nerdexam
GIAC

GCIH · Question #714

A company was a victim of bucket squatting. What process would help to prevent this type of attack?

The correct answer is C. Private bucket creation. Bucket squatting occurs when an attacker registers a cloud storage bucket with the same name as a deleted or unclaimed bucket to intercept data. Creating buckets as private from the outset restricts public access and reduces the exploitability of squatted buckets.

Cloud Incident Response & Threat Hunting

Question

A company was a victim of bucket squatting. What process would help to prevent this type of attack?

Options

  • AIdentity verification
  • BUnique bucket classification
  • CPrivate bucket creation
  • DFile evaluation

How the community answered

(64 responses)
  • A
    5% (3)
  • B
    3% (2)
  • C
    81% (52)
  • D
    11% (7)

Why each option

Bucket squatting occurs when an attacker registers a cloud storage bucket with the same name as a deleted or unclaimed bucket to intercept data. Creating buckets as private from the outset restricts public access and reduces the exploitability of squatted buckets.

AIdentity verification

Identity verification addresses authentication of users or principals but does not prevent an external attacker from claiming an abandoned public bucket name in a cloud provider namespace.

BUnique bucket classification

Unique bucket classification is not a defined cloud security control and does not address the core problem of bucket name re-registration after deletion.

CPrivate bucket creationCorrect

Private bucket creation ensures that even if an attacker squats a bucket name, the bucket's access control policies deny public read and write access, preventing the attacker from receiving or serving data intended for the original bucket. This is the most direct technical control because bucket squatting relies on the squatted bucket being publicly accessible to intercept or serve malicious content.

DFile evaluation

File evaluation refers to inspecting contents of files and does not prevent an attacker from registering and controlling a squatted bucket.

Concept tested: Cloud storage bucket squatting prevention controls

Source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

Topics

#bucket squatting#cloud storage#S3 security#cloud misconfiguration

Community Discussion

No community discussion yet for this question.

Full GCIH Practice