AWS Data Breaches

Summary

The provided content discusses various AWS data breaches in 2023, detailing the causes and instances of security incidents affecting AWS environments.

Abstract

The web content provides an overview of the causes behind data breaches on Amazon Web Services (AWS) in 2023, including misconfigurations, compromised third-party access, and malware attacks. It highlights specific cases such as the use of a honeypot to catch nation-state actors, ransomware attacks on AWS buckets, and the exploitation of software vulnerabilities leading to data leaks. The content also references the exposure of sensitive data due to misconfigured S3 buckets, the abuse of AWS services for cryptojacking, and the discovery of malware targeting AWS Lambda environments. Additionally, it mentions the importance of proper permission scoping to mitigate attacks, as demonstrated by an incident where limited permissions prevented a significant data breach. The author, Teri Radichel, offers insights into AWS security, drawing from her expertise and recognition in the cybersecurity field, and provides resources for further engagement with her work.

Opinions

The author emphasizes the importance of AWS's internal threat intelligence decoy system, MadPot, in disrupting nation-state-backed APTs and botnets.
There is a concern about the frequency and impact of data breaches due to misconfigured AWS services, such as S3 buckets and AWS servers.
The author suggests that AWS environments are targeted by sophisticated malware, such as the Legion malware, which has evolved to exploit SSH servers and AWS credentials.
The content implies that misconfigurations in web applications remain a primary attack vector for threat actors to retrieve AWS credentials.
The author points out that despite the severity of some breaches, proper limitation of permissions can significantly reduce the impact of a security incident.
There is an opinion that the cybersecurity community should be aware of and prepared for the evolving tactics of threat actors, as evidenced by the first malware discovered running on AWS Lambda environments.
The author's inclusion of various external links and resources indicates a belief in the value of sharing knowledge and staying informed about the latest security threats and mitigation strategies.

AWS Data Breaches

What’s causing data breaches on AWS?

AWS Using MadPot Decoy System to Disrupt APTs, Botnets

AWS says an internal threat intel decoy system called MadPot has successfully trapped nation state-backed APTs like…

UK councils caught in Capita unsecured AWS bucket data leak

As for March megabreach? M&S and Guinness maker Diageo warn pension members about data risks

Black Basta ransomware attack to cost Capita over £15m | Computer Weekly

Exceptional costs arising from the March 2023 Black Basta ransomware attack on the systems of outsourcer Capita will be…

CircleCI working with AWS to identify, rotate tokens impacted by the breach

CircleCI said the company's goal in partnering with AWS is to help customers easily identify and revoke or rotate any…

Malware Attack on CircleCI Engineer's Laptop Leads to Recent Security Incident

DevOps platform CircleCI recently fell victim to a breach after an employee's laptop was hacked. Attacker used malware…

EpiSource LLC Confirms Recent Data Breach Stemming from Unauthorized Access to AWS Information | JD…

On June 2, 2023, EpiSource LLC filed a notice of data breach with the Attorney General of California after learning…

Security researcher finds trove of Capita data exposed online | TechCrunch

London-based outsourcing giant Capita left a trove of data exposed in an unprotected AWS storage bucket for 7 years

DC health exchange breach traced back to misconfigured Amazon server

Members of the House Oversight Committee sought answers on Wednesday about a recent breach of Washington D.C.'s health…

White nationalist publisher's data exposed in Amazon cloud leak

Data from Greg Johnson's Counter-Currents sheds light on how organization promotes its ideology online

Researchers warn Amazon's AWS System Manager agent can be used as a RAT

Mitiga researchers found that the AWS SSM agent could be hijacked and turned into a remote access trojan that is…

AWS cryptojacking campaign abuses less-used services to hide

The AMBERSQUID cryptojacking campaign exploits cloud services without triggering AWS approval processes.

CVE-2023-20593

AWS is aware of CVE-2023-20593, otherwise known as " Zenbleed", and can confirm this issue affected AMD "Zen 2", also…

Wiz Says 62% of AWS Environments Exposed to Zenbleed Exploitation

Researchers say a whopping 62 percent of AWS environments may be exposed to the newly documented AMD 'Zenbleed'…

Legion Malware Upgraded to Target SSH Servers and AWS Credentials

Legion malware evolves with expanded capabilities. Latest version exploits SSH servers and gains access to DynamoDB and…

Clouded Judgment: How a Former Amazon Employee Hacked Capital One

Paige Thompson engineered one of the biggest data breaches in history from her bedroom in South Seattle. Her trial…

How Kubernetes Cryptomining Became an AWS Cloud Data Heist

The opportunistic "SCARLETEEL" attack on a firm's Amazon Web Services account turns into targeted data theft after the…

Infosys leak: IT firm left AWS key exposed on PyPi since Feb 2021

Infosys leak file accidentally published to PyPi contained "god mode" AWS key to S3 bucket potentially containing…

Hijacked S3 buckets used in attacks on npm packages

Cybercrooks use abandoned AWS storage tool to deliver malware

Python Package Index found stuffed with AWS keys and malware

British developer uses homegrown scanning tool to check for risks

This new malware targets AWS Lambda environments

Updated: Denonia malware is abusing servers to run cryptocurrency miners.

First Malware Running on AWS Lambda Discovered

Amazon Web Services (AWS) Lambda, serverless computing's poster child, is over seven years old and only now has…