AWS S3 Bucket Misconfiguration: Lessons Learned from SEGA Europe’s recent security blunder

A misconfiguration in SEGA Europe’s AWS S3 bucket exposed credentials and confidential data between October 18 and October 28, 2021. A thorough scan of cloud assets and risk assessment can help organizations identify such exposures that could result in data misuse or even tarnish brand image.

AWS S3 misconfiguration: Security incident in SEGA, Europe

SEGA Corporation is a Japanese multinational video game entertainment company, with SEGA of America and SEGA Europe being its international wings. On January 3, 2022, it came to light that several sensitive files of the European branch were put to risk, owing to a misconfiguration in its AWS S3 bucket. Being a multi-million-selling gaming franchise catering to over twenty million customers directly, SEGA Corporation acted in time to fix the security hole before malicious actors could effectuate a costly attack.

The incident highlights two types of cloud misconfigurations –

1) The AWS S3 bucket was set to public access permissions.

2) Hard-coded credentials were stored in the cloud.

In this blog, we will look into the details of AWS S3 misconfigurations and understand how organizations can avoid issues arising from such lapses.

Security Risks from Cloud Misconfigurations

Cloud misconfigurations are one of the most common and easily overlooked exposures introduced into organizational assets, often by mistake. These could be any error, glitch or gap in the set up or configuration of an application. According to Gartner’s Hype Cycle for Cloud Security Report, more than 99% of cloud breaches will loop back to misconfigurations or human errors, through 2025.

How are AWS S3 misconfigurations introduced

Simple Storage Service (S3) buckets are cloud repositories for Amazon Web Services, providing object storage through a web service interface. Most often, the data in these repositories needs to be shared across multiple users, and this is when S3 bucket misconfigurations arise.

Buckets that host support pages are made public, in order to allow all users to access the page.
When documents in S3 storage are shared with users, they are given more permissions than required. For example, a user who needs to view the document is given write access to the folder.
While resources are re-used for other purposes, the old permission settings are re-used, without validation.
Sometimes, S3 buckets are used as file share to share text files or documents containing plain text, with details like credentials stored in an easily accessible location.

Each of the above scenarios, while seemingly minor issues, are the No.1 cause for S3 misconfigurations that could lead to data breaches. Interestingly, S3 buckets default to private settings. Thus, it is the owner/user of the S3 bucket who is responsible for the misconfiguration.

Exposures from AWS S3 Misconfigurations

What are the exposures these misconfigurations can cause? How severe an impact can they have? To understand this, let us look into the implications of the SEGA S3 misconfiguration incident.

Insufficient privacy/control settings for the AWS S3 bucket of SEGA led to the following services being compromised, besides potential data compromise that included API keys, internal messaging systems, cloud systems, user data and more.

Tips to prevent Cloud Misconfigurations

The cloud is in constant flux, and what’s secure today may not hold good tomorrow. A huge component of this security comes from managing the exposures due to misconfigured assets. The impact of human error is huge, not only in missing critical configuration aspects, but also while remediating those misconfigurations. While the SEGA issue stands as an example of the former, the various vulnerabilities being identified in newer fixes for Apache Log4j exemplify the latter.

Here are four steps that can help organizations prevent misconfigurations in their cloud assets. Broadly, these can be categorized into discovering the assets and configuring each right.

Discover all the assets (resources) in the cloud
Catalogue the services running on every asset (resource)
Identify configuration rules for each of the assets (resources)
Perform rule checks for every asset (resource)

As a thumb rule, all assets must be set to private mode. If the asset needs to be offered public access, the settings should default to “Read only” status.

How Securin can help with preventing cloud and S3 misconfigurations

Securin’s Attack Surface Management (ASM) platform can help you address all misconfigurations, right from the discovery to the remediation stage. Securin can perform two types of scans and identify the exposures in your assets, including misconfigurations.

Authenticated Scan – The user specifies the resources and assets to be scanned for exposures. Securin can also scan asset integrations like cloud, scanners and ticketing systems.
Unauthenticated Scan – All assets are discovered based on domain or company name and scanned for exposures. Depending on access permissions provided, Securin can also scan for all existing S3 buckets including those left unattended or forgotten about.

In specific, Securin allows you to add AWS S3 buckets as an asset in the ASM platform to monitor it 24×7. You can also add other AWS resources by adding an AWS connector via the “Integrations” pane and choose the services to scan for exposures. The Securin rules engine automatically checks for all exposures, including those covered by AWS paid services like Inspector and Security Hub.

Below, we list the major S3 bucket exposures that Securin ASM can help you identify. These help you understand if your asset conforms to the basic security, performance and cost optimization rules.

Access Settings

Authenticated User Permissions
Cross Account Access
Encryption
Data transport and Logging
Enabled Feature checks
Compliance Checks
Checks for hardcoded credentials

An Extensive Asset Discovery & Exposure Scan is what organizations need

A single misconfiguration left unaddressed can provide attackers enough to get started with a major attack. These misconfigurations can also serve as the initial access vector in attack that combine multiple exposures to enter into and crawl deeper into organizational networks. Organizations need to be wary of all exposures in their attack surfaces and address them before they can be exploited by cyber adversaries to launch a cyber attack. Ensure you scan your assets for all possible exposures and fix them in time!