Amazon bucket and direct download vulnerability

[drbyte]

Hi Jason

Can you please email me. There is a major leak in the url associated with some certain products using Amazon bucket name and s2member

Sam

[Cristián Lávaque]

Sam, could you please email the details using this contact form? http://s2member.com/contact

[drbyte]

Hi Cris

I did, couple of times last night. I am awaiting his response.

[Cristián Lávaque]

Cool.

[drbyte]

Hi Cris

I don't think there is a fix for this one, so there has to be another alternative way to deliver inline media files using S3&S2M.

[drbyte]

Hi Cris

Can s2m protect subdomains? http://site.main.com using URI Level Access Restrictions...If not..is there a hack for it?

Sam

[Cristián Lávaque]

Got it. Well, I'll wait for Jason. He's in his Ivory Tower these days, coding away. I hope he gets back to you soon. You know he's done it as soon as he could in the past. Thanks for your help and patience!

Can s2m protect subdomains? http://site.main.com using URI Level Access Restrictions...If not..is there a hack for it?

No, s2Member can only protect content delivered via the WordPress installation it's in. What do you need to protect? Another script?

[drbyte]

Hi Cris...

Well, the first part is what we suppose to protect is easily can be figured out and that's what I want Jason to look at. I can email you what I have.

The second part is what seems to be AppleLand want to be different and difficult. Well, it's all smart phones and tablets. The problems is huge when you serve large media to those devices. On the Android part, it will play just fine until you slide your finger on the seek bar...that's when it all goes bye bye, koko, and adios.

You will have to reload the page and start the media from the beginning. These devices wont function correctly when S3 & S2M serves the media directly for the bucket

Same goes for the iPhone and the iPad with sour cream and a red Chili. They don't like direct URL that contain "?". Especially the iPad, Holly crap, and good luck.

So, I turned to Amazon CloudFront using the http download option. PERFECT (speed & smooth seek). It plays perfectly using the video tags. No need to any plugin if you are planning to deliver the media via Android, iPhone and the iPad.

Now, the catch for the above is not to hide the bucket name and use cname (CNAME). It works 100% on all devices when configured but you'll have to use a subdomain. Meaning http://media.wesite.com

So instead of having a link that looks like http://bucketname.s3.amazonaws.com/test.mp4, it would be http://media.website.com/test.mp4

You can accomplish this using S2M and S3.....and that's a problem

If S2M can protect subdomains then we don't have to worry about some people taking http://media.website.com/test.mp4 and sticking it in their player (If). Will it work....not sure..I can't test it.

Well, if somebody got hold of the media..which can be viewed by looking at the log...all what you have to do is change your cname name and all the hotlinking will be broken

S3 alone speed range between 200 & 480Kbps. S3 & CloudFront speed range from 700 to 1200Kbps. Amazing ha!!! Serving files between 150 to 800MB)

Seek time on devises using S3 is not possible. Using CloudFront is smooth as silk.

[Cristián Lávaque]

Ah, got it. Thanks for the explanation. I look forward to Jason's comments on this.

[drbyte]

Is he taking cover from Hurricane Irene that is passing by the East Coast? I know he's in Georgia but not sure how close the hurricane will come his way...I suppose just the end of it

[Jason Caldwell]

Is he taking cover from Hurricane Irene that is passing by the East Coast? I know he's in Georgia but not sure how close the hurricane will come his way...I suppose just the end of it

Hey Sam, just got your email and Cristián pointed me to this thread, I'll take a closer look shortly.

Thanks for your concern about Irene. Actually, I'm on the road right now. I'm in Oregon, about to travel down through California. We're good over here . No earthquakes/storms over here yet, thank goodness.

[Jason Caldwell]

Hi Sam. So just to be clear.

The vulnerability that you found is when/if CloudFront is introduced, is that right?
I'm assuming that you configured CloudFront as "Streaming". That explains why you're having better luck with videos and seeking. Traditional file delivery protocols do not support "streaming" media, but a CloudFront Distribution can be configured to do so.

I'm not sure if it's possible to integrate s2Member with the Amazon S3 / CloudFront combination though, is it? Please enlighten me if you'd like to. I must confess, I don't much about CloudFront yet, and s2Member's file delivery integration with Amazon S3 is not currently designed to work with CloudFront, as this essentially creates an open distribution, making files vulnerable, or am I missing something?

[drbyte]

Hi Sam. So just to be clear.

The vulnerability that you found is when/if CloudFront is introduced, is that right?
I'm assuming that you configured CloudFront as "Streaming". That explains why you're having better luck with videos and seeking. Traditional file delivery protocols do not support "streaming" media, but a CloudFront Distribution can be configured to do so.

I'm not sure if it's possible to integrate s2Member with the Amazon S3 / CloudFront combination though, is it? Please enlighten me if you'd like to. I must confess, I don't much about CloudFront yet, and s2Member's file delivery integration with Amazon S3 is not currently designed to work with CloudFront, as this essentially creates an open distribution, making files vulnerable, or am I missing something?

Not really Jason. I configured CloudFront as "Download" and it's working much better than just using Amazon S3 alone. Smooth seeking with Amazon S3 Alone is not possible with iphone, ipad, ipod and androids. Media larger than 100MB.

I suppose using CloudFront uses cache to preload a movie rather than just S3 trying to serve the media using just bandwidth.

I emailed you back with my finding. Have fun and drive safe.

Sam

[Jason Caldwell]

Thanks Sam. I just got your email.

While it's true that s2Member will expose the name of your Amazon S3 Bucket, that does not create a vulnerability unless you allow it to. That is, the Amazon S3 Bucket that you use in combination with s2Member should NOT be available to the public. If configured properly, files inside your Amazon S3 Bucket will only be available to authenticated members on your website.

*Dev Note* s2Member uses "Query String Authentication", provided by the Amazon® S3 API. Documented for developers here. To put it simply, s2Member will generate S3 authenticated redirect URLs ( internally ); which allow Customers temporary access to specific files inside your S3 Bucket.

s2Member assumes that you're creating a new Amazon® S3 Bucket, specifically for s2Member-protected files; and that your Bucket is NOT available publicly. In other words, if you type this URL into your browser ( i.e. http://s3.amazonaws.com/your-bucket-name/ ), you should get an error that says: Access Denied. That's good, that's exactly what you want.

See this thread for details: viewtopic.php?f=4&t=10054&p=20269&hilit=amazon+permissions#p20269

Now, introducing CloudFront will create a vulnerability for you. s2Member is currently NOT integrated with CloudFront, though we may try to improve on this in a future release. Configuring CloudFront will create a distribution of your otherwise protected files, making them all public. So if you need CloudFront, you won't be able to protect your files with s2Member at this time ( i.e. v110815 ) at this time.

Again, s2Member integrates with Amazon S3 only at this time, using the API methods provided by Amazon, as discussed here: http://docs.amazonwebservices.com/Amazo ... ation.html

[drbyte]

Hi Jason

Thank you for the explanation and the links. Unfortunately that kind of authentication is easily broken. I understand the bucket authentication and all what follows but that's not what I am experiencing.

I am not worrying about my members downloading the video files. Actually I want them to do so because it makes them happy, and happy means more dollars in my account. What I am worrying about is one of them getting hold of the actual amazon url and freely distribute them on the net, or opening a web site while I am paying price.

Since you think it's not a problem to other users then I can discuss it here.

If you have a video files Jason in one of you amazon buckets I would like to become a member and view that file. Having said that, I will be able to tell you the bucket name & the file and have that video file streaming on my site.


Let's put it in urls

As a member:

This:

Code: Select all

http://www.site.com/?s2member_file_inline=yes&s2member_file_download=/video.mp4

Translate to this:

Code: Select all

http://bucketname.s3.amazonaws.com/video.mp4?response-cache-control=no-cache%2C+must-revalidate%2C+max-age%3D0%2C+post-check%3D0%2C+pre-check%3D0&response-content-disposition=inline%3B+filename%3D%22video.mp4%22&response-content-type=video%2Fmp4&response-expires=Tue%2C+23+Aug+2011+07%3A32%3A11+GMT&AWSAccessKeyId=AKIAJYAXYKPMZ2EFF5LA&Expires=1314689561&Signature=v4DJAznbWd6qETm6U2MHxgZY3kk%3D

Which the only part that I need is this: http://bucketname.s3.amazonaws.com/video.mp4 to make my case, the rest does not server any good for the above example. since that file if open to public then it's freely can be copied, downloaded, and embedded on the net.

For None Members:

This:

Code: Select all

http://www.site.com/?s2member_file_inline=yes&s2member_file_download=/video.mp4

Translate to:

Code: Select all

http://www.site.com/sing-up.php

Which is good.


The bucket is secured, I understand this but the files aren't. Bucket domain policies does not work. I tried all of them. for some reason Amazon is refusing to respond to the huge demand of implementing some sort of solid bucket policy or even a small script for CloudFront users to protect their files. It seems they only worry of how much $$ goes to their bank account.

CouldFront uses Adobe Flash Media Server 4. I have that installed on one of my servers. I have applied full security restrictions and it's working 100% BUT I can't deliver media to iPhone and iPad users. It's Flash. The only thing they have is a quick fix using Live Streaming and that work on some Apple devices.

So, I have Wowza media server 2 on another server and that works perfectly fine. I have to use JWPlayer, Or Flowplayer to stream the media to devices. Again, Apple devices does not seem to like the idea that there is another plugin other than QuickTime trying to provide media playback. All sorts of problem we had with Wowza and Apple devises (So they say it support them but good luck). Another issues we had is that SSL streaming is not available at this moment to Apple gadgets.

The only solution that seems to work with apple devices and the rest (-windows mobile) without any problems is the HTML5 video tags.

I even have a Windows 2008 IIS Media server installed, LOL, Beautiful smooth streaming an tons of security options but it does not stream to the Android devises

So, back to F4M....They support http streaming but it's wide open to the public. The only way to block that is to buy Adobe Access. At this point I am broke. Beside the fact, S2M (at this point) does not support any other storage other than s2m files folder or amazon s3. That's why I asked you if I can have something else beside these 2. I'm sure you are working on something..I can smell it form here

I am not sure why it's so difficult to server a secure media files over the Internet but It seems it's nothing but a corporate greed

Sorry I went far off the main subject.

Anyway, yes Jason, if you are a member on my site and your type the url above on the address bar it will get you the exact location of the file on Amazon S3

Unless I am missing something in the code.

Thank you

Sam

[Jason Caldwell]

Hi Sam, thanks for the follow-up!

As a member:

This:

Code: Select all
http://www.site.com/?s2member_file_inli ... /video.mp4

Translate to this:

Code: Select all
http://bucketname.s3.amazonaws.com/vide ... xgZY3kk%3D

Which the only part that I need is this: http://bucketname.s3.amazonaws.com/video.mp4 to make my case, the rest does not server any good for the above example. since that file if open to public then it's freely can be copied, downloaded, and embedded on the net.

Just to make sure you're experiencing what *should* be happening
with the configuration that s2Member expects.

For Members, if allowed, this link WILL work,
but only if they're logged-in, and have permission, based on your configuration of s2Member:

Code: Select all

http://www.site.com/?s2member_file_inline=yes&s2member_file_download=/video.mp4

For Members and/or anyone in the public for that matter, this link should NEVER ( ever ) work:

Code: Select all

http://bucketname.s3.amazonaws.com/video.mp4

This link should NEVER work, because your Amazon S3 Bucket should be secured from public access. In other words, the only way anyone should be allowed access to files inside your private Bucket at Amazon S3, is if/when s2Member produces a temporary authorization link, to a particular file that resides in your private Bucket, such as this one ( notice the AWSAccessKeyId & Expires parameters ):

Code: Select all

http://bucketname.s3.amazonaws.com/video.mp4?response-cache-control=no-cache%2C+must-revalidate%2C+max-age%3D0%2C+post-check%3D0%2C+pre-check%3D0&response-content-disposition=inline%3B+filename%3D%22video.mp4%22&response-content-type=video%2Fmp4&response-expires=Tue%2C+23+Aug+2011+07%3A32%3A11+GMT&AWSAccessKeyId=AKIAJYAXYKPMZ2EFF5LA&Expires=1314689561&Signature=v4DJAznbWd6qETm6U2MHxgZY3kk%3D

So it should not matter that your Bucket name is exposed, because your Bucket should be off limits to all forms of public access anyway. If this is NOT the case for you, I'm guessing it could have something to do with your CloudFront distribution, or possibly with the permissions ( i.e. ACLs ) configured for this Bucket, or even configured on a per-file basis.

---

Regarding your frustration over finding a cross-compatible solution. I'm going to take a closer look at CloudFront before the next round of changes, and I'll see what we can come up with. I too would like to get this working for all browsers and mobile devices in a cross-compatible way. If we can't get it working with CloudFront, we may try CloudFlare, or another combination to meets the needs of all devices, as we are currently investigating this as a possible alternative in other areas anyway.

In the mean time, please let me know if you have any other suggestions. I'll keep this thread handy and use it as a reference as we work to improve this aspect of s2Member.

---

What concerns you about this? Can you please share your thoughts on a solution that might incorporate HTML5 video tags for me?

The only solution that seems to work with apple devices and the rest (-windows mobile) without any problems is the HTML5 video tags.

[drbyte]

Hi Jason

Thank you. I will try with Amazon first. I'm going to create another key and go from there.

What's the correct ACL permission for the individual files inside the bucket?

Sam

[Jason Caldwell]

Here is an example to go by Sam.

Please let me know if anything continues to cause problems in this regard.
Private file: https://s3.amazonaws.com/ws-s2member-files/video.mp4
( click screenshots to enlarge )

[drbyte]

Thanks Jason. That's what I have.. Huh?....Interesting Well, I am working on new set of keys now and a new bucket. Not sure what's going on but I have sent Amazon support a ticket regarding my account.

I will post my finding

Sam

[drbyte]

OK, I changed the keys and created a new bucket..but for some reason I yet to know, I look at new bucket policy and there is one that is saved. I have no idea why. I think there is something stuck on my account because I created a third one and it has the same policy that is created by it self

Code: Select all

{
  "Version":"2008-10-17",
  "Statement":[{
   "Sid":"AllowPublicRead",
      "Effect":"Allow",
     "Principal": {
         "AWS": "*"
       },
     "Action":["s3:GetObject"],
     "Resource":["arn:aws:s3:::the bucket name/*"
     ]
   }
  ]
}

Yet, when I look at the permission it's all correct. I keep deleting it but it keeps coming back. Any Idea Jason

I am awaiting Amazon Support to figure it out because this is not good. All of my buckets have the same above policy that I can't get ride off

[drbyte]

Hi Jason

OK, it's all fixed now. They did reset my account and it's working as it suppose to now. So easy, it took my almost 4 days..that's all. LOL, they are going to refund this month and last month fees

OK, now comes the fun stuff. I will create a new thread regarding video streaming and ways to server files across multiple platforms.

Thank you Jason for all your help

Sam

[Jason Caldwell]

Awesome Sam. I look forward to it. Thanks for reporting back for me!

[Cristián Lávaque]

Here's the new thread, Jason. Could you take a look there? viewtopic.php?f=4&t=14780