1

As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name with anyone.

If you are not familiar with it the DNS name for EBS is something like this:

{environment-name}.{random 10 character string}.{region}.elasticbeanstalk.com

I have a couple of theories:

  1. There's a script out there guessing the dns name of the application I think that's relatively hard given there is a 10 character random string in the dns name(I assume it’s random) plus the environment name.

  2. There is a script out there keeping a record of some AWS owned IPs and regularly scanning every port.
    Note: I am not using 80 or any other common port.

  3. You can somehow query elasticbeanstalk.com DNS record and get a record of all DNS names under it.

I mean it’s not bad as the admin login page, URL is random and the page is secured.

But it’s just baffling how I am being scanned without having any website linking to my application

Q: Can any security experts explain the reason for this behavior?

Any input is appreciated

  • Do you have any infosec team on the premisses? Was this the first time? – user182148 Dec 13 '18 at 12:52
  • No. I don't have any infosec team on the premisses. No It happens every time even when I change the environment (and the dns name gets changed as well) – Suliman Al Ruz Dec 13 '18 at 12:57
  • Ok. Can you see any logs from where the scan is comming from? – user182148 Dec 13 '18 at 13:03
  • Yes. for some reason the IPs are mostly coming from China – Suliman Al Ruz Dec 13 '18 at 13:13
  • some from South America – Suliman Al Ruz Dec 13 '18 at 13:16
0

Any instance/ELB on the public internet will get a public IPv4 address. There are people/bots who constantly scan for vulnerable hosts on the internet, I'm no expert on the tactics they use but its entirely possible that they scan known ranges like AWS more frequently.

A google shows up several articles on the tactics that could be used e.g.: https://www.securitynewspaper.com/2015/10/15/how-to-scan-whole-internet-3-7-billion-ip-addresses-in-few-minutes/

As an example I recently tested this by creating an instance with no DNS name, just an IP address. It was scanned 22 minutes after being created.

Bottom line is if you're concerned about the security of your IP then dont put it on the public internet, if you have to then consider an IP whitelist to just allow your address or alternatively look at AWS WAF for rules to block malicious traffic.

As an aside this is possible because the number of IPv4 addresses is relatively small. The IPv6 range is much bigger so theoretically scanning all addresses will not be possible (or at least not easily)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.