Recently, we have heard multiple stories revolving around "AWS S3 bucket Leaks", How can we avoid this? Here is a checklist of things you should configure to ensure your critical data is secure.

what seemed to be an obvious configuration mistake, two primary reasons surfaced:

1. Too Much Flexibility (Too Many Options) Turns into Easy Mistakes
There are five different ways to configure and manage access to S3 buckets.
The more ways to configure implies more flexibility but also means that higher chances of making a mistake. The other challenge is that there are two separate policies one for buckets and one for the objects within the bucket which make things more complex.

2. A “User” in AWS is Different from a “User” in your Traditional Datacenter
On an AWS account, the “Everyone” group includes all users (literally anyone on the internet) and “AWS Authenticated User” means any user with an AWS account


S3 Security Checklist

• Audit for Open Buckets Regularly
• Encrypt the Data
• Encrypt the Data in Transit
• Enable Bucket Versioning
• Enable MFA Delete
• Enable Logging
• Monitor all S3 Policy Changes
• Track Applications Accessing S3
• Limit Access to S3 Buckets
• Close Buckets in Real time

http://infosecisland.com/blogview/25056-Avoiding-Holes-in-Your-AWS-Buckets.html

Did you know Amazon alexa can send voice mails (I am being sarcastic here). It can send your private conversation , without your knowledge, and to a random contact). - Woman says her Amazon device recorded private conversation, sent it out to random contact

But Danielle said two weeks ago their love for Alexa changed with an alarming phone call. "The person on the other line said, 'unplug your Alexa devices right now,'" she said. "'You're being hacked.'"

he proceeded to tell us that he had received audio files of recordings from inside our house," she said. "At first, my husband was, like, 'no you didn't!' And the (recipient of the message) said 'You sat there talking about hardwood floors.' And we said, 'oh gosh, you really did hear us.'"

"They (Amazon )said 'our engineers went through your logs, and they saw exactly what you told us, they saw exactly what you said happened, and we're sorry.' He apologized like 15 times in a matter of 30 minutes and he said we really appreciate you bringing this to our attention, this is something we need to fix!"



https://www.kiro7.com/news/local/woman-says-her-amazon-device-recorded-private-conversation-sent-it-out-to-random-contact/755507974

"Alexa, are you spying on me?" — aaaa.....mmmm.....hmmm.....maybe!!!

Amazon  allows developers to build custom 'skills,' applications for Alexa, which is the brain behind millions of voice-activated smart devices including Amazon Echo Show, Echo Dot, and Amazon Tap.

Security researchers have developed a new malicious 'skill' for Amazon's popular voice assistant Alexa that can turn your Amazon Echo into a full-fledged spying device.




Luckily, you can still spot the spy red handed if you notice the blue light on your Echo device activated for a longer period, especially when you are not chit-chatting with it


https://thehackernews.com/2018/04/amazon-alexa-hacking-skill.html