much as I hate them, this is likey because a customer misconfigured their bucket and not on Amazon.
this post was submitted on 07 Apr 2024
515 points (95.7% liked)
Security
4975 readers
1 users here now
Confidentiality Integrity Availability
founded 4 years ago
MODERATORS
Yeah, I work for a Federal agency, and I can confirm this is an extremely plausible situation. Was probably a contractor.
load more comments
(1 replies)
I have never configure s3 buckets for an enterprise personally, but I have used AWS for some personal projects. The control panel pretty clearly warns you if you try to open the bucket to the public. "This is unsafe. Everyone can see everything you idiot!"
They must be doing it through the CLI.
load more comments
(4 replies)
Documents marked "not for public release" aren't classified. They're what's called controlled unclassified information (CUI). It's anything from PII, law enforcement victim records to sensitive (but unclassified) technical manuals. There's dozens of categories if anyone cares to look at them: https://www.archives.gov/cui/registry/category-marking-list
They shouldn't be sitting out there, but it's also not a crime.
The first result I got was labeled "classified: top secret - not for public release" so ~~the label is more broadly applied than just CUI.~~ my assumption that the document was legit was wrong.
That's pretty obviously fake. This is what the real markings look like: https://www.archives.gov/files/isoo/training/marking-booklet-revision.pdf
load more comments
(4 replies)
load more comments
(1 replies)
I work in a HIPAA-covered industry and if our AWS and GCP buckets are insecure that's on us. Fuck Amazon, but a hammer isn't responsible for someone throwing it through a window and a cloud storage bucket isn't responsible for the owner putting secret shit in it and then enabling public access.
Yeah I hate Amazon as much as the next person, but this is a people/process problem, not an Amazon problem. Amazon doesn't know or care what you put into an AWS bucket (within reason, data tracking, etc, blah blah blah). People taking classified documents and uploading it to an Internet-connected cloud service is procedurally wrong on so many levels.
load more comments
(3 replies)
load more comments
(4 replies)
Amazon is only doing what someone told it to do. This is improper handling of documents and not a problem with Amazon itself.
Such examples of OpSec competence make it easy to dismiss the majority of government conspiracy theories IMHO.
Basically “I can always tell” as an actually fallacy. Neat
Cool resource, thanks for the share!
lol yes. But it’s not the regular evidence of shoestring infrastructure and lack of process that casts doubt on these grand conspiracies. It’s the diminishing conditional probability, over time, that they are somehow always the exception.
load more comments
(3 replies)
They dropped this to make themselves look incompetent!
4D chess by the deep state!
"No! This is not how the game is meant to be played."
I go back to the veteran comedian every time.
We can't even stop our privates from telling their stripper girlfriend about the mission they're going on the next day, and people think there's a giant conspiracy out there where nobody talks...
Then there's the Warrantless Wiretap program under the Bush Administration. Cheney kept the authorization memo in his personal lawyer's safe. Only 7 people knew it existed. Shit still leaked.
Only 7. That’s perfect. I forget who said “three may keep a secret if two are dead” but of all the mustache twirling pricks in that admin, Cheney should have known.
Edit: it’s Ben Franklin’s joke, apparently. I doubt he’d mind.
Legit, if you want to know if a conspiracy is true, just wait 20-50 years and the CIA will declassify the related documents. Most of them are open secrets that happen to be difficult to corroborate as they’re happening. Very few rely on outright secrecy. More just plausible deniability during the period where the public would be up in arms about it.
Right, because people never make simple mistakes 🙄
People who get paid half a mill to code mess up basic stuf like this by accident all the time
I mean, I agree with you. I’m not claiming “there are no good toupees.” I’m pointing to [the alopecia market] as evidence that [a pill to cure baldness] couldn’t be kept secret by the [shadowy cabal of elites with gorgeous hair] for very long.
load more comments
(2 replies)
To be fair, it’s probably more about the IT contractors and consulting firms that didn’t implement security policies or configurations correctly on the S3 buckets for the governments they’re working for. The AWS products aren’t opening up things to the public internet without auth. Which I bet most of you knew.
Example: Accenture left a trove of highly sensitive data on public servers (2017)
I added more JPEG for OP:
Aaand that search query got me some files with the top secret flag. Fortunately, they seem to be internal memos on things that are already known to the public, so nothing too immediately dangerous.
My big question is, why in the ever-loving fuck are these files outside of SIPRNET?
Cloud cloud cloud, cloudy cloud, cloudy cloudy cloud cloud.
-Management
load more comments
(1 replies)
Contractors and third parties with security clearance. Did you really think any US government agency actually tightened things down properly after Snowden?
load more comments
(5 replies)
Went and looked at the documents that show up, both are on "russian hacking". 100% honey pot if I've ever seen one.
Okay, the question I have, is why any government from a developed country would ever use something like AWS or something that everyone can obtain access to rather than making their own private solutions to these problems?
It's easier to hire someone who knows aws than to train someone on your custom thing. I don't really agree, but that's mostly the reasoning.
Not to mention in house solutions are basically guaranteed to cost more than AWS to get something even close to as comparable. A basic service like Lambda is complex as fuck and has had billions of dollars poured into making it what it is today.
Another question could be : which developed country is not yet using the popular AWS already and why ?
For example : https://press.aboutamazon.com/2023/10/amazon-web-services-to-launch-aws-european-sovereign-cloud
Customers, AWS Partners, and regulators welcoming the new AWS European Sovereign Cloud include the German Federal Office for Information Security (BSI), German Federal Ministry of the Interior and Community (BMI), German Federal Ministry for Digital and Transport, Finland Ministry of Finance, National Cyber and Information Security Agency (NÚKIB) in the Czech Republic, National Cyber Security Directorate of Romania, SAP, Dedalus, Deutsche Telekom, O2 Telefónica in Germany, Heidelberger Druckmaschinen AG, Raisin, Scalable Capital, de Volksbank, Telia Company, Accenture, AlmavivA, Deloitte, Eviden, Materna, and msg group
Cloud presents several advantages,and GovCloud is a thing.
Like, Amazon has SCIF cloud offerings. These leaks were cuz some dumbass contractor exposed a repo to the internet
In Portuguese: https://www.serpro.gov.br/menu/noticias/noticias-2023/serpro-lanca-nuvem-de-governo
Brazillian government launched its own cloud service to support the government agencies, everything stored and administer in Brazilian territory, making it independent from private companies and international governments.
load more comments
(1 replies)
I expect the same reasons they're mostly all using Microsoft Office, Windows, and Active Directory. Because it's cheaper than doing it yourself.
load more comments
(3 replies)
So many of the results I see are incredibly obvious fakes.
What's the over-under on this being a honeypot?
My bets are on ~~"cloud infrastructure is bad for highly secret information" rather than "public web honeypot with zero obfuscation"~~ Edit: likely fake. The sensationalist in me would love it if this was real because it would confirm my "cloud storage bad" biases, but alas, the document markings dont appear to be consistent with my understanding of official US Government confidentiality/secrecy markings
load more comments
(2 replies)
In their defense:
view more: next ›