http://www.darkreading.com/cloud-security/167901092/security/vulnerabilities/231902718/cloud-services-credentials-easily-stolen-via-google-code-search.html By Tim Wilson Dark Reading Nov 09, 2011 The access codes and secret keys of thousands of public cloud services users can be easily found with a simple Google code search, a team of security researchers says. Researchers at Stach & Liu, a security consulting firm that develops Google hacking tools, first revealed the results of their cloud services research (PDF) at the Hacker Halted conference last month in Miami. Now the team is offering one word of advice to companies that are considering storing critical information on the public cloud: Don't. "It is not a good idea to put sensitive data out in the cloud right now -- at least not until there are intrusion-detection systems that would let users see these types of searches on their cloud services," says Fran Brown, managing director at Stach & Liu. "Companies are pushing forward on the cloud because they want the functionality, but they're not seeing the risk." In an online demonstration, Brown showed how an attacker who knows Google and some simple facts about cloud services authentication can easily find the access codes, passwords, and secret keys needed to unlock data stored in public cloud services environments such as Amazon's EC3. [...] _____________________________________________________ Subscribe to InfoSec News - www.infosecnews.org http://www.infosecnews.org/mailman/listinfo/isnReceived on Thu Nov 10 2011 - 00:13:21 PST
This archive was generated by hypermail 2.2.0 : Thu Nov 10 2011 - 00:20:27 PST