Hundreds of leaked AWS keys give full control over corporate accounts
Truffle Security said 88% of tested credentials still worked, and many quarantined keys could still disable logging or alter cloud resources.
5 Articles
5 Articles
Researchers found 768 leaked AWS keys that still work, and the containment policy leaves plenty possible
Truffle Security found 768 leaked AWS keys granting full control of corporate accounts, including 526 root keys, with 88% of tested credentials still active. AWS applies a quarantine policy to keys it detects as leaked, which still permits a long list of damaging actions. Researchers have found 768 leaked Amazon Web Services keys that still […] This story continues at The Next Web
The Register
IT Security News - cybersecurity, infosecurity newsAWS Security makes an inscrutable choice
One of the best ways to lower your AWS bill by 99 percent or more is by not checking your keys into public GitHub repositories. Many of us have done this inadvertently over the years, and the defenses against it have improved dramatically (my personal favorite being "using non-ephemeral credentials derived from OIDC or SSO is an anti-pattern"), but it still happens. On Friday, BleepingComputer reported on a Truffle Security finding that hundreds…
A Truffle Security investigation identified 768 leaked AWS keys that still allowed access to corporate accounts, while an analysis of the provider's quarantine policy warns of potentially destructive actions that might remain available. *** Truffle Security collected 431,875 AWS secrets and verified 10,616 complete credentials, of which 88% were still authenticated. Among the exposures there were 526 root keys, the highest level of privilege for…
Coverage Details
Bias Distribution
- 67% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
