Amazon Details Measures to Counter S3 Encryption Hacks

Amazon Web Services is urging its customers to deploy additional security measures to secure S3 buckets following reports of ransomware attacks targeting the platform.

See Also: AI, Cloud, and Cyber Threats: A Financial Sector Survival Guide

In an alert, Amazon said malicious actors re-encrypted data stored in Amazon S3 buckets using legitimate customer credentials. The attacks targeted the application’s server-side encryption or SSE-C, using client-provided keys used by Amazon to securely process encryption keys without storing them.

The company did not disclose details of the attacks but added it detected a “large number” operations tied to the S3 file copying feature CopyObject. The hacker used SSE-C to overwrite objects, causing re-encryption of “customer data with a new encryption key.”

Although the company was able to mitigate the attacks, it said it is difficult to “reliably distinguish valid usage from malicious use” since the hackers used legitimate customer credentials. The company is urging its customers to deploy additional security measures to secure their S3 environment.

These include blocking SSE-C as an encryption for unused applications, implementing data recovery through S3 versioning to keep multiple versions of an object and copying or sharing backups of critical data to a different bucket.

“These mitigations have already prevented a high percentage of attempts from succeeding,” Amazon said.

The alert from the company comes just days after security firm Halcyon RISE uncovered a ransomware campaign that exploited AWS S3 buckets. The security firm attributed the campaign to a threat group it tracks as Codefinger (see: Ransomware Campaign Targets Amazon S3 Buckets).

The campaign began with attackers identifying AWS keys with permissions to read and write S3 objects. The attackers initiated encryption using an AES-256 key generated and stored it locally.

Since AWS only logs an HMAC of the key while processing it – which is insufficient to reconstruct the key or decrypt the data – it allowed the hackers to manipulate the life cycle management policies of SSE-C. Attackers set a data deletion deadline of seven days to force the victims to pay the ransom.

Halcyon RISE said the attack tactics posed significant risks as it can lead to permanent data loss, and permit attackers to jeopardize the entire IT infrastructure of the victim organization.