Responsible Disclosure: Abandoned Buckets and Billing Emails
CyberSecurity o2 Responsible Disclosure telefonica · 1 comment · 450 words · read ~380 times.
A few weeks ago, I received a billing email from my phone provider O2. While glancing at it, I noticed all the images were broken. Viewing the source of the email showed that they were all coming from http:// mcsaatchi-email-preview.s3.amazonaws.com/o2/... What happens if we visit that domain? Ah, the dreaded "The specified bucket does not exist" error. At some point the images were served from that domain but someone deleted the bucket. This is a problem. Amazon doesn't reserve…
Continue reading →