Don't use guessable names in advance on mission-critical resources TL;DR: Secure your cloud resources by avoiding predictable naming patterns. Problems Predictable names
Unauthorized access
Data exposure risks
Shadow resources
Account takeovers
Idor vulnerability
Premature Optimization Solutions Use unique bucket names with dark keys
Verify ownership on creation
Secure resources fully
Have indirections obfuscating real names
Book names to prevent squatting
Randomize names Context Resource squatting happens when attackers anticipate the naming patterns of cloud resources, like S3 buckets. The attacker creates them in regions where the user hasn’t yet deployed resources. User interaction with these attacker-owned resources can lead to severe security breaches like data exposure, unauthorized access, or account takeovers. This vulnerability is critical in environments like AWS, where predictable naming conventions are often used. Many systems avoid this indirection fearing the performance penalty which is a clear case of premature optimization. Sample Code Wrong def create_bucket(account_id, region):
    bucket_name = f"aws-glue-assets-{account_id}-{region}"
    create_s3_bucket(bucket_name)  
   # This is deterministic and open Right import uuid

def create_bucket(account_id, region):
    unique_id = uuid.uuid4().hex
    # This number is not deterministic
    # is a way to generate a random UUID (Universally Unique Identifier) 
    # in Python and then retrieve it as a hexadecimal string.
    bucket_name = f"aws-glue-assets-{unique_id}-{account_id}-{region}"
    create_s3_bucket(bucket_name)
    verify_bucket_ownership(bucket_name, account_id) Detection [x]Automatic A security audit can detect this smell by analyzing your resource names for predictability. Look for patterns in names that an attacker can easily anticipate or guess. Many automated tools and manual code reviews can help identify these risks. Tags Security Level [x]Intermediate AI Generation AI generators may create this smell using standard templates with predictable naming patterns. Always customize and review generated code for security. AI Detection AI can help detect this smell if configured with rules that identify predictable or insecure resource naming conventions. This is a security risk that requires an understanding of cloud infrastructure and potential attack vectors. Conclusion Avoiding predictable naming patterns is critical to securing your cloud resources. Always use unique, obscure, hard-to-guess names, and also, verify resource ownership to protect against squatting attacks. Relations https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxiv?embedable=true More Info https://gbhackers.com/aws-vulnerability-remote-execution/?embedable=true https://en.wikipedia.org/wiki/Cybersquatting?embedable=true Disclaimer Code Smells are my opinion. Credits Photo by Felix Koutchinski on Unsplash The only system which is truly secure is one which is switched off and unplugged, locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards. Even then, I wouldn't stake my life on it. Gene Spafford https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true This article is part of the CodeSmell Series. How to Find the Stinky Parts of your Code Don't use guessable names in advance on mission-critical resources Don't use guessable names in advance on mission-critical resources TL;DR: Secure your cloud resources by avoiding predictable naming patterns. TL;DR: Secure your cloud resources by avoiding predictable naming patterns. Problems Predictable names Unauthorized access Data exposure risks Shadow resources Account takeovers Idor vulnerability Premature Optimization Predictable names Unauthorized access Data exposure risks Shadow resources Account takeovers Idor vulnerability Idor vulnerability Premature Optimization Solutions Use unique bucket names with dark keys Verify ownership on creation Secure resources fully Have indirections obfuscating real names Book names to prevent squatting Randomize names Use unique bucket names with dark keys Verify ownership on creation Secure resources fully Have indirections obfuscating real names Book names to prevent squatting squatting Randomize names Context Resource squatting happens when attackers anticipate the naming patterns of cloud resources, like S3 buckets. The attacker creates them in regions where the user hasn’t yet deployed resources. yet User interaction with these attacker-owned resources can lead to severe security breaches like data exposure, unauthorized access, or account takeovers. This vulnerability is critical in environments like AWS, where predictable naming conventions are often used. Many systems avoid this indirection fearing the performance penalty which is a clear case of premature optimization. Sample Code Wrong def create_bucket(account_id, region):
    bucket_name = f"aws-glue-assets-{account_id}-{region}"
    create_s3_bucket(bucket_name)  
   # This is deterministic and open def create_bucket(account_id, region):
    bucket_name = f"aws-glue-assets-{account_id}-{region}"
    create_s3_bucket(bucket_name)  
   # This is deterministic and open Right import uuid

def create_bucket(account_id, region):
    unique_id = uuid.uuid4().hex
    # This number is not deterministic
    # is a way to generate a random UUID (Universally Unique Identifier) 
    # in Python and then retrieve it as a hexadecimal string.
    bucket_name = f"aws-glue-assets-{unique_id}-{account_id}-{region}"
    create_s3_bucket(bucket_name)
    verify_bucket_ownership(bucket_name, account_id) import uuid

def create_bucket(account_id, region):
    unique_id = uuid.uuid4().hex
    # This number is not deterministic
    # is a way to generate a random UUID (Universally Unique Identifier) 
    # in Python and then retrieve it as a hexadecimal string.
    bucket_name = f"aws-glue-assets-{unique_id}-{account_id}-{region}"
    create_s3_bucket(bucket_name)
    verify_bucket_ownership(bucket_name, account_id) Detection [x]Automatic [x] Automatic [x] A security audit can detect this smell by analyzing your resource names for predictability. Look for patterns in names that an attacker can easily anticipate or guess. Many automated tools and manual code reviews can help identify these risks. Tags Security Security Level [x]Intermediate [x] Intermediate [x] AI Generation AI generators may create this smell using standard templates with predictable naming patterns. Always customize and review generated code for security. AI Detection AI can help detect this smell if configured with rules that identify predictable or insecure resource naming conventions. This is a security risk that requires an understanding of cloud infrastructure and potential attack vectors. Conclusion Avoiding predictable naming patterns is critical to securing your cloud resources. Always use unique, obscure, hard-to-guess names, and also, verify resource ownership to protect against squatting attacks. Relations https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxiv?embedable=true https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxiv?embedable=true More Info https://gbhackers.com/aws-vulnerability-remote-execution/?embedable=true https://gbhackers.com/aws-vulnerability-remote-execution/?embedable=true https://en.wikipedia.org/wiki/Cybersquatting?embedable=true https://en.wikipedia.org/wiki/Cybersquatting?embedable=true Disclaimer Code Smells are my opinion . opinion Credits Photo by Felix Koutchinski on Unsplash Felix Koutchinski Unsplash The only system which is truly secure is one which is switched off and unplugged, locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards. Even then, I wouldn't stake my life on it. The only system which is truly secure is one which is switched off and unplugged, locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards. Even then, I wouldn't stake my life on it. Gene Spafford Gene Spafford https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true This article is part of the CodeSmell Series. How to Find the Stinky Parts of your Code How to Find the Stinky Parts of your Code

Code Smell 264 - Hanlon's Razor

Code Smell 262 - Not Replaced Constants

Buy My Book

Share your ideas with me!

Read My Stories

Buy Me a Coffee

Too Long; Didn't Read

Make resilience your competitive advantage

Code Smell 263 - Squatting

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

10 Predictions About the Future of Finance

101 Stories To Learn About Cloud Infrastructure

10 Things in Engineering We Don't Spend Enough Time On

10 Things I Did To Increase CloudTrail Logs Security

10 reasons to give cloud computing a go

10 Predictions About the Future of Finance

101 Stories To Learn About Cloud Infrastructure

10 Things in Engineering We Don't Spend Enough Time On

10 Things I Did To Increase CloudTrail Logs Security

10 reasons to give cloud computing a go

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps