An AWS S3 user reported receiving a $1,000 invoice on the second day despite having an empty bucket, due to costly unauthorized API calls targeting a commonly named bucket (e.g., “bucket-crap”). This vulnerability, dubbed “Denial of Wallet” (DoW), allows attackers to generate charges by repeatedly calling a bucket—even without access—since AWS currently bills for denied requests Rhod. AWS is investigating and plans to make unauthorized requests free of charge, covering HTTP 3xx/4xx status codes supermathie. While no Discourse sites using S3 for uploads have been reported affected maiki, users are advised to take precautions, such as using a CDN to obscure bucket names pfaffman. The situation is particularly concerning because, once an attack is detected, there is no way to stop it in real time supermathie. The issue highlights a critical billing risk for S3 users relying on default or predictable bucket names.
Post from an AWS S3 user, who on the second day had an invoice for $1000 dollars and it was empty.
Apparently the problem lies mainly in the bucket calls, which create a cost, but the problem was that this user created a bucket with a name like “bucket-crap”, said name was the one that came by default in an application, apparently widely used by companies.
However, all this revealed that this service could have a serious problem, since it could cause what they now call “DoW” “Denial of Wallet”, since any malicious user, knowing the name of said bucket could create thousands of calls to said bucket. bucket and create an exacerbated cost, because even if you do not have access to said bucket, calls to it, even if they are denied, generate a cost.
Update: S3 engineers are working to make unauthorized requests that customers did not initiate free of charge.
This change will cover a range of HTTP 3xx/4xx status codes, including all of those cited in the article. We’re moving quickly and we plan to share more details this week.