Technology

38082 readers

39 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 3 years ago

MODERATORS

TheRtRevKaiser@kbin.social

8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur (labs.watchtowr.com)

submitted 2 days ago* (last edited 2 days ago) by Bishma@discuss.tchncs.de to c/technology

2 comments fedilink hide all child comments

Alt Title: How to take over the world using abandoned S3 Buckets

Watchtowr has moved on from using expired domains to assume authority over entire TLDs and instead is using blind trust in S3 addresses to infiltrate governments and militaries across the world.

The TL;DR is that this time, we ended up discovering ~150 Amazon S3 buckets that had previously been used across commercial and open source software products, governments, and infrastructure deployment/update pipelines - and then abandoned.

As for the research itself, it panned out progressively, with S3 buckets registered as they were discovered. It went rather quickly from “Haha, we could put our logo on this website” to “Uhhh, .mil, we should probably speak to someone”.

These S3 buckets received more than 8 million HTTP requests over a 2 month period for all sorts of things -

Software updates,

Pre-compiled (unsigned!) Windows, Linux and macOS binaries,

Virtual machine images (?!),

JavaScript files...

you are viewing a single comment's thread
view the rest of the comments

[–] seang96@spgrn.com 8 points 1 day ago

I always thought it was a bad idea for AWS to make the buckets unique globally. Attach the AWS account Id so it would always be unique, you can name a bucket whatever you want, and this attack vector wouldn't be possible (unless if you are AWS I guess)