Hunting the Public Cloud for Exposed Hosts and Misconfigurations
Summary: Unit 42 queried Shodan and Censys across the IP blocks of AWS, Azure and GCP and found 9.3 million AWS hosts, 1.5 million Azure hosts and 2.5 million GCP hosts, with 32% of exposed public cloud hosts running open SSH. Scanning 2.8 million U.S.-based public cloud SSH servers, it found almost 50% of Azure SSH servers had password login enabled versus less than 5% on AWS and GCP, and identified 29 million vulnerabilities in AWS, 1.7 million in Azure and 4 million in GCP, with more than 61% of SSL/TLS-configured hosts still using protocols older than TLS v1.2.
Why it matters: Of 16,764 malicious IPs reported in 2018 through Facebook Threat Exchange, 985 came from AWS, 109 from Azure and 34 from GCP - 7% from the three major providers - and the researchers could not determine whether those hosts were compromised or attacker-created.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026