Thread by @shawnwenzel

Let's dig a bit deeper into this screen shot posted by @zackwhittaker and talk about why the JamCOVID app's architecture is FUNDAMENTALLY FLAWED. This flaw goes way beyond Amber Group forgetting to secure the S3 bucket. It seems security was just not a consideration at all! 1/

When we look at this ACL we see two things: the "Everyone" group having FULL_CONTROL (this is what was fixed last Monday), but we also see an account "opmjmmobile" having FULL_CONTROL as well, with no other accounts defined. This account seems likely the one used by the app. 2/

For an app like this it needs a way to communicate with the server; it typically does this with a user account (opmjmmobile in this case) and a fixed password. This password can either be hard-coded and compiled with the app, or can be fetched from another server location. 3/

The issue is there are ways to find out what that password is using some advanced techniques. So, we need to restrict what this user account "opmjmmobile" can do by applying the Principle of Least Privilege: giving it the minimum access the app needs to function. 4/

Instead of doing this, the Amber Group folks gave "opmjmmobile" FULL_CONTROL permission, which allows it to do anything: create files, view existing files, alter files, or delete files. What it should ONLY have access to do is create files. 5/

The other thing that is missing is automated file management. Files should only exist in the app's S3 bucket for a short time; there should be a job that automatically moves them to a more secure location then purges them after 21 days. This process is completely missing. 6/

In short, security does not seem to have been a consideration in JamCOVID. When we look at the timelines this shouldn't be surprising: Amber reportedly threw this app together in 3 days. This just isn't enough time to get the security right or to do proper in-house testing! 7/

What I suggest the GOJ do at this point is to engage an IT security firm to do a proper security assessment of this app and its underlying architecture. This project was clearly a "rush job", there very likely are other issues. Symptai is one I can recommend for this. 8/8

There is an old principle in IT when implementing systems: "Read The F**king Manual" (RTFM).

If only Amber group had followed this principle when building JamCOVID they'd have seen this message splashed all over the Amazon S3 ACL configuration manual pages! 🤦‍♂️