The popularity of cloud hosting services also brings in new security chal- lenges: it has been reported that these services are increasingly utilized by miscreants for their malicious online activities. Mitigating this emerging threat, posed by such “bad repositories” (simply Bar), is challenging due to the different hosting strategy to traditional hosting service, the lack of direct observations of the repositories by those outside the cloud, the reluctance of the cloud provider to scan its customers’ repositories without their consent, and the unique evasion strategies employed by the adversary. In this paper, we took the first step toward understanding and detecting this emerging threat. Using a small set of “seeds” (i.e., confirmed Bars), we identified a set of collective features from the websites they serve (e.g., attempts to hide Bars), which uniquely characterize the Bars. These features were utilized to build a scanner that detected over 600 Bars on leading cloud platforms like Amazon, Google, and 150 K sites, including popular ones like groupon.com, using them. Highlights of our study include the pivotal roles played by these repositories on malicious infrastructures and other important discoveries include how the adversary exploited legitimate cloud repositories and why the adversary uses Bars in the first place that has never been reported. These findings bring such malicious services to the spotlight and contribute to a better understanding and ultimately eliminating this new threat.

中文翻译：

---

云存储库作为恶意服务：挑战、识别和暗示

云托管服务的普及也带来了新的安全挑战：据报道，不法分子越来越多地利用这些服务进行恶意在线活动。由于与传统托管服务不同的托管策略、云外部人员缺乏对存储库的直接观察、云提供商的不情愿，减轻这种由此类“不良存储库”（简称 Bar）构成的新兴威胁具有挑战性在未经客户同意的情况下扫描客户的存储库，以及对手采用的独特规避策略。在本文中，我们迈出了了解和检测这种新兴威胁的第一步。使用一小组“种子”（即已确认的 Bars），我们从它们所服务的网站中确定了一组集体特征（例如，试图隐藏 Bars），这是酒吧的独特特征。这些功能被用来构建一个扫描仪，该扫描仪在亚马逊、谷歌等领先云平台和 15 万个网站（包括 groupon.com 等流行网站）上检测到 600 多个 Bars，使用它们。我们研究的重点包括这些存储库在恶意基础设施中发挥的关键作用，其他重要发现包括攻击者如何利用合法的云存储库以及攻击者为什么首先使用从未被报道过的 Bars。这些发现使此类恶意服务成为人们关注的焦点，有助于更好地了解并最终消除这种新威胁。包括像 groupon.com 这样的流行网站，使用它们。我们研究的重点包括这些存储库在恶意基础设施中发挥的关键作用，其他重要发现包括攻击者如何利用合法的云存储库以及攻击者为什么首先使用从未被报道过的 Bars。这些发现使此类恶意服务成为人们关注的焦点，有助于更好地了解并最终消除这种新威胁。包括像 groupon.com 这样的流行网站，使用它们。我们研究的重点包括这些存储库在恶意基础设施中发挥的关键作用，其他重要发现包括攻击者如何利用合法的云存储库以及攻击者为什么首先使用从未被报道过的 Bars。这些发现使此类恶意服务成为人们关注的焦点，有助于更好地了解并最终消除这种新威胁。