The new open source scanner 'S3crets Scanner' allows researchers and red-teamers to search for sensitive information accidentally stored in publicly exposed Amazon AWS S3 storage buckets.
See also: Daniel Kaye accused of running dark web market The Real Deal
Amazon S3 (Simple Storage Service) is a cloud storage service used by businesses to store software, data files, and data in containers known as buckets.
Unfortunately, companies sometimes fail to properly secure S3 buckets and thus publicly expose the stored data to the Internet.
See also: LinkedIn: New security features to combat fake accounts
Unfortunately, these types of misconfigurations have been the cause of data breaches in the past, leaving employee and customer information vulnerable to attacks.
Secrets, such as authentication keys, access tokens, and API keys, can be found in source code or configuration files stored in S3 buckets.
If malicious actors gain access to these secrets, they could gain unauthorized access to other services or the company 's corporate network .
Scanning S3 for secrets
When security researcher Eilon Harel was investigating the recent SEGA data leak, he realized there were no tools available to scan for such leaks. So he decided to create his own automated scanner and release it as an open-source tool on GitHub.
Harel's Python tool, “S3crets Scanner,” automatically does the following to help quickly discover secrets exposed in public S3 buckets:
- CSPM can create a list of public buckets
- Creates a list of bucket contents via API calls.
- Check for exposed text files before opening them.
- Download the necessary text files.
- Scan content for secrets
- Sending results to SIEM
The following configuration changes will ensure that S3 buckets are not accidentally left open to the public:
- “BlockPublicAcls”
- “BlockPublicPolicy”
- “IgnorePublicAcls”
- “RestrictPublicBuckets”
Any buckets that were intended to be public are filtered from the list before downloading the text files for the “secrets scanning” step.
See also: Microsoft: Fixes TLS handshake failures in latest Windows update
The script using Trufflehog3 – an improved Go-based secrets scanner – will scan the bucket's text files for credentials and private keys in GitHub, GitLab, file systems, and S3 buckets.
Trufflehog3 scans files downloaded by S3crets for exposure to personally identifiable information (PII) and internal access tokens using a set of custom rules designed by Harel.
The researcher believes that if “S3crets Scanner” is used to scan an organization’s assets frequently, it could help businesses reduce the risk of data leakage or network breach caused by the disclosure of secrets.
In addition to malicious uses, the tool can also be used to warn owners of exposed secrets before they are found by malicious actors.
Information source: bleepingcomputer.com
