[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[ISN] Cloud Services Credentials Easily Stolen Via Google Code Search
By Tim Wilson
Nov 09, 2011
The access codes and secret keys of thousands of public cloud services
users can be easily found with a simple Google code search, a team of
security researchers says.
Researchers at Stach & Liu, a security consulting firm that develops
Google hacking tools, first revealed the results of their cloud services
research (PDF) at the Hacker Halted conference last month in Miami. Now
the team is offering one word of advice to companies that are
considering storing critical information on the public cloud: Don't.
"It is not a good idea to put sensitive data out in the cloud right now
-- at least not until there are intrusion-detection systems that would
let users see these types of searches on their cloud services," says
Fran Brown, managing director at Stach & Liu. "Companies are pushing
forward on the cloud because they want the functionality, but they're
not seeing the risk."
In an online demonstration, Brown showed how an attacker who knows
Google and some simple facts about cloud services authentication can
easily find the access codes, passwords, and secret keys needed to
unlock data stored in public cloud services environments such as
Subscribe to InfoSec News - www.infosecnews.org