AI
Why Abandoned Cloud Buckets Are a Supply Chain Risk
Attackers target supply chains to amplify reach. A single abandoned S3 bucket, once reclaimed, can deliver malware to every system that still references it. The bucket namespace is recyclable: after deletion, anyone can claim the same name. This turns a forgotten resource into a code execution vector. At scale, the blast radius can hit thousands of hosts. Red teamers know perimeter penetration is hard; supply chain attacks invert the effort-to-impact ratio.
Scaling Bucket Discovery Across Code Repositories and Malware
Max searched GitHub source code using SourceGraph for S3 bucket references. Extracting bucket names with regex took seconds. For Maven and PyPI, he crawled repositories over 1.5 months, covering 40-45% of packages. For malware, he used URL host to get all links to Amazon S3. The result: 4,500+ buckets from GitHub, 480 from package repos, 188 from malware.
28,000 Hosts and 25 Government Networks at Risk in Five Days
In five days of monitoring, Max’s claimed buckets received 11 million requests. 28,000 unique hosts from 158 countries pulled data. 134 organizations and 25 government networks would have been compromised. The attack cost effectively zero: only log storage. The total impact is likely much larger; this is just five days of data.
PyTorch Pickle Pipelines: Code Execution via Abandoned Models
A popular open-source project with 4,000 stars served pre-built PyTorch models from an S3 bucket. After the bucket was abandoned, 162 hosts still downloaded the model. PyTorch uses pickle deserialization, which allows arbitrary code execution by design. Max demonstrated poisoning the model to pop a calculator. Similarly, a five-year-old pip package referenced a pre-built binary from a reclaimed bucket; installing it installed a backdoor library on five Fortune 500 companies, including three of the largest banks.
Hijacking Malware Infrastructure: RK Stealer and Linker Extension
Two malware families dominated the traffic: RK stealer and Linker. Linker is a malicious Chrome extension masquerading as B9 apps on the web store. It injects JavaScript from the claimed bucket into every webpage visited. Max showed that on TikTok, Amazon S3 is allowed in the CSP, so exfiltration works. RK stealer pretends to be a useful executable and pulls stage-two payloads over HTTP. In a Windows VM, fake Netcat served a calculator to the malware, which executed it blindly.
Root Cause: Recyclable Namespaces and the Need for Secure-by-Default Cloud
Max collaborated with AWS to remediate sensitive buckets. AWS sold the buckets to prevent reclamation. The root cause is the recyclable bucket namespace. Max argues for non-recyclable bucket names or project-scoped names where the project ID is immutable. For malware, keeping buckets always private would starve the supply chain. Static code analysis tools already exist to detect dangling bucket references; Max urges developers to run them before deleting a bucket.
Notable Quotes
the risk is very real Max · ▶ 1:36
it’s just 5 days of monitoring logs Max · ▶ 32:04
28,000 users Max · ▶ 31:48
Key Takeaways
- Abandoned S3 buckets are a supply chain risk: 4,500+ buckets reclaimed, affecting 28,000 hosts.
- Attackers need zero budget; LLMs help triage 26 GB of logs down to 500 sensitive buckets.
- Fixing the root cause requires non-recyclable bucket names or always keeping buckets private.
About the Speaker(s)
Roni Carta, known as Lupin and co-founder of Lupin & Holmes, is an ethical hacker specializing in offensive cybersecurity, with a strong background in bug bounty hunting, including a $50,000 reward for hacking Google AI, red teaming at ManoMano, and significant research into software supply chain vulnerabilities, notably presenting at DEF CON 32 and recently reporting a hack of Google’s AI Gemini; his diverse technical skills range from ATO and RCE exploits to supply chain security, earning him recognition in various cybersecurity competitions.