The Bucket You Deleted Is Still in Your DNS: S3 Bucket Takeover at Bime
✓ Human-authored analysis; AI used for formatting and proofreading. In 2016, a researcher found that a2.bime.io had a CNAME record pointing to bimeio.s3.amazonaws.com . The bucket bimeio did not exist. It was not owned by Bime. It was not owned by anyone. The researcher created the bucket in their own AWS account. a2.bime.io was now serving their content under Bime's domain, with Bime's SSL…
In 2016, a researcher discovered that the subdomain a2.bime.io had a CNAME record pointing to a non-existent S3 bucket named bimeio. The researcher created the empty bucket in their own AWS account, which allowed them to serve content under Bime's domain using Bime's SSL certificate. This vulnerability, reported as HackerOne #121461, highlights an issue with S3 bucket takeover attacks.
When an S3 bucket is deleted, its name becomes available immediately for anyone to claim. If a DNS CNAME still points to that bucket's S3 endpoint, the attacker can control what the DNS record resolves to, even without credentials or exploit. The attack requires only three commands: finding the dangling CNAME, checking if the bucket exists, and registering the domain.
Traditional security tools may miss this vulnerability because they only scan AWS accounts for S3 buckets, but the bucket does not exist in the account inventory. The gap between the AWS account and DNS zone inventories allows the attacker to exploit the situation. The recommended remediation is either claiming the bucket name or removing the CNAME, both of which can be done in under a minute.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
