14

I'm uploading files on S3, where the filename is a UUID. All files uploaded are publicly read/write, however these files are considered private to users.

Is it possible for someone to guess a UUID, or randomly try a bunch of combinations to access some of these files?

Is there a better way to secure S3 files?

  • 3
    Guess? Probably depends on how the UUIDs are being generated. Note that if they're trying for a specific file (or from a specific user), they're probably out of luck, but they can probably get a random one eventually. I'd imagine Amazon already has something setup for security - what does their service provide/documentation suggest? – Clockwork-Muse Mar 16 '14 at 3:16
12

UUIDs generated following RFC 4122 come in several “versions”; in a UUID of the form xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx (in hexadecimal), then:

  • If 8 ≤ N ≤ b and M=1 or M=2 then the UUID identifies the machine that generated it and the time it was generated.
  • If 8 ≤ N ≤ b and M=3 or M=5 then the UUID is generated deterministically using a cryptographic hash function.
  • If 8 ≤ N ≤ b and M=4 then the UUID is random (with 6 fixed bits and 122 random bits).

If the UUID doesn't meet any of these constraints, it wasn't generated according to RFC 4122. But even if the constraints are met, this doesn't guarantee than the RFC was followed, or that the random generator was a good one.

I don't know what S3 does for UUIDs.

Even if the UUIDs are properly random, which would make the URL unguessable, protecting access to a resource with only a URL is a bad idea. URLs tend to leak in many ways: shared in emails or chat, lying around in browser histories and bookmark lists, accidentally copied around, or worse, left as a link in a page that the author meant to keep private but that had no authentication and got indexed by Google.

If you want to protect access to a resource on the web, do not rely on the URL being kept secret. Add an authentication mechanism. Even plain old password authentication is a huge improvement on an unguessable URL — browsers and even people know that they shouldn't be sharing passwords around, whereas URLs are normally public knowledge.

  • But if I have access to your browser history, I'll have access to your browser, and I can access that secure page anyway (regardless of whether it's authenticated by URL or not). – Pacerier Feb 16 '15 at 8:23
  • 1
    @Pacerier Not necessarily. You could see the history via shoulder surfing. Or you could have access to my browser data but not to my passwords, which wouldn't let you log in to a site with authentication. – Gilles 'SO- stop being evil' Feb 16 '15 at 13:32
3

The 100% correct solution, obviously, would be not to make files publicly readable and writable. That's out of your control here, but it is also not strictly necessary.

The server is set up in a way similar to how incoming folders have been set up on FTP servers for 30-40 years: You can cd into that directory and create/write files, and read any files that you can open, but you cannot list the directory's contents (and optionally, you can create and write any file, but not overwrite an existing one).

Assuming that file names cannot be guessed, this is secure insofar as you can't do much without knowing a file's name. An UUID has 128 bits, but you could use any other random file name of the same or greater size (or a 160-bit random name, if you think 128 bits are not enough).
While it is in theory possible to guess a random 128-bit number (and there is even a chance that two filenames will collide by accident), the chances for such a thing to happen is astronimically small given the time it takes to access a file over the network (which severely limits the number of operations per second that you can do). This is much different from e.g. someone brute-forcing a hash from a stolen password database, where the attacker would typically try a few hundred million hashes per second.
You are probably more likely to die from being hit by a meteor than to ever see this in your life.

Also, a quick Google says that S3 supports folders, so if you are in ultra-paranoia mode, you can create a folder with a UUID name and place your UUID-named files in there. Someone would have to guess a 256 bit number correctly for accessing a file, you can be pretty sure that this won't happen during your lifetime.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.