Poisoned Pipeline / Techniques / T0126
Exposed storage
Exposed storage is an attack technique where an attacker targets and exploits cloud storage containers or buckets that are publicly accessible or have weak access controls.
The attacker can gain access to sensitive data stored in the containers, such as personal information, financial data, or intellectual property.
Exposed storage can occur due to misconfigured access controls, where the data is mistakenly made publicly available or accessible to unauthorized users.
This can occur when the default security settings for cloud storage services are not properly adjusted, or when access controls are not regularly reviewed and updated.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
- https://www.trendmicro.com/vinfo/es/security/news/virtualization-and-cloud/a-misconfigured-amazon-s3-exposed-almost-50-thousand-pii-in-australia
- https://www.darkreading.com/application-security/cloud-misconfig-exposes-3tb-sensitive-airport-data-amazon-s3-bucket
Mitigations
- M1240 Enable data encryption at rest
- M1260 Implement least privilege access
- M1261 Implement proper access control for cloud storages
- M1550 Implement strict access control for clouds
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment