3 ms·
I think I'm not getting it. What's the problem if someone else can claim that bucket name? If it's deleted wouldn't the data be deleted too? Or is it there some
by Bridged7756 7mo ago
I think I'm not getting it. What's the problem if someone else can claim that bucket name? If it's deleted wouldn't the data be deleted too? Or is it there something I'm missing.
- echoangle 7mo agoI think you can put malicious data in the bucket and „impersonate“ the deleted bucket, so old code referencing the bucket uses your data instead of throwing an error (?).
- returningfory2 7mo agoOr old code referencing the bucket _writes_ data to it, and the attacker can now read it.
- tekla 7mo agohttps://www.aquasec.com/blog/bucket-monopoly-breaching-aws-accounts-through-shadow-resources/ https://www.aquasec.com/blog/bucket-monopoly-breaching-aws-a...