7

Lately, whenever I click on a download link in Google Chrome, it redirects to another link starting with s3.amazonaws.com, which in turn gets blocked either by Chrome or by my Antivirus (Comodo Internet Security). Copying the same link into Firefox or(*) a download manager downloads the file normally.

I have tried resetting Chrome settings, disconnecting my Google account, removing all extensions, disabling all plugins, and performing a system scan, but the issue persists.

My question is: What exactly is s3.amazonaws.com? Is it malicious, or is Chrome mistrusting it? And how do I fix the issue?

Edit:

An example file that invokes such behavior is Pandoc msi setup from this page

(*) It no longer works with Firefox

Improve this question
7
  • @thexacre clicking the link you posted leads me directly to this one: s3.amazonaws.com/github-cloud/releases/571770/… which is blocked by my browser – Tymric Apr 5 '15 at 0:58
  • 1
    My mistake, you're right. The link is on a GitHub domain but it 302 redirects to an S3 domain. You might want to a. post this on the Pandoc issue tracker github.com/jgm/pandoc/issues and b. ask for a checksum of the packages so you can confirm the ones you downloaded haven't been tampered with. – thexacre Apr 5 '15 at 1:01
  • For me the md5sum of pandoc-1.13.2-windows.msi is d368d072a2b84c72f1ed863db96d7826. I didn't have any trouble downloading it but I'm on Ubuntu and I don't have Comodo. – thexacre Apr 5 '15 at 1:03
  • 1
    It looks like you used 1.13.1 but mine was for 1.13.2. I downloaded 1.13.1 and got f40cb166d8f915afa9df978c014cc94d the same as you. – thexacre Apr 5 '15 at 1:23
  • 1
    It might just be a false positive, but I'd encourage you to raise this issue on their issue tracker just in case. I myself have been involved with a fairly large open source project who were the the victim of targeted attacks to both compromise our GitHub accounts and tamper with our download packages. It can happen. – thexacre Apr 5 '15 at 1:31
19

s3.amazonaws.com is an endpoint for a cloud file storage product offered by Amazon Web Services (AWS) and is used by many websites and apps (albeit usually behind the scenes, but you can serve files from it directly too).

Seeing references to that domain is definitely not inherently malicious, however given that you can store just about any file in S3 there's no guarantee that it isn't being used to store some malicious files (among the overwhelmingly legitimate files). AWS credentials are a valuable target for hackers so it's possible the owner of the account has been compromised.

Chrome and Comodo may know that attributes such as the size, checksum, name, etc. of the file match that of known malware which is why they're blocking it (rather than necessarily because it's served from s3.amazonaws.com).

I'd recommend reporting it via the AWS abuse form or by emailing abuse@amazonaws.com. If it is malware then they'll most likely remove it and contact the account owner. AWS is usually extremely proactive about security issues.

Improve this answer
0
2

The main problem is sites that might serve malware hide behind the relative anonymity of the cdns. You're not likely able to differentiate between one cdn source as legitimate as another. You essentially need a higher level way of determining endpoint identity such as that provided through ssl than just eyeballing the url. Alternatively you could try to figure out the ipv4 address and go from there.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.