When did you last check your AWS S3 security? Here's four scary words: 17k Magecart infections

If you're in charge of your organization's Amazon Web Services S3 buckets, here's some fresh motivation to check your security settings: the notorious payment-card-stealing Magecart malware is romping through unprotected storage silos. Infosec detectives at San Francisco-based RiskIQ reported this week that as many as 17,000 …

[sabroni]

Re: AWS security issues again?

The issue is that public write access has been enabled by AWS users.

How is that AWS' fault?

If you set up a site that captures credit card information you are responsible for securing it.

Surprised you didn't blame MS tbh.

[Michael Hoffmann]

unprotected...

You now actually have to go out of your way to leave an S3 bucket unprotected. Mind-boggling.

Because some code monkey can't figure out a bucket policy and/or IAM role they just click on the "public" button (*).

(*) button because they can only use AWS via console and can't figure out the CLI/API.

[yoganmahew]

Clean sweep...

Let me just go to me clean backup. It's here in this nice S3 bucket... oh...

[Mark Manderson]

we all know the type!

public assignment, cos its just "easier" same eedjits who still believe UAC is just a hindrance and "doesnt work quite right" head up arse and stuck in NT4 times.

[Gordon 10]

But but but but.....

What the fudge is source code used in a payment system doing on S3 in the first place? Thats even more stupid than committing your AWS keys to GitHub.

There should be a line in the PCI DSS spec that says using S3 for source code is an automatic certification withdrawal offence.