AWS S3 Bucket hotornot-images permissions allow for listing and removing files

Summary

We do not use amazon AWS but @yaworsk wanted to disclose his report anyway. Why not, we can do.

Hi All, Though I'm not 100% sure you own the bucket - and if not, I would appreciate being able to close this myself - I believe you may own the S3 bucket hotornot-images.

If so, using the AWS CLI, I am able to call the actions ls and rm on it to list files and remove them, however, cp/mv calls (PUT calls) result in access denied.

It would appear that there are no files in the root directory but if you were to start using it, files can be deleted by authorized AWS users though these users are not on your AWS account.

While I can't actually write to the bucket to confirm, when access is denied, a (Forbidden) error is returned. However, on the hotornot-images bucket, a (NoSuchKey) error is returned meaning we at least have access to read the bucket.

Please let me know if you have any questions. Pete

Update:

Just realized this was disclosed with limited details and since they included my original post, thought I could do the same picking up where they left off...

Badoo: Hey. What is "S3 bucket hotornot-images"? What domain you accessing and how?

Me: S3 bucket is Amazon's webservice for simple storage, it's like a file repository. I didn't access it through a website, using the Amazon command line tools, I found and accessed the bucket. When badoo acquired hotornot, did they have an aws account? By the sounds of it, you may be using Amazon services? If not, I'll close the ticket.

Badoo: So you even didn't check do we use aws or not? Just reported? Don't you respect our time, @yaworsk?

Report marked N/A

Explained what I did in two longer responses and said it would be my sole interaction with their site given the response.

Badoo: Lot of words but you still didn't even provide the domain name... [quoted my comment regarding sole interaction with them] -- Yes please, do us a favour.

Then I got an email saying I was banned from their program.