The Bucket List: Experiences Operating S3 Honeypots
summary
Built a fleet of 100 honeypots (public S3 buckets) with access logging feeding a private bucket and Kinesis/Lambda postprocessing, and the experiment works — buckets get hits within hours. About 550 unique IPs touch the buckets (50% US), median 40 requests per day, average 200, and 13 buckets are touched daily. Observed 34 IAM users, 13% of actors run intensive tooling (boto, AWS CLI, Go/Python/Ruby scripts, PhantomJS, wordlists, custom enumerators), one third download data, and canary tokens + access logs prove operational value.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:06The problem
- 2:28AWS
- 4:45Enumerating Buckets
- 5:38Word Lists
- 6:27Microsoft
- 7:02AWS S3
- 7:24Bucket List
- 10:36Who was doing this
- 13:45Bucket scripting
- 14:50Bucket targeting
- 16:03Custom tools
- 16:40Severity
- 17:23Sophisticated
- 21:29Key takeaways
- 22:36Is this something that was valuable
- 22:52How easy was it to deploy
- 23:30What is the value
related talks
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
26mLooking at 4 years of web honeypot attacks: tactics, ...
43mGame of Hacks: The Mother of All Honeypots
25mBreach Detection At Scale With AWS Honey Tokens
43mThink like a HACKER
50mThe Anatomy of Cloud Attacks
31mIncident Response Investigations in the Age of the Cloud
32mFaking a Factory: Creating and Operating a Realistic Honeypot