© Xiaojing Liao, Georgia TechBad repositories map: This map shows locations where the impacts of bad repositories (Bars) occur.
A study of 20 major cloud hosting services has found that as many as
10 percent of the repositories hosted by them had been compromised -- with several hundred of the "buckets" actively providing malware. Such bad content could be challenging to find, however, because it can be rapidly assembled from stored components that
individually may not appear to be malicious.To identify the bad content, researchers created a scanning tool that looks for features unique to the bad repositories, known as
"Bars." The features included certain types of
redirection schemes and "gatekeeper" elements designed to protect the malware from scanners. Researchers from the Georgia Institute of Technology, Indiana University Bloomington and the University of California Santa Barbara conducted the study.
Believed to be the first systematic study of cloud-based malicious activity, the research will be presented October 24 at the ACM Conference on Computer and Communications Security in Vienna, Austria. The work was supported in part by the National Science Foundation.
"Bad actors have migrated to the cloud along with everybody else," said Raheem Beyah, a professor in Georgia Tech's School of Electrical and Computer Engineering. "The bad guys are
using the cloud to deliver malware and other nefarious things while remaining undetected. The resources they use are compromised in a variety of ways, from traditional exploits to simply taking advantage of poor configurations."
Beyah and graduate student Xiaojing Liao found that the bad actors could
hide their activities by keeping
components of their malware in separate repositories that by themselves didn't trigger traditional scanners. Only when they were needed to launch an attack were the different parts of this malware assembled.
Comment: From Spaceweather.com: