A new vulnerability known as 'bucket hijacking' poses a significant threat to cloud storage systems by allowing attackers to redirect data streams, including audit logs and telemetry, to external storage under their control. This attack method affects major cloud providers such as Google Cloud, Amazon Web Services, and Microsoft Azure. Although no actual exploitation of this technique has been reported, researchers warn that its implementation can be extremely challenging to detect once in place.
The crux of the vulnerability lies in the architectural design of cloud storage systems where bucket names must be globally unique. This design flaw permits attackers who gain the necessary permissions to delete a cloud storage bucket to exploit this naming convention. Once a bucket is compromised, attackers can seamlessly divert data streams without triggering alarms or error states, as the legitimate configuration appears unchanged.
Research conducted by Unit 42 demonstrated the feasibility of this attack across multiple services on each major cloud platform. Broad storage administration roles, often found in enterprise settings, significantly increase the risk. For instance, in Google Cloud, the standard Storage Admin role allows for the deletion of buckets without the need to update stream configurations, enabling attackers to reroute data with ease.
To mitigate this risk, Unit 42 recommends implementing a defense strategy that includes least-privilege access controls coupled with proactive monitoring. This approach aims to minimize exposure by restricting permissions that could be exploited in such attacks. Moreover, the research suggests that any cloud platform using globally unique storage bucket names for data streams could be vulnerable, underscoring the importance of vigilance in multi-cloud environments.