Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [amazon]

The tag has no usage guidance.

-1
votes
0answers
25 views

How ITSM service management helps to become successful? [on hold]

How does amazon is using ITSM and become successful and how did they upgrade it from existing service?
1
vote
1answer
103 views

Has it been proven, that Google Home & Alexa do not record before their respective key phrases?

The way Alexa & Google Home should work, is that they listen for a specific trigger word, after which they start sending data to their servers. However, there have been some court cases, in which ...
0
votes
0answers
56 views

Information disclosure with AWS response headers

I'm currently testing a web application hosted on AWS. In the response headers, I've noticed various Amazon-related headers, I've never really seen before. The headers include: x-amzn-RequestId: <...
0
votes
1answer
101 views

Why does Amazon verify a TLS certificate?

Show site information, then Connection for https://support.mozilla.org indicates Verified by: Amazon Why is this? Is Amazon spying on me?
0
votes
1answer
82 views

Is amazon.com allowing authentication based on browser cookies only?

So I found out a couple of days ago that amazon.com has changed its behavior when trying to make a purchase. For years and up until recently, I could open a browser, log into amazon, close the browser....
0
votes
0answers
50 views

What is Amazon's GDPR role with Alexa for Business Conferencing?

With respect to GDPR and the Alexa for Business conferencing solution, is Amazon acting in the capacity of a data controller or a data processor, or even a sub-processor? Here's some information on ...
0
votes
0answers
40 views

Why was I not asked for CVV in amazon.com for my debit card? [duplicate]

I ordered some items in amazon.com .Payment mode was through mastercard debit and I was not asked for cvv. This is the first time i added the debit card though I initially had my credit card details ...
2
votes
1answer
101 views

What would be required to monitor Amazon Alexa traffic?

I had this interaction with a friend's robot today: "Alexa, are you spying on me?" "I only send audio data back to Amazon when I hear you say the wake word." If I wanted to ensure that ...
3
votes
1answer
74 views

AWS Flowlog for Private Subnet Showing Routable IP's

When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected. How is that possible? I expect IP addresses from the private subnet could be ...
0
votes
2answers
181 views

Blind SQL Injection on Amazon RDS

I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
0
votes
1answer
62 views

How to fix AWS security hole ALAS-2018-1045?

I am researching about the security hole CVE-2018-12020 and learned that you need to update to min version 2.2.8 to fix the issue. I need to fix this for my EC2. I read information from this offical ...
2
votes
1answer
211 views

Keeping AWS account ID secret

Must my AWS account ID be kept secret? Can anything at all be done using just the AWS account ID? From the AWS documentation: The AWS account ID is a 12-digit number, such as 123456789012, that ...
0
votes
1answer
76 views

What are the risks of placing Amazon Resource Names (ARNs) in VCS repositories?

Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational ...
0
votes
1answer
973 views

Amazon AWS KMS - Concept of signing in general and with JWT

Looking into Amazon AWS KMS (Key Management System). Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...
1
vote
1answer
175 views

Setting up linux to be SOC 2 compliant

We are setting up AWS servers to become SOC 2 compliant, to do that we need to discontinue support for the identified cipher suites and TLS 1.0 As I understand we need to leave only these suites ...
0
votes
1answer
127 views

Why http request signatures are useful? [closed]

Please provide pros of signing http api requests. For instance, Amazon requires requests to their web APIs be signed. If traffic is not encrypted, then a signature can prove your identity as a secret ...
1
vote
2answers
76 views

Are Amazon AWS instanceIds security sensitive?

For troubleshooting, it's useful to include HTTP response headers that indicate proxy and backend EC2 instance ids, such as: X-Backend: i-8af67c92e0f3d89b6b X-Via: i-5b8146e7102940c75b-us-east-2b Is ...
43
votes
7answers
19k views

Amazon let me place an order without me ever being asked for 3-D secure password

I have set a "3-d secure password" for my debit card, on my bank's website. But when I purchased something in amazon.co.uk, I went through the whole process without ever being asked for that 3D ...
0
votes
2answers
152 views

Email SPF record integrity

I have been reviewing my company's SPF record with a number of our SAAS providers. One service advised me to use 'include:amazonses.com' in my record to allow emails to be validated. I am rather ...
0
votes
2answers
129 views

Is Amazon Prime DRM able to scan a LAN for devices and services? [closed]

My company has signed up for Amazon Prime to watch some videos. They were asked to enable Amazon Prime DRM. Will this open up a security hole in our LAN? I am worried that they could start scanning ...
0
votes
2answers
669 views

Looking for a CIS Bechmark Tool to run against Amazon Linux 2016.09

I have been tasked with ensuring the CIS Bechmark on Amazon Linux 2016.09. Does anyone know of an examination tool that will output the difference between the current and the benchmark? ...
1
vote
1answer
568 views

Do AWS and GAE use DMZ?

The system I am working on primarily use Google App Engine for my main web app and Amazon Cloudfront/S3 for hosting static data. Now as an audit exercise this question is out to me: Are the ...
1
vote
0answers
60 views

What is Amazon's S3 template and can it be exploited?

I'm trying to make a vpn on CloudFormation following this guide. It's telling me to use the template given here. I'm not familar with what an S3 template does and whether if I should trust this guide ...
3
votes
1answer
605 views

OpenSSL version causes PCI Compliance failure

We have a client on AMI Linux (Amazon), which is currently using OpenSSL 1.0.1k-15.99. As far as I can tell Amazon is very good about backporting security patches as per this page: https://alas.aws....
0
votes
1answer
106 views

Network address (DNS) translation on Amazon Web Services (Ec2)

I am trying to figure out better ways to practice my computer defense/ infosec skills. If someone was to set up a honeypot (e.g., MHN) on AWS/EC2 server and then try to launch attacks from a local ...
4
votes
1answer
608 views

Amazon Echo/Dot on your network

I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network. Below is the reasons I have come up with so far. This is still the rough list. The ...
1
vote
1answer
143 views

Open SFTP on the main server - the safe way?

We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options: Open SFTP on our main server with restrictions (directory, user, size,...
1
vote
3answers
3k views

How to get a SSL Certificate for a public IP

I am using Amazon's EC2 to host my RDS database. I access the database via http calls to the EC2 instance, which in turn contacts the database. I would like to use https instead to allow for a more ...
5
votes
2answers
328 views

Why does Ubuntu make requests to these Amazon EC2 IPs at startup?

Each time I bootup and login to Ubuntu 16.04, and before I launch any software/browser, I watch in Wireshark that Ubuntu has some requests to and from these IPs: 54.173.79.111 54.231.40.234 Whois ...
0
votes
2answers
143 views

Best way to use http get with php server for mobile app

I am using an http server on Amazon Web Services running php and connecting to an RDS DB, also on AWS. I am sending GET requests to the server to get Information. The requests dont contain any private ...
6
votes
2answers
190 views

AWS declined to give me details on Multi-Factor Authentication reset procedure

I asked AWS: How do I recover access to AWS Account in case I lost device with Google Authenticator installed? In case my email was hacked, what will prevent hacker from removing MFA? Their answer ...
1
vote
1answer
1k views

Why can't I delete the default AWS security group?

There are no inbound nor outbound rules. It's an empty group. What use does it serve?
1
vote
2answers
190 views

CISecurity AMI EC2 Amazon

We are moving to Amazon our on-premise infrastructure and I'm trying to follow this document to increase our security of the ec2 instances : CISecurity Benchmark for Amazon Linux In the document, it'...
4
votes
2answers
617 views

Minimum required processes with open ports on AWS?

I recently started an AWS box to be used for a public web site and it seems to have the following ports open... I was long ago convinced that it's a good idea to minimize the attack surface on any box ...
1
vote
1answer
792 views

Cross-Device-Tracking on Facebook with partners like Amazon

I have a question regarding cross-device-tracking, especially on facebook. I'm interested in how this is done and I'm a bit concerned about my privacy. Yesterday I surfed on amazon (logged in with my ...
0
votes
1answer
387 views

Does amazon take down availability zones or regions for maintenance? [closed]

If there are details available any where regarding their past outages or maintenance windows that took down their entire availability zone or regions please share
5
votes
2answers
398 views

Security mechanism differences between Google and Amazon APIs

Does anyone know why Google and Amazon (AWS)'s API have such different ways to deal with security? For example, Google has a simple API key which you can revoke at any time, while Amazon has this ...
0
votes
0answers
62 views

I have to send my broken Tablet back, what should I do with my data?

The display of my Fire Tablet is broken, so I cannot do anything on the device. A member of support told me, when I remove the Tablet from my Amazon account via web browser, all data will be removed. ...
1
vote
1answer
55 views

How can I protect myself from one of my AWS EC2 instances being subverted and creating other instances?

I'm running a custom server program on a free tier EC2 instance. I'm not a security professional, so while I've taken every step I know how to to secure my software, it's very likely that there's some ...
12
votes
8answers
38k views

Is this “security update” from security-update@amazon.com an advanced phishing scam or a real security measure from Amazon?

I just got either a helpful security update from Amazon or an advanced phishing attempt by an Amazon impersonator falsifying the email origin. The title is "Your Amazon password has been changed". ...
0
votes
1answer
152 views

MySQL database (non-SSL) connections secured via origin/destination IPs, how unsafe are they?

I am testing an Amazon RDS MySQL solution: the database is provided by Amazon RDS but the application logic (php scripts) that accesses the data is hosted in another, different (non-amazon) server. ...
2
votes
1answer
362 views

Amazon RDS MySQL SSL connection, is the password sent in clear?

I am testing Amazon RDS MySQL and I want to connect to MySQL instance using SSL. It works pretty well, but there is something that is not clear to me: reading the FAQs (https://aws.amazon.com/rds/faqs/...
5
votes
1answer
444 views

Penetration Testing Vocabulary

The Terms and Conditions on Amazon's AWS prohibit activities called, "White cards" and "Red team and blue team testing". What do these terms mean?
1
vote
1answer
60 views

Can I use a TLS certificate (first generated for a Windows Server) on a Linux Server?

I don't have any experience on this kind of things, so please bear with me. And I apologise if this has been asked before, but I couldn't find it in this site. My situation: I have a Windows Server ...
6
votes
1answer
866 views

Why would Amazon include an already trusted Root CA in the bug report they filed to get into Mozilla's truststore?

Amazon will soon be a trusted Root CA. To this end Mozilla Bug #1172401 was filed a while back to get into Mozilla's trust store. Along with 4 of their own Root CAs they've included a fifth one (...
6
votes
1answer
2k views

Can personnel who manage AWS datacenters access my ec2 instances and monitor data in use in my application?

I am building an Express (NodeJS) app and plan to host with AWS ec2. I want to protect my users' data as much as possible and am considering even outlier scenarios. And so the question arose: The ec2 ...
2
votes
1answer
101 views

Why include the host in the signature of the Amazon HMAC scheme?

The Amazon's HMAC schemes includes the hash of the canonical request in the string to sign in order to create the signature, and the canonical request in turn includes the host. What is the security ...
2
votes
0answers
60 views

AWS GovCloud and ELB - SSL from Server to ELB, then ELB to consumer?

I'm reviewing the GovCloud notes, in particular AWS's "Elastic Load Balancer" and in their ITAR statement they mention (source: http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-elb....
22
votes
2answers
4k views

Why is Amazon's home page not encrypted? [closed]

I've been working on my very first web application and I usually refer to Amazon.com as my role model. I'm very interested in deploying my web application with SSL/TLS. However, there is one thing ...
0
votes
1answer
188 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...