Researchers have uncovered thousands of misconfigured Amazon S3 storage buckets, making it possible to obtain access to potentially highly sensitive company data.

In the tests, penetration testing firm Rapid 7 was able to access personal photos from a social media service, a car dealership’s sales records and account information, firms’ employee records as well as unprotected database backups containing site data and encrypted password.

According to Will Vandevanter, senior security consultant at Rapid 7, the firm was able to access the information having identified more than a thousand publicly accessible Amazon S3 storage buckets.

Firms typically use Amazon’s S3 system to store static content such as server backups, company documents, web logs, and publicly visible content such as website images. The files in S3 are then organised into so-called buckets.

“Although a file might be listed in a bucket it does not necessarily mean that it can be downloaded. Buckets and objects have their own access control lists,” Vandevanter wrote on a company blog.

Firms that had stored their data insecurely in S3 could be set for a rude awakening, he warned.

“Much of the data could be used to stage a network attack, compromise users accounts, or to sell on the black market.”

Typically, Amazon would make S3 buckets private, so the public ones are likely to be the results of users misconfiguration, said Vandevanter. 

Nonetheless, Amazon Web Services makes it easier for would-be hackers by using a URL structure that is easy to guess, making it child’s play to access public buckets.

“Checking if a bucket is public or private is easy. All buckets have a predictable and publicly accessible URL,” he added.

Having identified hundreds of public buckets, Vandevanter and his colleagues took a random sample to check which buckets had accessible content.

They discovered more than five million accessible text documents, many of which where marked ‘private’ or confidential.

AWS told V3 there were many legitimate reasons users might choose to leave buckets open, but in cases where customers were unsure, it did its utmost to work with them to secure their data.

“AWS Support staff regularly reach out to customers who may have potential configuration issues with AWS, to assist those customers with achieving better efficiency, reduced costs, or in some cases, to remedy their security configuration and posture, for S3 and other services,” a company spokesman told V3.