{"id":40854,"date":"2021-05-12T14:31:25","date_gmt":"2021-05-12T14:31:25","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/32278\/AWS-Configuration-Issues-Lead-To-Exposure-Of-5-Million-Records.html"},"modified":"2021-05-12T14:31:25","modified_gmt":"2021-05-12T14:31:25","slug":"aws-configuration-issues-lead-to-exposure-of-5-million-records","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/aws-configuration-issues-lead-to-exposure-of-5-million-records\/","title":{"rendered":"AWS Configuration Issues Lead To Exposure Of 5 Million Records"},"content":{"rendered":"
\n
Visitors arrive at the cloud pavilion of Amazon Web Services at the 2016 CeBIT digital technology trade fair in Hanover, Germany. AWS <\/a>System Manager (SSM) misconfigurations led to the potential exposure of more than 5 million documents with personally identifiable information and credit card transactions on more than 3,000 SSM documents. (Photo by Sean Gallup\/Getty Images)<\/figcaption><\/figure>\n

Researchers reported on Tuesday that Amazon Web Services<\/a> System Manager (SSM) misconfigurations led to the potential exposure of more than 5 million documents with personally identifiable information and credit card transactions on more than 3,000 SSM documents.<\/p>\n

In a blog,<\/a> Check Point researchers said they have worked with AWS Security<\/a> to provide customers with the necessary information to help them resolve any configuration issues with the SSMs.   <\/p>\n

AWS SSM documents contain the operations that an AWS systems manager performs on a company\u2019s cloud assets. SSM documents are private by default, but developers can share them with other AWS accounts or publicly.<\/p>\n

In analyzing the SSM documents, the Check Point<\/a> researchers found that the misconfigurations took place because developers did not follow the proper parameters of usage as defined in the AWS best practices<\/a>.<\/p>\n

According to the researchers, a misconfigured public SSM document can give an attacker valuable information about the account\u2019s internal resources and operations. This not only serves as a basis for social engineering attacks, but can lead to the exposure of additional resources. An SSM document can provide an attacker an initial foothold into the victim\u2019s environment and sometimes even grant a view into the account\u2019s deployment processes, resources, and backup procedures.<\/p>\n

Here are four steps the researchers says security teams can take to configure SSM documents safely:<\/p>\n