Thousands of Leaked Cloud Keys Still Work... The AWS Access Key Problem

Full spoken transcript

Thousands of leaked AWS access keys are still working. An AWS access key is basically a username and password software uses to access an Amazon cloud account. You can think of it like a digital employee badge. And to be clear, these leaked keys don't access the Amazon account you use to shop from. They're only for Amazon Web Services. And depending on their permissions, the access these keys provide can range from viewing private information all the way up to making major changes to an organization's cloud environment.

Of the more than 10,000 complete key pairs that were rechecked, about 88 percent still authenticated. That 88 percent does only apply to this sample. It doesn't mean that 88 percent of every exposed AWS key ever still works. But the access these keys provided was still pretty significant. Researchers found 526 root keys and another 242 with full administrator access.

That means that hundreds of these keys weren't to a small storage closet. They probably unlocked the entire building. You can think of it like a company employee losing their master access badge. Some random stranger finds it, they copy it, and they post a working version of it online. The company finds the post and they have it removed, but they never actually deactivate the badge. Removing the post doesn't magically fix the situation, and it doesn't make all the existing copies just disappear. Anyone who already saved it can still use it.

It might seem obvious, but you do need to cancel the old badge and create a new one. And the burden of cancelling these keys falls on the customer who owns them, not on AWS. This situation won't resolve itself.

And that's the important part of the story. In the subset where researchers could check whether a new key had been created, only about 14 percent had done so. The average key was five years old and the oldest one was over 17 years old. That means the oldest key had been active since before Instagram existed, and it was publicly available.

Now, to be clear, this research doesn't prove that every one of these keys was abused. It just shows that thousands of keys that are found out in the public still unlock the door that they go to. And this failure to do routine cleanup after your keys are exposed can x really well to status quo bias.

Status quo bias is our tendency to leave things the same because changing feels more uncertain or disruptive. If rotating your credentials or your keys might break something or slow down business, we don't want to do it. Sometimes leaving things alone feels easier. The application is still working, and the danger is mostly invisible. Change is hard and it requires effort. And if it ain't broke, don't fix it, right? So we'll change it later, starts to feel like the safer choice. Even when your keys and your credentials are already public.

In 1988, researchers gave people several different decision problems. All the participants received the same choices. But researchers changed which options were described as the person's existing or current choice. And across each scenario, people were more likely to select an option when it was framed as the status quo or the choice they were told they already made. Even if they hadn't. And the more options they had to consider, the safer they felt with that original choice and the stronger their preference for it became.

Now, choosing between hypothetical options isn't exactly the same as rotating keys and credentials when needed. This can involve legitimate technical work. But the useful parallel here is that if a system is functioning, it can make an exposed key feel safer than it actually is, if it means not changing anything. The fact that nothing has gone wrong yet can easily become the reason that nobody does anything.

So the practical takeaway here is simple. If a password, an access key, or another secret becomes public. Treat it as if someone has already made a copy of it. Don't just remove it from a public page. Disable it and replace it entirely.

If you found out random people had found a key to your house, you'd probably change your locks. Replacing an access key is basic security.

So as always, stay mindful stay resilient. If you lose your key, make sure you replace it and change your locks and follow for more cyberpsychology breakdowns.