Researchers at Unit 42 have uncovered a serious cloud attack technique called bucket hijacking, confirmed to work across Google Cloud, AWS and Microsoft Azure, all three of which were notified through responsible disclosure. The method exploits a simple but fundamental flaw: cloud storage bucket names are globally unique, meaning whoever owns the name owns the destination.
An attacker holding bucket deletion permissions inside the target environment can delete an active storage bucket, immediately re-register the same name — on Azure they'd need to be in the same tenant — and watch the original data stream of audit logs, telemetry and metrics flow silently into their environment. No alerts fire. No errors appear. The pipeline just keeps running.
Unit 42 has seen no sign of this being used in the wild, and notes that's cold comfort: once deployed, it would be extremely hard to detect. The biggest exposure is the broad storage-admin roles enterprises hand out routinely.
Unit 42 recommends restricting deletion permissions, enforcing data perimeter controls like AWS SCPs and Google Cloud VPC Service Controls, monitoring bucket deletion API calls closely, and enabling AWS account-regional S3 namespaces where available.
Source: Cybersecurity News