利用蜜桶刻画现实中的云存储扫描行为
Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild
AI总结：
本文通过部署数百个 AWS S3 蜜桶分析云存储扫描攻击，发现攻击者偏好针对技术行业商业组织的存储桶，并会下载、篡改内容，甚至利用桶中文档尝试获取服务器未授权访问。
摘要：
在这项工作中，我们分析了攻击者在多大程度上以防护薄弱的云存储桶为攻击目标。我们部署了数百个具有不同名称和内容的 AWS S3 蜜桶，以引诱并测量不同的扫描策略。攻击者表现出明显的偏好，倾向于扫描那些看似属于组织的存储桶，尤其是技术领域中设有漏洞披露计划的商业实体。攻击者通过下载、上传和删除文件持续与存储桶内容进行交互。最令人警觉的是，我们记录了多个实例，其中恶意攻击者下载、阅读并理解了我们蜜桶中的文档，进而试图获取未经授权的服务器访问权限。
英文摘要：
In this work, we analyze to what extent actors target poorly-secured cloud storage buckets for attack. We deployed hundreds of AWS S3 honeybuckets with different names and content to lure and measure different scanning strategies. Actors exhibited clear preferences for scanning buckets that appeared to belong to organizations, especially commercial entities in the technology sector with a vulnerability disclosure program. Actors continuously engaged with the content of buckets by downloading, uploading, and deleting files. Most alarmingly, we recorded multiple instances in which malicious actors downloaded, read, and understood a document from our honeybucket, leading them to attempt to gain unauthorized server access.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
