IP address reuse in public clouds

Cloud providers reassign IP addresses from one tenant to the next. When a tenant releases an address but leaves DNS records or service configurations pointing at it, traffic meant for that tenant reaches whoever holds the address next. We call attacks that exploit this cloud squatting.

To measure it (IEEE S&P 2022), we ran a telescope in the AWS us-east-1 region for 101 days in 2021. It held 1.5 million unique IP addresses, about 56% of the available pool, and received over 5 million cloud messages. Many contained sensitive data such as financial transactions, GPS locations, and personal information. We identified 5,446 exploitable domains, 23 of them in the top 1,000. Amazon planned mitigations in response.

The defense depends on how a provider hands out addresses. Our NDSS 2025 paper models tenant deployment behavior and evaluates allocation policies against an adversary who controls many tenants. The policy we designed, IP scan segmentation, limits how quickly an adversary can sample addresses from the pool. EIPSim, the simulator used for that evaluation, is open source.