Slashdot Mirror
The Windows Flaw That Cracks Amazon Web Services
Nerval's Lobster writes "Developer and editor Jeff Cogswell decided to poke around the security of Amazon Web Services, and found a potential loophole that could theoretically allow anyone — a developer, an unscrupulous Amazon employee, the NSA — to access and copy data volumes stored on the system, using a slightly modified version of the popular 'chntwp' password tool. In this article, he breaks down how he did it, and suggests some ways for those who use cloud-hosting services to keep their data a little more secure in the future. 'The key here, of course, is that an unscrupulous employee might be able to make a copy of any existing Windows volume, and go to work on it without the customer ever knowing that it happened,' he writes. 'Now let's be clear: I'm not accusing anyone of having done this; in fact, I doubt anybody has, considering I was unable to find a working copy of chntpw until I modified it.' It's a security concern, and one that's particularly insidious to patch."
If you mount your Windows harddrive in Linux without using Encryption you can access all your Data?
Not news at all. You can do this on any operating system of any type assuming your not using an encrypted system.
Oh look, it's yet another case of "If you have physical access to the server, all bets are off.". If you can clone the volume, you effectively have physical access to the server. This isn't a new vulnerability. Just another case of "It's on the webz, it must a a completely novel thing!".
1. Take a Windows server on Amazon Web Services, make a copy of the hard drive (which Amazon calls a volume),
If you can do this, the system is already compromised in a dozen different, less-interesting, ways.
The question is whether you can do this without already having the passwords, with EC2's existing security. I see no evidence from the article he can.
Without that, the claim is half gratuitous cleverness, half FUD of an attention-grabbing vendor name, to my eyes.
~ Whence do you come, slayer of men, or where are you going, conqueror of space?
chntpw has been in the wild since 1997. It's wonderful that the researcher just realized that it works on cloud volumes just as well as physical volumes, but this it flat out not news. It's also mitigated by deploying an Active Directory domain controller if you want to stick with windows or rolling one yourself with krb5/ldap/samba/etc. if you want your backend servers running unix of whatever variant you like.
And this isn't even a vulnerability.
The ability to share disks by copying or moving them from one machine to another is an AWS feature.
It's common that you'd launch a high-CPU compute node (which might be windows) to prepare a set of data on a disk; and then kill that expensive high-CPU node when the data's ready; and move the disk to another machine (which might be running Linux).
Isn't that exactly what the author described?