Incident: Improperly Configured Amazon S3 Bucket Exposes Millions of Data

Published Date: 2017-07-15

Postmortem Analysis
Timeline 1. The software failure incident involving the exposure of personal data for three million World Wrestling Entertainment fans due to an S3 bucket misconfiguration was confirmed late last week in the article published on 2017-07-15 [61289]. Therefore, the software failure incident happened in early July 2017.
System 1. Amazon S3 cloud repositories [61289] 2. Database misconfigurations [61289]
Responsible Organization 1. Human error, specifically misconfigurations, was responsible for causing the software failure incident mentioned in the article [61289].
Impacted Organization 1. World Wrestling Entertainment (WWE) fans - 3 million fans' personal data was exposed due to an S3 bucket misconfiguration [61289]. 2. Verizon customers - Between six and 14 million Verizon customers had their data exposed due to a badly set-up bucket [61289].
Software Causes 1. Improperly set up database configurations leading to exposure of personal data for millions of users [61289] 2. Misconfigurations in Amazon S3 cloud repositories exposing data of millions of customers [61289] 3. Common errors in infrastructure setups, such as mismanaging web domain exposure and granting excessive user privileges, leading to security vulnerabilities [61289] 4. Rushed software development cycles leading to small but significant mistakes in production environments [61289]
Non-software Causes 1. Human error in setting up the database configurations [61289] 2. Lack of proper awareness and training on secure configurations for cloud repositories like Amazon S3 [61289]
Impacts 1. Personal data for three million World Wrestling Entertainment fans was exposed due to an S3 bucket misconfiguration [61289]. 2. Data of between six and 14 million Verizon customers was exposed because of a badly set-up bucket [61289].
Preventions 1. Implementing service-specific analysis to identify common errors in infrastructure, working with database developers and cloud providers to spread awareness, and creating secure defaults to prevent misconfigurations [61289]. 2. Looking systemically at the software development cycle to avoid rushed production and reduce the chances of significant mistakes [61289].
Fixes 1. Conducting service-specific analysis to identify common errors and working with companies like database developers and cloud providers to spread awareness [61289]. 2. Looking systemically at the software development cycle to prevent rushed production and reduce the chances of significant mistakes [61289].
References 1. Security researcher Victor Gevers, co-founder of the GDI Foundation [Article 61289] 2. Threat research group Detectify Labs [Article 61289] 3. Mark Testoni, president of SAP National Security Services [Article 61289]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to misconfigurations exposing data has happened again at World Wrestling Entertainment (WWE). The article mentions that an S3 bucket misconfiguration had exposed personal data for three million of its fans [61289]. (b) The software failure incident related to misconfigurations exposing data has also happened at Verizon, where a badly set-up bucket exposed the data of between six and 14 million customers [61289]. This indicates that similar incidents have occurred at multiple organizations.
Phase (Design/Operation) design, operation (a) The articles discuss software failure incidents related to the design phase, where misconfigurations and bad defaults in systems like Amazon S3 repositories have led to data exposures. These misconfigurations are attributed to human error and rushed production cycles that increase the chances of significant mistakes [61289]. The need for secure defaults, proactive scanning for exposures, and system audit capabilities is highlighted to address these design-related failures. (b) The articles also touch upon software failure incidents related to the operation phase, where misconfigurations in system setups that were never intended to be connected to the internet have inadvertently exposed data online. Developers failing to reconfigure infrastructure to be public-facing have led to unintended weaknesses making their way onto the web, contributing to operational failures [61289].
Boundary (Internal/External) within_system (a) The software failure incident discussed in the articles is primarily within_system. The incident was caused by misconfigurations and bad defaults in setting up databases and cloud repositories, leading to the exposure of sensitive data of millions of users [61289]. The misconfigurations were attributed to human error and the rushed production cycle in software development, highlighting internal factors contributing to the failure. Additionally, the article mentions the need for companies to create secure defaults and proactively scan for exposures, indicating that improvements can be made within the system to prevent such incidents in the future.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The article discusses misconfigurations in Amazon S3 cloud repositories that have exposed data of millions of users. These misconfigurations were not directly caused by human actions but rather by improper setup and defaults in the system. For example, the mismanagement of web domain exposure and granting too many user privileges in S3's Access Control Lists were identified as common errors leading to these exposures [61289]. (b) The software failure incident occurring due to human actions: The article highlights that human error, specifically misconfigurations, is at the core of the insecurity issue. These misconfigurations are introduced by human actions during the setup and maintenance of systems. The article emphasizes that the software development cycle, which can lead to rushed production and significant mistakes, is a contributing factor introduced by human actions [61289].
Dimension (Hardware/Software) software (a) The articles do not specifically mention any software failure incident occurring due to contributing factors originating in hardware. Therefore, the information related to a software failure incident occurring due to hardware issues is unknown. (b) The software failure incidents discussed in the articles are primarily attributed to misconfigurations in databases and cloud repositories, which are contributing factors originating in software. These misconfigurations have led to the exposure of personal data for millions of users, such as in the cases of World Wrestling Entertainment and Verizon customers. The articles emphasize that human error, specifically misconfigurations and bad defaults, are at the core of the insecurity issues, highlighting the importance of addressing software-related issues to prevent data exposures and breaches [61289].
Objective (Malicious/Non-malicious) non-malicious (a) The objective of the software failure incident was non-malicious. The incident was caused by misconfigurations in Amazon S3 buckets, leading to the exposure of personal data for millions of users. These misconfigurations were attributed to human error and were not intentional acts to harm the system [61289].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions The intent of the software failure incident discussed in the articles can be categorized into both poor_decisions and accidental_decisions: (a) poor_decisions: The incident of exposing personal data for millions of fans of World Wrestling Entertainment and Verizon customers was a result of misconfigurations in Amazon S3 buckets. These misconfigurations were due to poor decisions made during the setup of the database, leading to the inadvertent exposure of sensitive information online [61289]. (b) accidental_decisions: The misconfigurations and bad defaults that led to the exposure of data were described as low-hanging fruit and mistakes that anyone might make in the course of their jobs. The misconfigurations were attributed to human error, indicating that they were accidental decisions rather than intentional actions [61289].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is highlighted in the article. It mentions how misconfigurations in databases, particularly in Amazon S3 cloud repositories, have exposed sensitive data of millions of users due to human error and lack of professional competence in setting up secure configurations [61289]. (b) The software failure incident related to accidental factors is also evident in the article. It discusses how minor errors made in the course of jobs, such as misconfigurations, can have significant impacts on millions of consumers and users, indicating that these failures were not intentional but rather accidental due to human mistakes [61289].
Duration permanent (a) The articles discuss software failure incidents that can be considered permanent in nature. The misconfigurations and bad defaults in services like Amazon S3 cloud repositories have led to the exposure of sensitive data for millions of users [61289]. These misconfigurations are highlighted as a new strain of online criminal behavior in 2017, with human error being at the core of the insecurity issue. The problems arising from misconfigurations are ongoing and require long-term solutions to address the underlying issues [61289]. (b) The articles do not specifically mention any temporary software failure incidents caused by contributing factors introduced by certain circumstances but not all.
Behaviour omission, value, other (a) crash: The articles do not specifically mention any software failure incident related to a crash where the system loses state and does not perform any of its intended functions. (b) omission: The incident described in the articles is related to a misconfiguration in the setup of databases, particularly Amazon S3 buckets, which led to the omission of proper security measures and exposed sensitive data of millions of users [61289]. (c) timing: The articles do not mention any software failure incident related to timing, where the system performs its intended functions but at incorrect times. (d) value: The software failure incident discussed in the articles is related to the misconfiguration of databases, leading to the system performing its intended functions incorrectly by exposing sensitive data to unauthorized access [61289]. (e) byzantine: The articles do not mention any software failure incident related to a byzantine behavior, where the system behaves erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident described in the articles can be categorized as a security vulnerability resulting from misconfigurations in the setup of databases, particularly Amazon S3 buckets, leading to the exposure of sensitive data to potential cyber threats [61289].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) Property: People's material goods, money, or data was impacted due to the software failure. The articles discuss how misconfigurations in databases, particularly in Amazon S3 cloud repositories, have led to the exposure of personal data for millions of individuals. For example, a misconfigured S3 bucket exposed personal data for three million World Wrestling Entertainment fans and between six and 14 million Verizon customers [61289]. These incidents highlight how software failures, such as misconfigurations, can result in the compromise of sensitive information and data belonging to individuals, impacting their property in terms of data security and privacy.
Domain entertainment (a) The failed system in the incident was related to the entertainment industry. The incident involved World Wrestling Entertainment (WWE) confirming that a misconfigured Amazon S3 bucket had exposed personal data for three million of its fans [61289]. (k) The software failure incident was specifically related to the entertainment industry, as it affected the data of WWE fans due to a misconfigured Amazon S3 bucket [61289].

Sources

Back to List