So apparently if someone knows / guesses the name of your S3 bucket - even if it's private (!) - they can just bankrupt you by sending infinite PUT requests and there is nothing you can do about it.
— Laura Wendel (@Lauramaywendel) April 29, 2024
> requests get rejected
> but AWS still counts it as a write operation against… pic.twitter.com/oFavRPau2N
Denial of wallet attacks or How an empty s3 bucket can make your bills explode
https://x.com/Lauramaywendel/status/1785064878643843085
- 13
- 21
Jump in the discussion.
No email address required.
How long until this is used in an attack?
Jump in the discussion.
No email address required.
Apparently already, but what it probably means is an neurodivergent like could probably bankrupt someone instead of just knocking them off the internet
Jump in the discussion.
No email address required.
Wonder if Amazon will fix it fast now that it's all over twitter.
Jump in the discussion.
No email address required.
More options
Context
Sweaty. Does Lucas look like he has the intelligence to pull off anything other than slow-talk whining on the Internet like the useless pill head he is?
Jump in the discussion.
No email address required.
Someone fricked with kf, might not have been lucas but he was the face of it
Jump in the discussion.
No email address required.
Whatta face!! Hubba hubba
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
More options
Context
More options
Context
People who use AWS deserve bankruptcy.
Jump in the discussion.
No email address required.
Jump in the discussion.
No email address required.
More options
Context
More options
Context
Just put your shit behind a WAF, goddarn. Unless this applies to straight-up any S3 bucket regardless of config?
Jump in the discussion.
No email address required.
Yes that's the whole point. If you have the bucket's name you can bankrupt them by sending unauthenticated requests. Even if you use Virtual Private Cloud (AWS analogue of a firewall) and only whitelist certain ip address access to your s3 bucket they can still do this.
Jump in the discussion.
No email address required.
I didn't read it, but I imagine traffic would get caught by the firewall without ever reaching the bucket service, no?
Jump in the discussion.
No email address required.
There's still a direct URL to the bucket. Fairly certain I've had those type of requests blocked by CloudFront w/ WAF in the past, but I have no idea if there's still a way to use the S3 API to ping it.
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
More options
Context
Snapshots:
https://x.com/Lauramaywendel/status/1785064878643843085:
ghostarchive.org
archive.org
archive.ph (click to archive)
Jump in the discussion.
No email address required.
More options
Context