Measuring and Mitigating the Risk of IP Reuse on Public Clouds · HackerPapers discussions

Measuring and Mitigating the Risk of IP Reuse on Public Clouds — mentioned by ericpauley

Wed, 22 Jan 2025 19:04:14 GMT

I'll chime in here as this is (very) related to my research. This instance of openly-registerable nameservers is just one (relatively rare) subset of a wide class of dangling DNS issues [1]. Much more common is direct mapping of names to IP addresses on cloud providers that can be obtained by attackers [2][3]. Because of the scope and lack of global visibility that often comes with cloud services, an enterprise that uses is the cloud is very likely to have some vulnerabilitity like this under some subdomain. Unfortunately bug bounty programs often blanket exclude any form of "subdomain…

Paper and discussion history. A mention is not an endorsement.

Measuring and Mitigating the Risk of IP Reuse on Public Clouds — HN submission

Mon, 09 Jan 2023 10:03:07 GMT

Measuring and Mitigating the Risk of IP Reuse on Public Clouds

1 point; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Measuring and Mitigating the Risk of IP Reuse on Public Clouds — mentioned by ericpauley

Sun, 08 Jan 2023 22:44:15 GMT

Security vulnerabilities due to resource reuse (subdomain takeover is just one example of this) are rampant and readily exploitable for tons of major companies, especially as cloud providers and SaaS often overlook these as being client responsibilities. Shameless plug, I’ve worked on identifying/characterizing these issues on cloud providers: https://arxiv.org/pdf/2204.05122.pdf It’s only a matter of time before adversaries become more sophisticated at identifying and exploiting these in bulk.

Paper and discussion history. A mention is not an endorsement.

Measuring and Mitigating the Risk of IP Reuse on Public Clouds — HN submission

Fri, 15 Apr 2022 14:29:50 GMT

Measuring and Mitigating the Risk of IP Reuse on Public Clouds

3 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.