Hack of webpage hosted on S3

0

This domain name has DNS hosted by Route 53. The DNS "A" record is pointed to an S3 bucket. There is a DNS "CNAME" record for "www" that points to the "A" record.

When you visit this URL (without www), you see the file in the s3 bucket that I intended: index.html. When you visit the URL with www, you see a website hosted by a hacker:

http://printsafe.net http://www.printsafe.net

The hacker created a bucket using the "www" version of my domain name. He then uploaded his content to that bucket. AWS and S3 server the hacker's content when visiting the "www" version of my domain name.

I solved this by modifying the DNS record in Route 53. For the "www" record, I switched the "www" from a CNAME. I change it to an "A" record that points to 127.0.0.1

John W
已提問 10 個月前檢視次數 389 次
4 個答案
1

If you own the domain printsafe.net then you own the DNS record for www.printsafe.net Id check DNS configuration and bucket settings are correct.

It may be a case of miss configuration. A hacker cant create a bucket in your subdomain unless they have access to your DNS records. If you suspect this, then contact AWS Support

Either that or the bucket could be public read/write and someone has modifed the code.

profile picture
專家
已回答 10 個月前
0
已接受的答案

I do control the DNS. What the hacker did was to configure his own S3 bucket using the "www" variant of my domain name. AWS S3 did NOT detect this or prevent this.

The is a security hole in S3.

John W
已回答 10 個月前
  • S3 buckets do not control DNS records. You create alias to buckets. If you are naming your buckets after your domain name thats a different matter. Anyone can create a bucket of any name

0

If you suspect that your AWS account may have been compromised, please contact AWS Support immediately.

To route domain traffic to an S3 bucket, use Amazon Route 53 to create an alias record that points to your bucket. An alias record is a Route 53 extension to DNS. It's similar to a CNAME record, except you can create an alias record both for the root domain, such as example.com, and for subdomains.

AWS
Piotrek
已回答 10 個月前
0

Another way to overcome this situation is to put a CloudFront distribution in front of your S3 bucket. This will allow you to use both addresses and your bucket can have any name. See:

  1. Amazon S3 + Amazon CloudFront: A Match Made in the Cloud.
  2. Speeding up your website with Amazon CloudFront
  3. AWS Free Tier Data Transfer Expansion – 100 GB From Regions and 1 TB From Amazon CloudFront Per Month
profile pictureAWS
專家
kentrad
已回答 10 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南