Misconfigured AWS EBS Snapshots Expose Corporate Secrets to the Open Internet
New research presented at Def Con reveals that companies inadvertently leave Amazon EBS snapshots public, exposing application keys, source code, and VPN configurations. These misconfigured cloud storage volumes act as digital keys to the kingdom for anyone on the internet.
Security researchers at the Def Con conference reveal that companies and governments are inadvertently leaking highly sensitive data through misconfigured Amazon Web Services Elastic Block Storage (EBS) snapshots. Much like the widely known issue of exposed S3 buckets, these EBS volumes store complete application data, secret keys, and customer databases, essentially serving as the keys to the kingdom for whoever accesses them.
Ben Morris, a senior security analyst at Bishop Fox, explains that cloud administrators frequently fail to apply the correct configuration settings, leaving these snapshots both public and unencrypted. This oversight allows anyone on the internet to download a company's virtual hard disk, attach it to their own machine, and search through the files for valuable secrets without needing to hack any systems.
Morris builds a tool using Amazon's own internal search feature to automatically detect, copy, and catalog the contents of these exposed snapshots within minutes of them becoming public. In just two months and for only a few hundred dollars, he uncovers dozens of publicly exposed volumes containing application keys, administrative credentials, source code, and VPN configurations from major healthcare and tech companies.