[ISN] Cloud Services Credentials Easily Stolen Via Google Code Search

[InfoSec News <alerts@xxxxxxxxxxxxxxx>]

http://www.darkreading.com/cloud-security/167901092/security/vulnerabilities/231902718/cloud-services-credentials-easily-stolen-via-google-code-search.html

By Tim Wilson
Dark Reading
Nov 09, 2011

The access codes and secret keys of thousands of public cloud services 
users can be easily found with a simple Google code search, a team of 
security researchers says.

Researchers at Stach & Liu, a security consulting firm that develops 
Google hacking tools, first revealed the results of their cloud services 
research (PDF) at the Hacker Halted conference last month in Miami. Now 
the team is offering one word of advice to companies that are 
considering storing critical information on the public cloud: Don't.

"It is not a good idea to put sensitive data out in the cloud right now 
-- at least not until there are intrusion-detection systems that would 
let users see these types of searches on their cloud services," says 
Fran Brown, managing director at Stach & Liu. "Companies are pushing 
forward on the cloud because they want the functionality, but they're 
not seeing the risk."

In an online demonstration, Brown showed how an attacker who knows 
Google and some simple facts about cloud services authentication can 
easily find the access codes, passwords, and secret keys needed to 
unlock data stored in public cloud services environments such as 
Amazon's EC3.

[...]


_____________________________________________________
Subscribe to InfoSec News - www.infosecnews.org
http://www.infosecnews.org/mailman/listinfo/isn