How attackers abuse S3 Bucket Namesquatting — And How to Stop Them

With the sheer amount of data and users leveraging AWS, it’s easy for misconfigurations to slip through the cracks. One commonly overlooked area is the naming of S3 buckets. AWS S3 bucket names are global with predictable names that can be exploited by bad actors seeking to access or hijack S3 buckets. This is known as “S3 bucket namesquatting.” The use of predictable S3 bucket names presents a widespread issue. Thousands of instances on GitHub use the default qualifier, making them prime targets for exploitation. In this blog, we will examine the occurrence of S3 bucket namesquatting, methods to address the issue, and how Varonis can prevent this and other related data security problems in AWS. S3 bucket namesquatting can occur in several ways, but the root cause always depends on predictable naming qualifiers. For example, when new regions are released, bad actors can preemptively register buckets before the actual owners can claim them by correctly guessing the names. A lthough AWS Region names aren’t usually made public, they can be deduced by those familiar with qualifiers and region names. If a bad actor knows the timing of a new region release, they can proactively register buckets before the owners can. S3 bucket namesquatting can also occur when using the AWS Cloud Deployment Kit. The AWS Cloud Deployment Kit creates staging S3 buckets where resources are provisioned to the environment with a predictable naming pattern: cdk-{Qualifier}-assets-{Account-ID}-{Region}. ...