Potential CloudFront/S3 takeover risks

Blog

Potential CloudFront/S3 takeover risks

•

Dec 23rd, 2021

We recently helped a customer identify some potential CloudFront/S3 takeover risks. You can find the details of the risk described in the article, "Simple Route53/Cloudfront/s3 subdomain takeover".

Here are the 3 relevant questions/queries added to the library. You may want to try these questions/queries in your environment and set up alerts accordingly.

The questions are already added in-app. Simply type "cloudfront origin" in the search bar to run them.

You can then create an alert for each one. We are adding them to the alert rule packs, too.

To be clear, when you run the questions/queries highlighted, the best result is no results.

Author

Erkang Zheng

I founded JupiterOne because I envision a world where decisions are made on facts, not fear; teams are fulfilled, not frustrated; breaches are improbable, not inevitable. Security is a basic right.

We are building a cloud-native software platform at JupiterOne to deliver knowledge, transparency and confidence to every digital operation in every organization, large or small.

I am the Founder and CEO of JupiterOne, and also a cybersecurity practitioner with 20+ years experience across IAM, pen testing, IR, data, app, and cloud security. An engineer by trade, entrepreneur at heart, I am passionate about technology and solving real-world challenges. Former CISO, security leader at IBM and Fidelity Investments, I hold five patents and multiple industry certifications.