MISTRUSTED ADVISOR: EVADING DETECTION WITH PUBLIC S3 BUCKETS AND POTENTIAL DATA EXFILTRATION IN AWS

Summary from the TLDR InfoSec newsletter

Researchers from Fog Security discovered three methods to bypass AWS Trusted Advisor and expose S3 buckets without triggering alerts. The three methods are to create a bucket policy that denies s3:GetBucketPolicyStatus, s3:GetBucketPublicAccessBlock, and s3:GetBucketAcl. Fog Security coordinated disclosure with AWS, but noted that it took AWS two attempts to fix the vulnerability and felt that AWS's communication downplayed the severity.