Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration

Summary: Unit 42 identified a bucket hijacking technique that exploits the global uniqueness of storage bucket names across major cloud providers: an attacker with delete permissions removes a target bucket and recreates it under the same name in their own account, silently rerouting data streams into attacker-controlled storage. The researchers simulated the attack in Google Cloud Logging, Pub/Sub and Storage Transfer Service, in AWS S3 replication and Amazon Data Firehose, and in Azure Monitor via a cross-subscription variant, and reported the findings to Google Cloud, AWS and Microsoft Azure. No real-world threat actor has yet been identified using the technique.

What's compelling: The permissions needed to pull this off - storage.buckets.delete and storage.objects.delete - are included in common storage admin roles by default, so an attacker can bypass the granular update permissions that data stream configurations are supposed to require. Because the stream keeps running and the sink configuration still looks valid on inspection, deletion of a retention or backup bucket can go unnoticed while sensitive logs flow to the attacker's account.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Cloud Security
Related