Abstract:Public clouds provide scalable and cost-efficient computing through resource sharing. However, moving from traditional on-premises service management to clouds introduces new challenges; failure to correctly provision, maintain, or decommission elastic services can lead to functional failure and vulnerability to attack. In this paper, we explore a broad class of attacks on clouds which we refer to as cloud squatting. In a cloud squatting attack, an adversary allocates resources in the cloud (e.g., IP addresses) and thereafter leverages latent configuration to exploit prior tenants. To measure and categorize cloud squatting we deployed a custom Internet telescope within the Amazon Web Services us-east-1 region. Using this apparatus, we deployed over 3 million servers receiving 1.5 million unique IP addresses (56% of the available pool) over 101 days beginning in March of 2021. We identified 4 classes of cloud services, 7 classes of third-party services, and DNS as sources of exploitable latent configurations. We discovered that exploitable configurations were both common and in many cases extremely dangerous; we received over 5 million cloud messages, many containing sensitive data such as financial transactions, GPS location, and PII. Within the 7 classes of third-party services, we identified dozens of exploitable software systems spanning hundreds of servers (e.g., databases, caches, mobile applications, and web services). Lastly, we identified 5446 exploitable domains spanning 231 eTLDs-including 105 in the top 10,000 and 23 in the top 1000 popular domains. Through tenant disclosures we have identified several root causes, including (a) a lack of organizational controls, (b) poor service hygiene, and (c) failure to follow best practices. We conclude with a discussion of the space of possible mitigations and describe the mitigations to be deployed by Amazon in response to this study.

Is It Safe to Share Your Files? an Empirical Security Analysis of Google Workspace

An Empirical Analysis of Hazardous Uses of Android Shared Storage.

Collaborative Privacy for Web Applications

"If You Can't Beat them, Join them": A Usability Approach to Interdependent Privacy in Cloud Apps

Security and Privacy Perceptions of Third-Party Application Access for Google Accounts (Extended Version)

Why is My Secret Leaked? Discovering Vulnerabilities in Device-to-Device File Sharing

A Comparative Analysis of Honeypots on Different Cloud Platforms

An Empirical Study of Open Edge Computing Platforms: Ecosystem, Usage, and Security Risks

Cloud Computing Service: Focus on Search and Seizure in Team Collaboration Platform Provider

Survey on Insider Threats to Cloud Computing

Component Security Ten Years Later: an Empirical Study of Cross-Layer Threats in Real-World Mobile Applications

Remote Working Pre- and Post-COVID-19: An Analysis of New Threats and Risks to Security and Privacy

Emergent (In)Security of Multi-Cloud Environments

A Study of Security and Applicability on Building Collaborative Design Platform in Wide Area Network

An Empirical Study of Web Resource Manipulation in Real-world Mobile Applications.

Revealing the Weaknesses of File Sharing System on Cloud Storages

The Curious Case of the PDF Converter that Likes Mozart: Dissecting and Mitigating the Privacy Risk of Personal Cloud Apps

Digital Privacy Under Attack: Challenges and Enablers

Evaluation of security framework for BYOD device in cloud environment

Researches on Architecture Extensions for Cloud Security

Measuring and Mitigating the Risk of IP Reuse on Public Clouds