A Comparative Analysis of Honeypots on Different Cloud Platforms.

Christopher Kelly,Alexios Mylonas,Sean Mckeown,William J Buchanan,Nikolaos Pitropakis

doi:10.3390/s21072433

Christopher Kelly, Alexios Mylonas + Show 3 more

Open Access

https://doi.org/10.3390/s21072433

Copy DOI

Abstract

In 2019, the majority of companies used at least one cloud computing service and it is expected that by the end of 2021, cloud data centres will process 94% of workloads. The financial and operational advantages of moving IT infrastructure to specialised cloud providers are clearly compelling. However, with such volumes of private and personal data being stored in cloud computing infrastructures, security concerns have risen. Motivated to monitor and analyze adversarial activities, we deploy multiple honeypots on the popular cloud providers, namely Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure, and operate them in multiple regions. Logs were collected over a period of three weeks in May 2020 and then comparatively analysed, evaluated and visualised. Our work revealed heterogeneous attackers’ activity on each cloud provider, both when one considers the volume and origin of attacks, as well as the targeted services and vulnerabilities. Our results highlight the attempt of threat actors to abuse popular services, which were widely used during the COVID-19 pandemic for remote working, such as remote desktop sharing. Furthermore, the attacks seem to exit not only from countries that are commonly found to be the source of attacks, such as China, Russia and the United States, but also from uncommon ones such as Vietnam, India and Venezuela. Our results provide insights on the adversarial activity during our experiments, which can be used to inform the Situational Awareness operations of an organisation.

Highlights

It is estimated that one in four businesses will run their applications solely on the cloud within a year [1]
Our work investigated the different types of attacks being deployed across the Internet against the most popular Infrastructure as a Service (IaaS) cloud computing environments, namely Google Cloud Platform (GCP), Amazon Web Services (AWS) and Microsoft Azure
In this work honeypots were deployed on all popular cloud providers, operating in multiple regions, i.e., North America, Europe and Asia, in order to study the techniques employed by the threat actors

Summary

Introduction

It is estimated that one in four businesses will run their applications solely on the cloud within a year [1] This involves moving all their IT infrastructure to cloud-based providers to utilise either a private and/or public cloud structure. In the current threat landscape, threat actors are active constantly across the world, attempting to exploit new and existing vulnerabilities, which often could be decades old Such an incident happened recently, where yet another large-scale breach was witnessed with Capital One’s customers data being exposed [2]. Platform as a Service (PaaS)—the vendor provides higher-level application services where the business can create its own custom applications. Infrastructure as a Service (IaaS)—provides a backbone by providers such as Google, Amazon, and Microsoft where the services can be rented by businesses

Objectives

Methods

Results

Conclusion