Honey Configs: Measuring The Emerging Exploitation of Cloud IP Address Reuse#

Authors: Eric Pauley (Virginia Tech & Terrace Networks), Yohan Beugin (University of Wisconsin-Madison), Paul Barford (University of Wisconsin-Madison), Patrick Traynor (University of Florida), Patrick McDaniel (University of Wisconsin-Madison)

• Why: The 2021 "cloud IP address reuse" vulnerability class (tenants pinning trust — allowlists, firewall rules, cert SANs — to public IPs that the provider will re-allocate to someone else) is directly relevant to anyone operating multi-cloud infrastructure. This is one of the few papers measuring both whether defenders fixed it and whether attackers are actually exploiting it.
• What: A three-year longitudinal study of defender and attacker response. The headline findings are bad on both sides: 60% of originally-observed vulnerabilities were still present years after disclosure, and exploitation has increased 39x since the original disclosures. The active measurement surfaces a global, multi-cloud adversarial apparatus that identifies and exploits latent configurations — hosting malicious content, mal-issuing TLS certificates, and executing cookie-based attacks on target sites. (from abstract only)
• How: Combines passive data (the DScope Internet telescope, certificate transparency logs) with a new active technique — honey configurations — deliberately deployed configurations that act as tripwires to directly measure exploitation rather than infer it.
• Where applicable: Any organization using public cloud IPs with IP-bound trust relationships. Broadly applicable across major cloud providers; the attacker observations are from research vantage points, so treat specific attacker behaviors as a lower bound rather than a census.