Sign here: Abusing presigned URLs for fun and profit!

AWS presigned URLs have become a popular way to provide secure and sane access to S3 buckets and other resources. But the security of presigned URLs greatly relies on the implementation and integrations made with individual systems, and simple mistakes can result in unwittingly signing sensitive data away to an attacker. As S3 buckets continue to be an abundant source of low hanging fruit for threat actors, we discover that presigned URLs might not be the silver bullet that S3 security needs.

In this talk, I will cover the cardinal sins that can be committed when implementing presigned access to S3 buckets, the resulting attacks that can arise from these mistakes, and how developers can best avoid them.

This talk will begin with a brief introduction to AWS presigned URLs and what problems they aim to solve for access to S3 or other services. The various types of implementations will be discussed, briefly touching on some past S3 flaming disasters, and how presigned URLs provide - in theory - a means to prevent such issues from ever occurring.

Following this, we'll move onto a more formal classification of the mistakes that can be made when implementing access via presigned URLs. This will cover oversights that can be made when architecting solutions using presigned URLs, assumptions leading to security holes, and touch on what the impact of this could be from a technical and business perspective. This section of the talk will also cover a dive into different types of attacks against presigned URLs that exploit weaknesses in implementation.

Finally, we'll explore regaining sanity via the mitigations against the aforementioned issues and introduce a simple sanity check for implementation that developers can use to safeguard their applications. This will include a brief dive into incident readiness for S3 and what measures should be set up to prepare for an S3 related incident. This will include a conclusion on the contents of the talk and touch on other hardening measures that can be taken with S3 buckets to improve their security.