Questions tagged [amazon]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
118 views

Has it been proven, that Google Home & Alexa do not record before their respective key phrases?

The way Alexa & Google Home should work, is that they listen for a specific trigger word, after which they start sending data to their servers. However, there have been some court cases, in which ...
0
votes
0answers
262 views

Information disclosure with AWS response headers

I'm currently testing a web application hosted on AWS. In the response headers, I've noticed various Amazon-related headers, I've never really seen before. The headers include: x-amzn-RequestId: <...
0
votes
1answer
124 views

Why does Amazon verify a TLS certificate?

Show site information, then Connection for https://support.mozilla.org indicates Verified by: Amazon Why is this? Is Amazon spying on me?
0
votes
1answer
116 views

Is amazon.com allowing authentication based on browser cookies only?

So I found out a couple of days ago that amazon.com has changed its behavior when trying to make a purchase. For years and up until recently, I could open a browser, log into amazon, close the browser....
0
votes
0answers
118 views

What is Amazon's GDPR role with Alexa for Business Conferencing?

With respect to GDPR and the Alexa for Business conferencing solution, is Amazon acting in the capacity of a data controller or a data processor, or even a sub-processor? Here's some information on ...
0
votes
0answers
56 views

Why was I not asked for CVV in amazon.com for my debit card? [duplicate]

I ordered some items in amazon.com .Payment mode was through mastercard debit and I was not asked for cvv. This is the first time i added the debit card though I initially had my credit card details ...
2
votes
1answer
155 views

What would be required to monitor Amazon Alexa traffic?

I had this interaction with a friend's robot today: "Alexa, are you spying on me?" "I only send audio data back to Amazon when I hear you say the wake word." If I wanted to ensure that ...
3
votes
1answer
125 views

AWS Flowlog for Private Subnet Showing Routable IP's

When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected. How is that possible? I expect IP addresses from the private subnet could be ...
0
votes
2answers
460 views

Blind SQL Injection on Amazon RDS

I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
0
votes
1answer
76 views

How to fix AWS security hole ALAS-2018-1045?

I am researching about the security hole CVE-2018-12020 and learned that you need to update to min version 2.2.8 to fix the issue. I need to fix this for my EC2. I read information from this offical ...
4
votes
2answers
1k views

Keeping AWS account ID secret

Must my AWS account ID be kept secret? Can anything at all be done using just the AWS account ID? From the AWS documentation: The AWS account ID is a 12-digit number, such as 123456789012, that ...
0
votes
1answer
145 views

What are the risks of placing Amazon Resource Names (ARNs) in VCS repositories?

Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational ...
0
votes
1answer
2k views

Amazon AWS KMS - Concept of signing in general and with JWT

Looking into Amazon AWS KMS (Key Management System). Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...
1
vote
1answer
231 views

Setting up linux to be SOC 2 compliant

We are setting up AWS servers to become SOC 2 compliant, to do that we need to discontinue support for the identified cipher suites and TLS 1.0 As I understand we need to leave only these suites ...
0
votes
1answer
173 views

Why http request signatures are useful? [closed]

Please provide pros of signing http api requests. For instance, Amazon requires requests to their web APIs be signed. If traffic is not encrypted, then a signature can prove your identity as a secret ...
2
votes
2answers
97 views

Are Amazon AWS instanceIds security sensitive?

For troubleshooting, it's useful to include HTTP response headers that indicate proxy and backend EC2 instance ids, such as: X-Backend: i-8af67c92e0f3d89b6b X-Via: i-5b8146e7102940c75b-us-east-2b Is ...
43
votes
8answers
22k views

Amazon let me place an order without me ever being asked for 3-D secure password

I have set a "3-d secure password" for my debit card, on my bank's website. But when I purchased something in amazon.co.uk, I went through the whole process without ever being asked for that 3D ...
0
votes
2answers
204 views

Email SPF record integrity

I have been reviewing my company's SPF record with a number of our SAAS providers. One service advised me to use 'include:amazonses.com' in my record to allow emails to be validated. I am rather ...
0
votes
2answers
152 views

Is Amazon Prime DRM able to scan a LAN for devices and services? [closed]

My company has signed up for Amazon Prime to watch some videos. They were asked to enable Amazon Prime DRM. Will this open up a security hole in our LAN? I am worried that they could start scanning ...
0
votes
2answers
904 views

Looking for a CIS Bechmark Tool to run against Amazon Linux 2016.09

I have been tasked with ensuring the CIS Bechmark on Amazon Linux 2016.09. Does anyone know of an examination tool that will output the difference between the current and the benchmark? ...
1
vote
1answer
702 views

Do AWS and GAE use DMZ?

The system I am working on primarily use Google App Engine for my main web app and Amazon Cloudfront/S3 for hosting static data. Now as an audit exercise this question is out to me: Are the ...
1
vote
0answers
60 views

What is Amazon's S3 template and can it be exploited?

I'm trying to make a vpn on CloudFormation following this guide. It's telling me to use the template given here. I'm not familar with what an S3 template does and whether if I should trust this guide ...
3
votes
1answer
680 views

OpenSSL version causes PCI Compliance failure

We have a client on AMI Linux (Amazon), which is currently using OpenSSL 1.0.1k-15.99. As far as I can tell Amazon is very good about backporting security patches as per this page: https://alas.aws....
0
votes
1answer
112 views

Network address (DNS) translation on Amazon Web Services (Ec2)

I am trying to figure out better ways to practice my computer defense/ infosec skills. If someone was to set up a honeypot (e.g., MHN) on AWS/EC2 server and then try to launch attacks from a local ...
3
votes
1answer
693 views

Amazon Echo/Dot on your network

I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network. Below is the reasons I have come up with so far. This is still the rough list. The ...
1
vote
1answer
149 views

Open SFTP on the main server - the safe way?

We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options: Open SFTP on our main server with restrictions (directory, user, size,...
1
vote
3answers
4k views

How to get a SSL Certificate for a public IP

I am using Amazon's EC2 to host my RDS database. I access the database via http calls to the EC2 instance, which in turn contacts the database. I would like to use https instead to allow for a more ...
5
votes
2answers
374 views

Why does Ubuntu make requests to these Amazon EC2 IPs at startup?

Each time I bootup and login to Ubuntu 16.04, and before I launch any software/browser, I watch in Wireshark that Ubuntu has some requests to and from these IPs: 54.173.79.111 54.231.40.234 Whois ...
0
votes
2answers
159 views

Best way to use http get with php server for mobile app

I am using an http server on Amazon Web Services running php and connecting to an RDS DB, also on AWS. I am sending GET requests to the server to get Information. The requests dont contain any private ...
5
votes
2answers
212 views

AWS declined to give me details on Multi-Factor Authentication reset procedure

I asked AWS: How do I recover access to AWS Account in case I lost device with Google Authenticator installed? In case my email was hacked, what will prevent hacker from removing MFA? Their answer ...
1
vote
1answer
2k views

Why can't I delete the default AWS security group?

There are no inbound nor outbound rules. It's an empty group. What use does it serve?
1
vote
2answers
344 views

CISecurity AMI EC2 Amazon

We are moving to Amazon our on-premise infrastructure and I'm trying to follow this document to increase our security of the ec2 instances : CISecurity Benchmark for Amazon Linux In the document, it'...
4
votes
2answers
812 views

Minimum required processes with open ports on AWS?

I recently started an AWS box to be used for a public web site and it seems to have the following ports open... I was long ago convinced that it's a good idea to minimize the attack surface on any box ...
1
vote
1answer
873 views

Cross-Device-Tracking on Facebook with partners like Amazon

I have a question regarding cross-device-tracking, especially on facebook. I'm interested in how this is done and I'm a bit concerned about my privacy. Yesterday I surfed on amazon (logged in with my ...
0
votes
1answer
418 views

Does amazon take down availability zones or regions for maintenance? [closed]

If there are details available any where regarding their past outages or maintenance windows that took down their entire availability zone or regions please share
5
votes
2answers
418 views

Security mechanism differences between Google and Amazon APIs

Does anyone know why Google and Amazon (AWS)'s API have such different ways to deal with security? For example, Google has a simple API key which you can revoke at any time, while Amazon has this ...
0
votes
0answers
62 views

I have to send my broken Tablet back, what should I do with my data?

The display of my Fire Tablet is broken, so I cannot do anything on the device. A member of support told me, when I remove the Tablet from my Amazon account via web browser, all data will be removed. ...
1
vote
1answer
58 views

How can I protect myself from one of my AWS EC2 instances being subverted and creating other instances?

I'm running a custom server program on a free tier EC2 instance. I'm not a security professional, so while I've taken every step I know how to to secure my software, it's very likely that there's some ...
12
votes
8answers
38k views

Is this “security update” from security-update@amazon.com an advanced phishing scam or a real security measure from Amazon?

I just got either a helpful security update from Amazon or an advanced phishing attempt by an Amazon impersonator falsifying the email origin. The title is "Your Amazon password has been changed". ...
0
votes
1answer
163 views

MySQL database (non-SSL) connections secured via origin/destination IPs, how unsafe are they?

I am testing an Amazon RDS MySQL solution: the database is provided by Amazon RDS but the application logic (php scripts) that accesses the data is hosted in another, different (non-amazon) server. ...
2
votes
1answer
420 views

Amazon RDS MySQL SSL connection, is the password sent in clear?

I am testing Amazon RDS MySQL and I want to connect to MySQL instance using SSL. It works pretty well, but there is something that is not clear to me: reading the FAQs (https://aws.amazon.com/rds/faqs/...
4
votes
1answer
585 views

Penetration Testing Vocabulary

The Terms and Conditions on Amazon's AWS prohibit activities called, "White cards" and "Red team and blue team testing". What do these terms mean?
1
vote
1answer
60 views

Can I use a TLS certificate (first generated for a Windows Server) on a Linux Server?

I don't have any experience on this kind of things, so please bear with me. And I apologise if this has been asked before, but I couldn't find it in this site. My situation: I have a Windows Server ...
5
votes
1answer
922 views

Why would Amazon include an already trusted Root CA in the bug report they filed to get into Mozilla's truststore?

Amazon will soon be a trusted Root CA. To this end Mozilla Bug #1172401 was filed a while back to get into Mozilla's trust store. Along with 4 of their own Root CAs they've included a fifth one (...
7
votes
1answer
2k views

Can personnel who manage AWS datacenters access my ec2 instances and monitor data in use in my application?

I am building an Express (NodeJS) app and plan to host with AWS ec2. I want to protect my users' data as much as possible and am considering even outlier scenarios. And so the question arose: The ec2 ...
2
votes
1answer
113 views

Why include the host in the signature of the Amazon HMAC scheme?

The Amazon's HMAC schemes includes the hash of the canonical request in the string to sign in order to create the signature, and the canonical request in turn includes the host. What is the security ...
2
votes
0answers
66 views

AWS GovCloud and ELB - SSL from Server to ELB, then ELB to consumer?

I'm reviewing the GovCloud notes, in particular AWS's "Elastic Load Balancer" and in their ITAR statement they mention (source: http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-elb....
22
votes
2answers
4k views

Why is Amazon's home page not encrypted? [closed]

I've been working on my very first web application and I usually refer to Amazon.com as my role model. I'm very interested in deploying my web application with SSL/TLS. However, there is one thing ...
0
votes
1answer
213 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
7
votes
2answers
255 views

What are the compliance requirements or standards for a non-US firm hosting personal data in the US?

I work for a head hunting company with offices in Canada and Asia. We migrated our custom built CRM system from our own servers hosted in Japan to an Amazon hosting service meaning that all our data ...