Cloud-Squatting: The Never-ending Misery Of Deleted & Forgotten Cloud Assets
summary
Claims that forgotten cloud IPs and CNAMEs get reassigned and let outsiders capture traffic and secrets with surprising scale — providers publish thousands of prefixes (AWS ~7,000) — and that automation is required to keep up. Implementation uses provider APIs and a centralized DNS dump, matches IPs to provider prefixes, scans codebases for hardcoded IPs, fingerprint CNAME-vulnerable services from a GitHub corpus, and runs a continuous workers pipeline that writes to a DB and sends alerts to resource owners; the in-house system runs and reduces incidents.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:17Cloud computing overview
- 3:30Understanding cloud squatting
- 7:32Subdomain takeover risks
- 10:47Data collection strategies
- 14:23Managing IP address ranges
- 18:40System architecture and workflow
- 24:02Implementation and best practices
- 27:28Q&A and closing
related talks
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
28mAvoiding DNS Pain
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
57mCloud’s Dirty Little Secret: It Was Misconfigs All Along
33mCloud Hacking Scenarios
36mCloud Hacking Scenarios
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had
48mNine Cloud Security Reasons for Resting Breach Face