Cloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
Talkat 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) · 2024-04-16..04-18·
summary
Passive DNS plus periodic HTML sampling and simple signatures reveal targeted takeovers of cloud-hosted names rather than an IP lottery: researchers analyze ~1.5M cloud subdomains over three years, detect 20,904 hijacked resources, cluster ~1,800 attacker infrastructures and find 75% blackhat SEO abuse with one third persisting >65 days; method uses cname/subnet matching, HTML diffing and keyword signatures, and the practical mitigation is to randomize provider-assigned hostnames as Google Cloud already does.
AI-written summary · about
chapters (6)
- 0:00Dangling DNS record attacks
- 3:26IP lottery impractical
- 7:47Three-year study methodology
- 13:11Exploitation scale and detection
- 14:12Black hat SEO abuse
- 18:06Conclusion and call to action
related talks
38mCloud-Squatting: The Never-ending Misery Of Deleted & Forgotten Cloud Assets
50mThe Anatomy of Cloud Attacks
39mReal-World Detection Evasion Techniques in the Cloud
28mFerris Bueller's Guide to Abuse Domain Permutations
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
12mUnderstanding and Managing Security Events
25mDark Side of the DNS Force
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services