How Public CT Logs Let Attackers Map and Exploit Cloud Storage Buckets Silently

·1 views

Security researchers and attackers can discover exposed cloud storage buckets on AWS S3, Google Cloud, and Azure Blob without sending a single packet to a target, using publicly available certificate transparency logs monitored via tools like bucket-stream. TLS certificates issued for a company's operational subdomains reveal naming conventions that can be used to generate and test likely bucket names. Search platforms like GrayhatWarfare have indexed hundreds of thousands of buckets and billions of files, allowing anyone to find sensitive data such as credentials or database dumps without authentication. Enabling 'Block Public Access' on S3 does not prevent this passive discovery phase, since CT log monitoring operates entirely before any permission check is made. The gap between when a bucket is briefly exposed and when it is secured means sensitive files may already have been indexed or copied, making post-fix audits insufficient on their own.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why filtered data should be labeled, not deleted, in software systems

A software developer building a mileage-tracking app discovered a critical flaw months after shipping a GPS data filter: rejected readings were being permanently deleted, making it impossible to verify whether the filter was working correctly. The fix involved replacing hard deletions with labeled categories, so that implausible GPS points were marked and stored rather than discarded, with only physically impossible values still removed entirely. This approach allowed disputed expense claims to be resolved by showing drivers exactly which readings were excluded and why. Tunable thresholds became possible because engineers could replay real journeys and adjust filtering logic based on retained data. The developer argues this principle applies broadly to any system that rejects data — from fraud scoring to log pipelines — since deleting a record destroys the only evidence needed to audit the decision.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ventoy Lets You Boot Multiple ISOs From One USB Drive Without Reformatting

Rufus and Ventoy are both tools for creating bootable USB drives, but they work in fundamentally different ways. Rufus writes a single ISO directly to a USB drive, typically requiring the process to be repeated whenever a different operating system is needed. Ventoy, by contrast, is installed once on the USB drive, after which users can simply copy and delete ISO files as needed without reformatting. This allows a single large USB drive to store multiple operating systems and recovery tools simultaneously, accessible via a boot menu. Ventoy also supports a persistence feature on select Linux distributions, enabling users to retain system changes across reboots when running a live environment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Crack Amazon's SQL Interview: Key Skills and Strategies

Amazon's SQL interviews for roles like BI Engineer, Data Analyst, and Data Scientist test more than syntax — candidates are evaluated on logical thinking, communication, and handling messy real-world data. Interviews typically take the form of a technical screen or a whiteboarding case study, with interviewers looking for correctness, clear reasoning, and structured query writing. Core topics include JOIN types, window functions such as ROW_NUMBER and LAG, aggregations with CTEs, and date-based calculations like rolling averages and cohort analysis. Candidates are advised to restate the problem, clarify ambiguous metrics, and build queries in logical CTE blocks rather than complex nested subqueries. Interviewers often embed intentional data traps — such as nulls in join keys or duplicate rows — to test whether candidates spot and address data quality issues proactively.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Open-Source Mobile Terminal App Using the App Itself

A developer has created Termish, an open-source mobile tool designed for remote work via SSH/Mosh terminals, file management, and AI-assisted development. Unusually, much of Termish was built using Termish itself, with the developer working from a phone connected to a host machine running herdr and OpenAI's Codex. The app targets a workflow gap where developers want to start, inspect, or continue coding tasks from a phone without replacing a desktop setup entirely. Termish integrates terminal access, AI agent interaction, screenshot uploads, Git diff reviews, and remote screen viewing into a single touch-optimized interface. The source code is publicly available on GitHub under the ttermish organisation.

0 comments Read more at DEV Community