---
title: 'GhostWriter' Newly Discovered AWS S3 Bucket Threat
description: Researchers discover a new type of S3 bucket vulnerability that allows your data to be overwritten for a potential man in the middle attack.
---

[SecureWorld News ](https://www.secureworld.io/industry-news)

# ['GhostWriter' Newly Discovered AWS S3 Bucket Threat](https://www.secureworld.io/industry-news/new-aws-s3-bucket-threat)

 Written by [SecureWorld News Team](https://www.secureworld.io/industry-news/author/secureworld-news-team) | Mon | Nov 6, 2017 | 3:37 PM Z

Cloud security--and who owns the risk--was part of an Advisory Council roundtable last week at SecureWorld Denver.

And the consensus is that all sides own a slice of the risk.

Amazon Web Services, for example, operates under a shared responsibility model. AWS is responsible for the security of the cloud infrastructure. The client is responsible for properly configuring each server in the cloud that it uses.

And that's where companies are running into trouble. Mis-configured servers in the cloud have left sensitive information open and exposed. That was the case with [Accenture's exposed cloud database](https://www.secureworld.io/industry-news/report-accenture-exposes-cloud-databases) in the fall of 2017. There have been almost weekly examples of issues like this

### **New Vulnerability called 'GhostWriter'**

Now, researchers at SkyHigh networks have [discovered](https://www.skyhighnetworks.com/cloud-security-blog/skyhigh-discovers-ghostwriter-a-pervasive-aws-s3-man-in-the-middle-exposure/) a new kind of AWS S3 bucket vulnerability that can lead to a man-in-the-middle (MITM) attack because some S3 buckets are configured to allow public writes.

<https://www.secureworld.io/hubfs/Blog_images/aws-s3-bucket-vulnerability.png>"Bucket owners who store Javascript or other code should pay particular attention to this issue to ensure that 3rd parties don’t silently overwrite their code for drive-by attacks, bit-coin mining or other exploits. Even benign image or document content left open for overwriting can be exploited for steganography attacks or malware distribution," says Chief Scientist Sekhar Sarukkai.

The company found that these open third-party buckets are wide-ranging and owned by leading national news/media sites, large retail stores, popular cloud services, and leading advertisement networks.

 

"As the cloud increasingly becomes the de-facto source of computing and storage resources for websites and applications, we are seeing new types of exposures and attack vectors we would not have imagined before," says Sarukkai.

 

[View full post](https://www.secureworld.io/industry-news/new-aws-s3-bucket-threat)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "SecureWorld News Team"
  },
  "dateModified" : "2017-11-06T15:52:19.046Z",
  "datePublished" : "2017-11-06T15:37:01Z",
  "headline" : "'GhostWriter' Newly Discovered AWS S3 Bucket Threat",
  "image" : {
    "@type" : "ImageObject",
    "height" : 566,
    "url" : "https://cdn2.hubspot.net/hubfs/2221756/Social%20Media%20images/cloud_upload_and_download_flat_icons_by_superawesomevectors-da9tyqo.jpg",
    "width" : 800
  },
  "mainEntityOfPage" : "https://www.secureworld.io/industry-news/new-aws-s3-bucket-threat",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/2221756/Logos/SWE/SWE_logo_full-long_forWHITEbackgrounds.jpg",
      "width" : 304.46954
    },
    "name" : "SecureWorld News"
  }
}
```