"GhostWriter" Vulnerability Affecting Amazon S3 Services
A vulnerability called “GhostWriter” has been discovered affecting Amazon Web Services’ (AWS) Simple Storage Service (S3). S3 is a storage solution within AWS.
This content has been archived
This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk
Summary
A vulnerability called “GhostWriter” has been discovered affecting Amazon Web Services’ (AWS) Simple Storage Service (S3). S3 is a storage solution within AWS.
Affected platforms
The following platforms are known to be affected:
Threat details
The vulnerability is due to improperly configured S3 buckets, essentially publicly shared folders that users upload content to. This could allow access to external users who could then launch man-in-the-middle attacks, steal or modify data, or deliver malware to the bucket. Most exposure to GhostWriter is said to be due to poor configuration by the bucket owners, rather than the cloud service provider.
Threat updates
| Date | Update |
|---|---|
| 20 Feb 2018 |
Recent news articles appear to indicate AWS have begun contacting users regarding mis-configured buckets and advising them to remediate. However, AWS have been informally contacting users since last year. |
Remediation steps
| Type | Step |
|---|---|
|
AWS administrators are encouraged to audit their S3 configuration policies, either manually or using a number of tools created by AWS. Additionally, administrators should check their AWS dashboard inbox for any messages from AWS indicating a vulnerability in their bucket configuration. |
Last edited: 17 February 2020 11:25 am