AI
The S3 Bucket Supply Chain Threat
Supply chain attacks give attackers an asymmetric advantage. Perimeter penetration is expensive; compromising a widely-used software dependency is not. S3 buckets are a clean attack surface: when a bucket is deleted, the name becomes available. Anyone can reclaim it, upload malware, enable public access, and infect every downstream client that still pulls from that URL. The same applies to malware infrastructure: when AWS takes down a bucket after an abuse report, a different attacker can claim it and take over the victim pool.
Finding Buckets at Scale
Sourcegraph indexes GitHub in seconds, letting you query petabytes of code for S3 URLs and extract bucket names with a regex. Maven Central and PyPI required 1.5 months of crawling on a home machine; Shudrak managed about 40-45% before giving up. For malware, a malware URL feed provided a direct list of AWS-hosted links without needing to unpack obfuscated samples. The haul: 480 buckets from PyPI and Maven, 188 from malware infrastructure, and 4,500 from GitHub. All were claimed, kept private, and monitored for 5 days with access logging enabled.
LLM Agents Cutting Through 26 GB of Logs
26 GB of logs and 11 million requests can’t be manually triaged. Shudrak built a three-component LLM agent: a planner/aggregator/classifier that receives a bucket name and sample requests, runs internet and GitHub searches to gather context, then issues a verdict. The agent collapsed months of review to a few days, reducing 26 GB to a few megabytes with 500 flagged buckets. Hallucinations occurred but the time savings were worthwhile. Sensitive types flagged: executables, ML models, PyPI and Maven packages, dynamic web content, config files, and write attempts.
Case Studies: Code Execution Vectors
A large network equipment vendor deleted its installer bucket after a policy change. 162 hosts were still pulling and executing the binary. A Minecraft Raspberry Pi tutorial pointed to the same abandoned bucket. PyTorch models loaded via pickle deserialization allow arbitrary code execution by design. Super Gradients (4,000 GitHub stars) served pre-built models from a reclaimed bucket; a live demo showed a poisoned model launching a calculator. A native library package used by five Fortune 500 firms, including three of the world’s largest banks, would have installed a backdoor on download.
Total Impact and Root Cause Fixes
After 5 days of log monitoring, 28,000 hosts across 158 countries would have been compromised, spanning 134 organizations and 25 government networks. The attack cost: roughly $20 for log storage. Shudrak worked with AWS to take down all identified sensitive buckets. AWS also raised the per-account bucket limit to 10,000, reducing the incentive to delete buckets. The structural fix is bucket names that are project-scoped or non-recyclable. For malware infrastructure, keeping reclaimed buckets permanently private prevents a different attacker from taking over the victim pool.
Notable Quotes
But the risk is very real. Maksim Shudrak · ▶ 1:36
arbitrary code execution by design right Maksim Shudrak · ▶ 16:02
it’s just 5 days of monitoring logs, Maksim Shudrak · ▶ 32:01
attack with relatively low cost and LLMs Maksim Shudrak · ▶ 37:09
Key Takeaways
- Deleted S3 bucket names are immediately reclaimable; a $20 budget is enough to run this attack at scale.
- LLM agents reduced log triage from months to days across 26 GB of raw traffic data.
- PyTorch pickle deserialization and Vagrant Vagrantfile commands deliver code execution without exploiting any CVE.
- 28,000 hosts across 25 government networks were in scope after just 5 days of monitoring.
- The structural fix is non-recyclable bucket names or project-scoped namespaces enforced by the cloud provider.
About the Speaker(s)
Maksim Shudrak is an offensive security researcher and engineer with more than a decade of experience in red teaming, malware analysis, and exploit development, complemented by a PhD in machine code vulnerability detection. He focuses on complex large-scale issues in modern technologies and has released open-source tools for cloud infrastructure scanning, fuzzing, and dynamic malware analysis. His work has been presented at DEF CON, VirusBulletin, and BlackHat Arsenal.