{"id":18542,"date":"2023-05-25T04:05:56","date_gmt":"2023-05-25T11:05:56","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=18542"},"modified":"2024-04-23T08:58:12","modified_gmt":"2024-04-23T15:58:12","slug":"aws-s3-bucket-misconfiguration-lessons-learned-from-sega-europes-recent-security-blunder","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/aws-s3-bucket-misconfiguration-lessons-learned-from-sega-europes-recent-security-blunder\/","title":{"rendered":"AWS S3 Bucket Misconfiguration: Lessons Learned from SEGA Europe’s recent security blunder"},"content":{"rendered":"\t\t
A misconfiguration in SEGA Europe’s AWS S3 bucket exposed credentials and confidential data between October 18 and October 28, 2021. A thorough scan of cloud assets and risk assessment can help organizations identify such exposures that could result in data misuse or even tarnish brand image.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t SEGA Corporation is a Japanese multinational video game entertainment company, with SEGA of America and SEGA Europe being its international wings. On January 3, 2022, it came to light that several sensitive files of the European branch were put to risk, owing to a misconfiguration in its AWS S3 bucket<\/a>. Being a multi-million-selling gaming franchise catering to over twenty million customers directly, SEGA Corporation acted in time to fix the security hole before malicious actors could effectuate a costly attack.<\/p> The incident highlights two types of cloud misconfigurations –<\/p> 1) The AWS S3 bucket was set to public access permissions.<\/p> 2) Hard-coded credentials were stored in the cloud.<\/p> In this blog, we will look into the details of AWS S3 misconfigurations and understand how organizations can avoid issues arising from such lapses.<\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t Cloud misconfigurations are one of the most common and easily overlooked exposures introduced into organizational assets, often <\/span>by mistake. These could be any error, glitch or gap in the set up or configuration of an application. According to Gartner’s Hype Cycle for Cloud Security Report, more than 99% of cloud breaches will loop back to misconfigurations or human errors, through 2025.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t Simple Storage Service (S3) buckets are cloud repositories for Amazon Web Services, providing object storage through a web service interface.\u00a0\u00a0Most often, the data in these repositories needs to be shared across multiple users, and this is when S3 bucket misconfigurations arise.<\/p> Buckets that host support pages are made public, in order to allow all users to access the page.<\/p><\/li> When documents in S3 storage are shared with users, they are given more permissions than required. For example, a user who needs to view the document is given write access to the folder.<\/p><\/li> While resources are re-used for other purposes, the old permission settings are re-used, without validation.<\/p><\/li> Sometimes, S3 buckets are used as file share to share text files or documents containing plain text, with details like credentials stored in an easily accessible location.<\/p><\/li><\/ul> Each of the above scenarios, while seemingly minor issues, are the No.1 cause for S3 misconfigurations that could lead to data breaches. Interestingly, S3 buckets default to private settings. Thus, it is the owner\/user of the S3 bucket who is responsible for the misconfiguration.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t What are the exposures these misconfigurations can cause? How severe an impact can they have? To understand this, let us look into the implications of the SEGA S3 misconfiguration incident.<\/p> Insufficient privacy\/control settings for the AWS S3 bucket of SEGA led to the following services being compromised, besides potential data compromise that included API keys, internal messaging systems, cloud systems, user data and more.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t The cloud is in constant flux, and what’s secure today may not hold good tomorrow. A huge component of this security comes from managing the exposures due to misconfigured assets. The impact of human error is huge, not only in missing critical configuration aspects, but also while remediating those misconfigurations. While the SEGA issue stands as an example of the former, the various vulnerabilities being identified in newer fixes for Apache Log4j<\/a> exemplify the latter.<\/p> Here are four steps that can help organizations prevent misconfigurations in their cloud assets. Broadly, these can be categorized into discovering the assets and configuring each right.<\/p> Discover all the assets (resources) in the cloud<\/p><\/li> Catalogue the services running on every asset (resource)<\/p><\/li> Identify configuration rules for each of the assets\u00a0(resources)<\/p><\/li> Perform rule checks for every asset (resource)<\/p><\/li><\/ol> As a thumb rule, all assets must be set to private mode. If the asset needs to be offered public access, the settings should default to “Read only” status.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t February 2022<\/p> <\/div>\n\n <\/td>\n Securitas<\/p> <\/div>\n\n <\/td>\n Sweden-based multinational security company<\/p> <\/div>\n\n <\/td>\n 3TB data exposed, Columbia and Peru airport employee data leaked<\/span><\/p> <\/div>\n\n <\/td>\n Link<\/a><\/p> <\/div>\n\n <\/td>\n January 2022<\/p> <\/div>\n\n <\/td>\n SEGA Europe<\/p> <\/div>\n\n <\/td>\n European wing of the gaming giant<\/span><\/p> <\/div>\n\n <\/td>\n Multiple related domains affected<\/span><\/p> <\/div>\n\n <\/td>\n AWS S3 misconfiguration: Security incident in SEGA, Europe<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
Security Risks from Cloud Misconfigurations<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
How are AWS S3 misconfigurations introduced<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
Exposures from AWS S3 Misconfigurations <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
Tips to prevent Cloud Misconfigurations<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n