Hello Reader,
Today I wanted to share an important lesson I learned while creating a test cloud environment. Whenever I need to generate a test dataset for my SANS class or other public events, I typically create a new fictional company to host my tests. This time, I thought I'd simplify my life by performing all cloud setups within an AWS VM, allowing me to conveniently store and save snapshots for future use.
However, I inadvertently discovered a detection rule shared by AWS, Microsoft, and Google:
"Never allow account sign-ups originating from an AWS EC2 IP—EVER."
Here's what happened when I attempted to create new accounts from an AWS EC2 instance:
- Microsoft Azure: Allowed initial sign-up, but redirected me to a blank "unknown error" page.
- Microsoft 365: Similarly allowed account creation attempts but ended in an error.
- Outlook.com: Immediately displayed an error preventing account creation.
- Google Cloud: Appeared to allow account creation initially, but consistently rejected every phone number provided for validation.
The key takeaway is clear: Due to extensive fraud originating from cloud IP ranges, you must use either a VPS or your personal IP for such activities.
Tomorrow, I'll discuss strategies for reliably receiving SMS verification codes.
Also Read: Things not to do when creating test clouds part 2
Post a Comment