Abstract:Public clouds provide scalable and cost-efficient computing through resource sharing. However, moving from traditional on-premises service management to clouds introduces new challenges; failure to correctly provision, maintain, or decommission elastic services can lead to functional failure and vulnerability to attack. In this paper, we explore a broad class of attacks on clouds which we refer to as cloud squatting. In a cloud squatting attack, an adversary allocates resources in the cloud (e.g., IP addresses) and thereafter leverages latent configuration to exploit prior tenants. To measure and categorize cloud squatting we deployed a custom Internet telescope within the Amazon Web Services us-east-1 region. Using this apparatus, we deployed over 3 million servers receiving 1.5 million unique IP addresses (56% of the available pool) over 101 days beginning in March of 2021. We identified 4 classes of cloud services, 7 classes of third-party services, and DNS as sources of exploitable latent configurations. We discovered that exploitable configurations were both common and in many cases extremely dangerous; we received over 5 million cloud messages, many containing sensitive data such as financial transactions, GPS location, and PII. Within the 7 classes of third-party services, we identified dozens of exploitable software systems spanning hundreds of servers (e.g., databases, caches, mobile applications, and web services). Lastly, we identified 5446 exploitable domains spanning 231 eTLDs-including 105 in the top 10,000 and 23 in the top 1000 popular domains. Through tenant disclosures we have identified several root causes, including (a) a lack of organizational controls, (b) poor service hygiene, and (c) failure to follow best practices. We conclude with a discussion of the space of possible mitigations and describe the mitigations to be deployed by Amazon in response to this study.

Test-suite-guided discovery of least privilege for cloud infrastructure as code

Making Least Privilege The Low-Hanging Fruit In Clouds

Automated Model-Based Performance Testing for PaaS Cloud Services

Exploring Security Practices in Infrastructure as Code: An Empirical Study

RestSep: Towards a Test-Oriented Privilege Partitioning Approach for RESTful APIs

Design and Implementation of Access Control As a Service for IaaS Cloud

Statically Inferring Usage Bounds for Infrastructure as Code

ACaaS: Access Control as a Service for IaaS Cloud

Enforcing the principle of least privilege with a state-based privilege control model

Measuring and Mitigating the Risk of IP Reuse on Public Clouds

A Role Engineering Approach Based on Spectral Clustering Analysis for Restful Permissions in Cloud

Thunder CTF: Learning Cloud Security on a Dime

Interactive Greybox Penetration Testing for Cloud Access Control using IAM Modeling and Deep Reinforcement Learning

Raising Security Awareness of Cloud Deployments using Infrastructure as Code through CyberSecurity Challenges

Using Constraint Programming and Graph Representation Learning for Generating Interpretable Cloud Security Policies

Implementation and Automatic Testing for Security Enhancement of Linux Based on Least Privilege

Apples and Oranges: Detecting Least-Privilege Violators with Peer Group Analysis

A Framework for Implementing Dynamically Modified Least Privilege Security Policy

Implementing the principle of least administrative privilege on operating systems: challenges and perspectives

CloudCAMP: Automating Cloud Services Deployment and Management

Privacy-Preserving and Lightweight Verification of Deep Packet Inspection in Clouds