Measuring and Mitigating the Risk of IP Reuse on Public Clouds

Abstract

Public clouds provide scalable and cost-efficient computing through resource sharing. However, moving from traditional on-premises service management to clouds introduces new challenges; failure to correctly provision, maintain, or decommission elastic services can lead to functional failure and vulnerability to attack. In this paper, we explore a broad class of attacks on clouds which we refer to as cloud squatting. In a cloud squatting attack, an adversary allocates resources in the cloud (e.g., IP addresses) and thereafter leverages latent configuration to exploit prior tenants. To measure and categorize cloud squatting we deployed a custom Internet telescope within the Amazon Web Services us-east-1 region. Using this apparatus, we deployed over 3 million servers receiving 1.5 million unique IP addresses (≈ 56% of the available pool) over 101 days beginning in March of 2021. We identified 4 classes of cloud services, 7 classes of third-party services, and DNS as sources of exploitable latent configurations. We discovered that exploitable configurations were both common and in many cases extremely dangerous; we received over 5 million cloud messages, many containing sensitive data such as financial transactions, GPS location, and PII. Within the 7 classes of third-party services, we identified dozens of exploitable software systems spanning hundreds of servers (e.g., databases, caches, mobile applications, and web services). Lastly, we identified 5446 exploitable domains spanning 231 eTLDs-including 105 in the top 10 000 and 23 in the top 1000 popular domains. Through tenant disclosures we have identified several root causes, including (a) a lack of organizational controls, (b) poor service hygiene, and (c) failure to follow best practices. We conclude with a discussion of the space of possible mitigations and describe the mitigations to be deployed by Amazon in response to this study.

Understanding the Implementation and Security Implications of Protective DNS Services

“…If a third-party attacker manipulates these Dare resources, they become insecure and exploitable. Three attack vectors to hijack these resources have been identified in existing works, involving expired domains [97], [134], [130], obsolete cloud IP addresses [16], [116], and third-party hosting services [97], [134].…”

“…As a result, an attacker can launch denial of response by spoofing IP addresses of legitimate users and initiating queries for malicious domains, such that the PDNS servers will reject the users. Second, when rewriting DNS responses, 26 PDNS servers return addresses pointing to dangling cloud infrastructure [16], [116], which enables domain takeover for attackers and re-engages illegal activities. Finally, when queried for harmful domains, 105 PDNS servers return both forged and genuine responses, and clients may still connect to malicious hosts.…”